1. INTRODUCTION

Weladee Form ("We," "Us," "Our," or "Company") is committed to protecting the privacy of our users and complying with Thailand's Personal Data Protection Act, BE 2562 (2019) ("PDPA"). This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use our form management platform ("Service").

This Privacy Policy applies to Weladee customers who are Human Resources professionals and authorized personnel accessing Weladee Form for HR-related purposes, as well as individuals who submit responses to forms created on the Weladee Form platform.

2. ABOUT US

Company Name: Frontware International Co., Ltd.

Tax ID: 0-1055-40087-06-1

Address: 1213/390 Soi Ladprao 94, Plubpla, Wangthonglang, Bangkok 10310, Thailand

Telephone: +66 2 559 2308

Email: [email protected]

Website: https://form.weladee.com

3. SCOPE AND APPLICABILITY

3.1 Data Controller

Weladee Form (Frontware International Co., Ltd.) operates as a Data Controller under the PDPA for personal data collected directly through the platform.

3.2 Who This Policy Applies To

Primary Users: HR professionals and authorized personnel who create and manage forms on Weladee Form
Data Subjects: Individuals whose personal data is submitted through forms created and distributed on Weladee Form (including employees, candidates, survey respondents, and other form participants)

3.3 Weladee Form as a Data Processor

When our customers use Weladee Form to collect personal data from their respondents, Weladee Form acts as a Data Processor processing data on behalf of the customer (who acts as the Data Controller). The customer remains responsible for providing privacy notices to their respondents and obtaining necessary consents. We process this data only according to the customer's instructions and our Data Processing Agreement.

4. WHAT PERSONAL DATA WE COLLECT

4.1 Form Response Data

The primary data we collect and store is personal data submitted by individuals through forms created on Weladee Form. This includes:

Information entered into form fields created by our customers
Respondent name, contact information, and responses to custom questions
Timestamps of form submission
IP address of the form respondent (if form creator enables this feature)
Any attachments uploaded through forms

Important: The specific types of personal data collected depend entirely on what questions the form creator includes in their form.

4.2 Account Information (Form Creators/HR Users)

When you register for Weladee Form as an HR professional, we collect:

Full name
Email address
Phone number (optional)
Company name
Job title/designation
Username and password
Company account information and billing details

4.3 Usage and Technical Data

When accessing Weladee Form, we collect:

Device type and operating system
Browser type and version
IP address
Pages accessed and time spent on pages
Login times and session information
Click patterns and interaction with the platform
Cookies and similar tracking technologies (for analytics and security)

4.4 Communication Data

Email correspondence with our support team
Support tickets and inquiries
Feedback and suggestions
Complaint information

5. LEGAL BASIS FOR PROCESSING PERSONAL DATA

We process personal data under the following legal bases as defined by the PDPA:

5.1 Explicit Consent

We obtain your explicit written consent before processing personal data for purposes not strictly necessary for the Service delivery. This includes marketing communications and non-essential analytics.

5.2 Performance of Contract

We process personal data necessary to:

Establish and maintain your Weladee Form account
Deliver and provide access to the Service
Process payments and billing
Fulfill your requests

5.3 Compliance with Legal Obligations

We process personal data to comply with Thai laws, regulations, court orders, and government requests.

5.4 Legitimate Interests

We process certain data for our legitimate business purposes, including:

Improving and optimizing the Service
Detecting and preventing fraud and unauthorized access
Enhancing security and protecting against data breaches
Analyzing platform usage and performance
Conducting system maintenance and troubleshooting

6. PURPOSES OF PERSONAL DATA PROCESSING

We collect and process personal data for the following purposes:

6.1 Service Delivery

Creating and maintaining your Weladee Form account
Storing and managing form responses you collect
Providing technical support and customer service
Processing payments and sending invoices
Sending service-related notifications and updates

6.2 Service Improvement and Analytics

Analyzing platform usage patterns and user behavior
Identifying trends and optimizing features
Improving system performance and stability
Conducting user testing and research
Monitoring service quality and availability

6.3 Security and Fraud Prevention

Detecting and preventing fraudulent activities
Protecting against unauthorized access and data breaches
Monitoring and maintaining system security
Enforcing our Terms of Service and legal agreements
Investigating suspicious activities

6.4 Compliance and Legal Obligations

Meeting legal and regulatory requirements in Thailand
Responding to lawful government and court requests
Maintaining audit trails and compliance records
Resolving disputes and legal claims

6.5 Marketing and Communications (with consent)

Sending product updates and announcements
Notifying you of new features or services
Conducting customer surveys and feedback initiatives
Direct marketing via email or phone (only with explicit consent)

7. DATA STORAGE AND RETENTION

7.1 Where Data is Stored

All personal data collected through Weladee Form is stored on our secure servers located in Thailand or in jurisdictions that provide adequate data protection standards as determined by the PDPC.

7.2 How Long We Keep Your Data

Form Response Data (collected from form respondents):

Stored indefinitely on our servers until the customer who created the form decides to delete it
The form creator has full control over when form responses are deleted
Once deleted, data is permanently removed from our active systems (though backup copies may be retained for 30 days for disaster recovery purposes)

Account Information (for form creators/HR users):

Retained for the duration of your active account
Retained for 2 years after account termination for legal, tax, and compliance purposes
May be deleted upon request if no legal obligations require retention

Usage and Technical Data:

Analytics data: retained for up to 12 months
Log files: retained for up to 90 days
Backup data: may be retained longer for disaster recovery purposes (maximum 30 days)

Support and Communication Records:

Retained for 3 years for dispute resolution and compliance purposes
May be retained longer if required by law

7.3 Your Right to Delete Data

If you are a form respondent: You have the right to request deletion of your submitted data. Please contact the form creator (your employer or the organization that sent you the form) or contact us at [email protected].

If you are a form creator: You have full control over your form data and can delete forms and all associated responses at any time through your account dashboard.

7.4 Deletion of Account

Upon request, we will delete your account and associated personal data unless:

Retention is required by Thai law or court order
Data is necessary for ongoing contract performance or disputes
Data relates to investigations or complaints
We have legitimate legal or business interests requiring retention

Deletion of your account does not automatically delete form responses that were submitted to your forms; you must separately delete forms to remove that data.

8. YOUR RIGHTS AS A DATA SUBJECT (PDPA RIGHTS)

Under the PDPA, you have the following rights. To exercise any of these rights, please contact us at [email protected].

8.1 Right to Be Informed

You have the right to receive clear, transparent information about how we collect, use, and process your personal data. This Privacy Policy provides such information.

8.2 Right of Access

You have the right to request and obtain a copy of your personal data that we hold, including:

Your account information
Form responses you have submitted
Your usage and activity data
Any other personal data we process about you

We will provide this information free of charge within 30 days of your verified request.

8.3 Right to Rectification

You have the right to correct, update, or amend inaccurate, incomplete, or misleading personal data. You may update your account information directly in your account settings. For other data, please submit a formal request to [email protected].

8.4 Right to Erasure

You have the right to request deletion or de-identification of your personal data, except where:

Retention is required by Thai law or court order
Data is necessary for contract performance
Data relates to legal claims or investigations
Other legitimate legal obligations apply

We will respond to deletion requests within 30 days. Note: Deleting your account does not automatically delete form responses already submitted to your forms.

8.5 Right to Object

You have the right to object to:

Processing of your data for direct marketing purposes
Processing based on our legitimate interests (we will cease processing unless we have compelling reasons)
Automated decision-making that produces legal or similarly significant effects

8.6 Right to Withdraw Consent

If you have provided consent for any processing activity, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

8.7 Right to Data Portability

You have the right to request your personal data in a structured, commonly used, machine-readable electronic format (such as CSV or JSON) and to receive it within 30 days. Data will be provided in a format that allows you to transmit it to another service provider.

8.8 How to Exercise Your Rights

To exercise any of these rights:

Contact us at:

Email: [email protected]
Address: 1213/390 Soi Ladprao 94, Plubpla, Wangthonglang, Bangkok 10310, Thailand
Telephone: +66 2 559 2308

In your request, please:

Provide your name and email address
Specify which right you wish to exercise
Include any supporting documentation or evidence of identity
Provide details of the data or account in question

We will verify your identity before fulfilling your request to protect your privacy. Response time: 30 days from receipt of a verified request.

9. SENSITIVE PERSONAL DATA

9.1 Special Handling Requirements

If forms on Weladee Form collect sensitive personal data as defined by the PDPA, including:

Health information
Genetic data
Racial or ethnic origin
Political opinions
Religious beliefs
Sexual life or orientation
Criminal history or judicial records
Trade union membership
Biometric data

The form creator (customer) is responsible for:

Obtaining explicit written consent from respondents before collecting such data
Providing clear notices about the collection of sensitive data
Implementing enhanced security and confidentiality measures
Limiting processing to specified, legitimate purposes
Ensuring compliance with PDPA requirements

9.2 Our Commitment

We treat all sensitive data stored on our platform with the highest level of security and confidentiality. We implement enhanced access controls and encryption for sensitive data.

9.3 Form Creator Responsibility

As a form creator, you are responsible for informing your respondents about the collection of sensitive data and obtaining necessary consents before creating forms that collect such information.

10. DATA SHARING AND DISCLOSURE

10.1 No Unauthorized Sharing

We do not sell, rent, lease, or share personal data to third parties for marketing purposes or any other purpose except as explicitly described in this policy.

10.2 Form Response Sharing

Form responses collected on Weladee Form are:

Visible only to authorized users of the account that created the form
Shared only with others if the form creator explicitly grants them access to that account or form
Not shared with any third party unless the form creator authorizes it

10.3 Service Providers and Data Processors

We may share personal data with third-party service providers who act as Data Processors on our behalf, under strict contractual obligations. These may include:

Cloud hosting and server providers
Analytics and monitoring services (e.g., Google Analytics)
Payment processors
Email delivery and communication services
Customer support platforms
Security and fraud prevention services

All service providers:

Are contractually bound to comply with the PDPA
Are prohibited from using data for any purpose other than providing their services
Maintain appropriate technical and organizational security measures
Are subject to our audit and oversight

10.4 Cross-Border Data Transfers

Personal data is primarily stored on servers in Thailand. Any transfer of personal data to countries outside Thailand will only occur to jurisdictions that have adequate data protection standards as determined by the PDPC, or where we have implemented appropriate safeguards such as Standard Contractual Clauses.

Users will be notified in advance of any international data transfers.

10.5 Legal Obligations and Law Enforcement

We may disclose personal data when required by:

Court orders, subpoenas, or legal process
Government agencies, law enforcement, or regulatory authorities
Investigations into illegal activities or violations of our Terms of Service
Protection of our legal rights, privacy, safety, and property
Protection of the rights, privacy, and safety of others

We will attempt to notify affected individuals of such requests unless legally prohibited.

10.6 Business Transfers

In the event of merger, acquisition, insolvency, bankruptcy, or other business restructuring, personal data may be transferred as part of that transaction. Affected individuals will be notified of any such change and any choices available regarding their data.

10.7 With Explicit Consent

We will disclose personal data to third parties only with the explicit written consent of the data subject, except as required by law.

11. SECURITY MEASURES

11.1 Technical Security Measures

We implement comprehensive security measures to protect personal data:

Encryption: Data in transit is encrypted using TLS/SSL protocols; data at rest is encrypted using industry-standard encryption
Access Controls: Strict authentication and authorization controls limit data access to authorized personnel only
Database Security: Secure database architecture with firewalls and intrusion detection/prevention systems
Regular Updates: Timely security patches and software updates
Monitoring: Continuous monitoring for suspicious activities and unauthorized access
Backups: Regular, encrypted backups for disaster recovery

11.2 Organizational Security Measures

Personnel: Only authorized personnel with a legitimate need have access to personal data
Training: Regular data protection and privacy training for all staff members
Confidentiality: Confidentiality agreements required for all employees and contractors
Background Checks: Background checks conducted for personnel with data access
Incident Response: Documented procedures for detecting, investigating, and responding to data breaches

11.3 Physical Security Measures

Data Centers: Secure server facilities with controlled access, CCTV surveillance, and security personnel
Environmental Controls: Climate control, power backup, and fire suppression systems
Device Security: Physical security for devices used to process personal data

11.4 Limitations

While we employ strong security measures, no method of data transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security against all threats, though we maintain industry-standard protections.

11.5 Data Breach Notification

In the event of a confirmed personal data breach, we will:

Assess the risk to affected individuals
Notify affected data subjects without undue delay and as soon as feasible (within 72 hours if high risk)
Report the breach to the Personal Data Protection Committee (PDPC) as required by PDPA
Provide affected individuals with details of what data was compromised, likely consequences, measures taken, and DPO contact information

12. COOKIES AND TRACKING TECHNOLOGIES

12.1 What are Cookies?

Cookies are small files stored on your device that help us recognize you, remember your preferences, and analyze how you use Weladee Form.

12.2 Types of Cookies We Use

Essential Cookies (No Consent Required): Authentication, CSRF protection, and basic functionality.

Non-Essential Cookies (Consent Required): Analytics, performance, and marketing tracking.

12.3 Cookie Management

You can control cookies through your browser settings. Note that disabling essential cookies may limit Service functionality.

13. THIRD-PARTY LINKS AND INTEGRATIONS

We are not responsible for the privacy practices of third-party websites or services. Please review their policies before providing personal data.

14. CHILDREN'S PRIVACY

Weladee Form is not intended for individuals under 18. We do not knowingly collect personal data from children under 18.

15. DATA PROTECTION OFFICER

Frontware International Co., Ltd. has appointed a DPO. Contact: [email protected].

16. AMENDMENTS TO THIS PRIVACY POLICY

We may update this policy periodically. Material changes will be notified via email or platform notice.

17. COMPLAINTS AND DISPUTE RESOLUTION

Please contact us first at [email protected]. You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand at www.pdpc.go.th.

18. CONTACT INFORMATION

Email: [email protected]
Address: 1213/390 Soi Ladprao 94, Plubpla, Wangthonglang, Bangkok 10310, Thailand

19. ACKNOWLEDGMENT

By using Weladee Form, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

Last Updated: January 6, 2026

WELADEE FORM - PRIVACY TERMS