Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Company: Vision Hub Limited
• Country: Hong Kong
• Email: office@workco.app

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Data you provide directly

• LINE profile information - Display name, profile picture URL, and LINE user ID (obtained via LINE Login).
• Business information - Business name, branch names, locations, and shift types.
• Employee data - Names, phone numbers, roles, and schedule assignments entered by business owners or managers.
• Contact information - Email address (if provided for support inquiries).

2.2 Data collected automatically

• GPS location data - Coordinates collected only when an employee voluntarily taps "Check In" or "Check Out". We do not track location continuously or in the background.
• Usage data - Pages viewed, features used, and interaction patterns within the app.
• Device information - Browser type, operating system, and screen size.
• Language preference - Your selected display language (English or Thai).

2.3 Data from third parties

• LINE Platform - When you log in via LINE Login or add the WorkCo LINE Official Account as a friend, LINE provides us with your LINE user ID and basic profile information as authorized by you.

3. Purposes and Legal Basis for Processing

Under the PDPA, we process your personal data based on the following legal grounds:

• Provide scheduling and check-in services. Legal basis: Contract performance (Section 24(3)).
• Send schedule notifications via LINE. Legal basis: Contract performance (Section 24(3)).
• Verify employee location during check-in. Legal basis: Consent (Section 19), GPS permission requested at check-in.
• Improve the app and fix bugs. Legal basis: Legitimate interest (Section 24(5)).
• Respond to support inquiries. Legal basis: Legitimate interest (Section 24(5)).
• Comply with legal obligations. Legal basis: Legal obligation (Section 24(6)).

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

4. Data Sharing and Disclosure

We may share your personal data with:

• LINE Corporation - To deliver schedule notifications via LINE Messaging API.
• Vercel Inc. - Hosts our web application as a data processor on our behalf.
• Supabase Inc. - Stores and processes account, schedule, and attendance data as a data processor on our behalf.
• Google LLC - We use Google Analytics (GA4) on our website to collect anonymous usage statistics. Google processes this data under its own privacy policy.
• Your employer (if you are an employee user) - Business owners/managers can view schedule assignments and check-in records for employees in their business.
• Law enforcement or regulators - When required by Thai law or a valid court order.

All third-party processors are required to protect your data in accordance with the PDPA.

5. Cross-Border Data Transfers

Your data may be stored on servers located outside Thailand (via our hosting provider Vercel and our database provider Supabase). In such cases, we ensure that the destination country has adequate data protection standards, or we implement appropriate safeguards as required by Section 28 of the PDPA, including contractual obligations on data processors to protect your personal data to a standard no less than the PDPA.

6. Data Retention

• Active accounts: Data is retained for as long as your account is active and you use the service.
• Deleted accounts: Upon account deletion, all personal data will be deleted within 30 days, except where retention is required by law.
• GPS check-in data: Retained for 12 months from the date of check-in, then automatically deleted.
• Support conversations: Retained for 12 months after resolution.

7. Your Rights Under the PDPA

As a data subject under the PDPA, you have the following rights:

• Right of Access - Request a copy of the personal data we hold about you.
• Right to Rectification - Request correction of inaccurate or incomplete data.
• Right to Erasure - Request deletion of your personal data when it is no longer necessary for the purpose it was collected, or when you withdraw consent.
• Right to Data Portability - Request your data in a structured, commonly used, machine-readable format.
• Right to Object - Object to processing based on legitimate interest.
• Right to Restrict Processing - Request that we limit how we use your data in certain circumstances.
• Right to Withdraw Consent - Where processing is based on consent (e.g., GPS data), you may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint - You have the right to file a complaint with the Personal Data Protection Committee (PDPC) if you believe your data protection rights have been violated.

To exercise any of these rights, contact us at office@workco.app We will respond to your request within 30 days.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (HTTPS/TLS).
• Encryption at rest for stored data.
• Access controls limiting data access to authorized personnel only.
• Regular review of security practices.

9. Cookies and Local Storage

WorkCo uses local storage (not cookies) to save your language preference.

We use Google Analytics (GA4) on our website (workco.app) to understand how visitors use the site. Google Analytics uses cookies to collect anonymous usage data such as pages visited, time on site, and referral source. This data is used solely to improve our website and content. Google Analytics does not collect personal data that directly identifies you.

For more information about how Google processes data, see Google's Privacy Policy. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

10. Children's Data

WorkCo is intended for business use by individuals aged 18 and above. We do not knowingly collect personal data from children under the age of 20 (the age of legal majority in Thailand) without verifiable parental consent. If you believe we have inadvertently collected data from a minor, please contact us immediately.

11. LINE Integration

WorkCo operates as a LINE mini app (LIFF). By using WorkCo:

• You authorize LINE Login to share your profile information with WorkCo.
• When you add the WorkCo LINE Official Account as a friend, we receive your LINE user ID to send schedule notifications.
• You can stop receiving messages at any time by blocking the WorkCo LINE Official Account.
• We comply with LINE's Platform API Terms of Use and User Data Policy.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you via LINE message or within the app. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of WorkCo after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy questions, data subject requests, or complaints:

• Email: office@workco.app
• LINE: Message us via the WorkCo LINE Official Account.

If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.