QAi Consulting & Services Co., Ltd. — Last Updated: July 26, 2026
1. Introduction
expand_more
QAi Consulting & Services Co., Ltd. ("the Company") places the highest importance on the privacy and security of personal data, including the safeguarding of your personal data. The Company therefore issues this Privacy Notice to inform you of the Company's policy regarding the collection, use, and/or disclosure of personal data, in accordance with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). This Privacy Notice explains in detail how the Company collects, uses, or discloses your personal data, the types of data collected and the purposes for which such data is processed, as well as details regarding the retention period, disclosure of personal data to third parties, your rights, the confidentiality and security of your personal data, and how you may contact the Company for further information. The Company recommends that you read and carefully consider this Privacy Notice so that you understand the principles and methods by which the Company collects, uses, or discloses your personal data.
1.1 Scope of Application
This Privacy Notice applies to the following categories of individuals:
- Business Customers: directors, shareholders, employees, and legal representatives of corporate customers, as well as other individuals authorized to act on behalf of corporate customers.
- Individual Customers: individual customers of the Company.
- Employees: all employees of the Company, including executives, permanent employees, contract employees, temporary employees, interns, advisors, and employees of business partners.
- Candidates: individuals interested in applying for a position with the Company, through any application channel.
- Website Visitors and Inquirers: individuals who visit the Company's website and/or who are interested in contacting the Company to inquire about its services.
1.2 Definitions
- "Data Subject" means the individual who is the owner of personal data collected, used, or disclosed by the Company.
- "Personal Data" means information about a person that enables the identification of that person, whether directly or indirectly.
- "Sensitive Personal Data" means personal data relating to race, ethnicity, political opinions, religious or philosophical beliefs, health data, disability, genetic data, criminal records, sexual orientation, biometric data, or any other data that similarly affects the data subject.
2. Purposes of Collection, Use, or Disclosure of Personal Data
expand_more
The Company will collect, use, or disclose your personal data only where necessary or where there is a legal basis to do so. In general, the purposes for which the Company uses your personal data include the following:
- To provide services, or as part of the Company's provision of services, including the improvement of the Company's products or services and other products and services that may be introduced in the future, as well as the maintenance and operations related to the provision of such services.
- To carry out transactions related to the Company's products or services.
- To manage the relationship between the Company and the data subject.
- To verify and/or identify the data subject when accessing services through various channels or when contacting the Company.
- To communicate with, notify, and/or provide information to you, or to notify you of changes occurring within the Company.
- To conduct the Company's business operations, such as data analysis, audits, development of existing services, development of new services or products, improvement or modification of services, and analysis of service usage, among others.
To carry out any actions that are necessary and appropriate to:
- Investigate and prevent acts that violate or may violate the law.
- Respond to requests from government agencies or authorities, including foreign government or governmental agencies in the jurisdiction where the data subject resides.
- Enforce the Company's terms of service and policies relating to personal data.
- Protect the Company's business operations.
- Protect the privacy rights and security of the property of the Company, its personnel, and data subjects or other individuals.
- Remedy, prevent, or limit any damage that may occur.
To comply with the law, investigations by government officials or regulatory authorities, or to comply with rules, regulations, or obligations prescribed by law or government authorities. For any purpose not specified above, the data subject will be notified at the time the Company requests to collect such personal data. In obtaining your personal data, the Company will collect, use, or disclose your personal data for these purposes only where one of the following conditions is met:
- Where required by law.
- Where consent has been obtained from you.
- Where it is for your benefit and consent cannot be obtained at that time.
- Where necessary for the legitimate interests of the Company's group of companies, or of another person or juristic person other than the Company.
- Where necessary for compliance with a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into such a contract.
- Where necessary to protect the life, health, or safety of you or other service users.
- Where it is in the interest of an investigation by an inquiry official, or the adjudication of a case by a court.
3. Sources of Your Personal Data
expand_more
In general, the Company collects personal data directly from you. For example, the personal data of job applicants is obtained when you apply for a position through the Company's published recruitment channels, in which case you intend to provide such personal information for consideration. In certain cases, however, the Company may obtain your personal data from other sources, and in such cases the Company will act in accordance with the requirements of the PDPA.
Personal data collected by the Company from other sources may include, but is not limited to, the following:
- Data received from the Company's business partners or other persons with whom the Company has a legal relationship.
- Data received from persons related to you, such as your family, colleagues, or referrers.
- Data received from corporate customers, where you act as a director, authorized representative, agent, delegate, or contact person.
- Data received from government agencies, agencies with regulatory authority over the Company, financial institutions, and/or external service providers.
- Personal data obtained from your visits to the Company's website, such as the name of your internet service provider and the IP address used to access the internet, the date and time of your visit, the pages visited, and inquiries made regarding the Company's services via the website or other social media channels.
- Application usage behavior, including logs of your usage of the Company's website, applications, and/or other systems.
- Personal data obtained from public records and non-public records that the Company is legally entitled to collect.
- Personal data received from government agencies or regulatory authorities exercising powers under the law.
4. Disclosure of Your Personal Data
expand_more
The personal data that the Company maintains may be disclosed to the following persons:
Business Partners
The Company may disclose your personal data to its business partners for the provision of the Company's services, such as Consulting, IT Outsourcing, and Software Testing services, where it is necessary to disclose your personal data — in your capacity as Company personnel performing duties in connection with such service activities — to the Company's business partners, in accordance with the terms and processes of the relevant services. To assure you that your personal data will be securely protected, the Company places importance on selecting business partners that maintain personal data protection policies of a standard level, store your personal data securely, and comply with the PDPA.
External Service Providers
The Company may disclose your personal data to external service providers who provide services to the Company in specific matters, within the scope of their responsibilities under the relevant service agreement, such as accounting and tax advisory firms, data processing and analytics service providers, internal audit advisory firms, and IT systems development providers for internal organizational use, which may involve the personal data of employees and/or your personal data. These external service providers are obligated to protect your personal data. To assure you that your personal data will be securely protected, the Company places importance on selecting external service providers that maintain personal data protection policies of a standard level, store your personal data securely, and comply with the PDPA.
Customers
Customers who use the Company's services, such as Consulting, IT Outsourcing, and Software Testing services, may require the Company to disclose your personal data to them, in accordance with the terms and processes of the relevant services.
Other Persons or External Agencies, in the Following Cases Only
The Company may be required to disclose your personal data in accordance with legal requirements, legal proceedings, litigation, and/or requests by government authorities, for reasons of national security, law enforcement, or other matters of public importance, in which case the Company will disclose only such data as is necessary and appropriate. In addition, the Company may need to disclose your personal data where it determines this to be necessary to enforce its terms and conditions of service or to protect the Company's operations. Furthermore, in the event of a corporate reorganization, the Company may need to transfer all or part of the personal data it has collected to relevant persons, as necessary in connection with such reorganization.
5. Protection of Personal Data and Data Subject Rights
expand_more
As a data subject, you may exercise the rights relating to your personal data, in accordance with the channels and methods notified by the Company, as set out below:
| Type of Right | Description |
|---|---|
| 5.1 Right of Access | You have the right to access and obtain a copy of your personal data held by the Company, except where the Company has the right to refuse your request under the law or a court order, or where your request would adversely affect the rights and freedoms of other persons. |
| 5.2 Right to Rectification | You have the right to request that the Company correct or update your personal data that is inaccurate or incomplete. |
| 5.3 Right to Erasure | You have the right to request that the Company erase or destroy your data, or render your data unable to identify you, except where the Company has a lawful ground to refuse your request. |
| 5.4 Right to Restriction of Processing | You have the right to request that the Company restrict the use of your personal data in certain circumstances (for example, while the Company is considering your personal data prior to entering into an employment contract), or while the Company is processing your personal data to the extent necessary for the development of its services. For the purpose of protecting your privacy, you have the right to request that the Company restrict the processing of all or part of your personal data. |
| 5.5 Right to Object | You have the right to object to the collection, use, or disclosure of your personal data where the Company processes such data on the basis of legitimate interest, or for direct marketing or statistical purposes, except where the Company has a lawful ground to refuse your request (for example, where the Company can demonstrate that the collection, use, or disclosure of your personal data is based on a legal ground of greater weight, or is for the establishment, compliance with, or exercise of legal claims, or for the public interest of the Company). |
| 5.6 Right to Data Portability | You have the right to request your personal data where the Company is able to organize such data into a format that is readable or commonly used by automated tools or equipment, and where such data can be used or disclosed by automated means. You also have the right to request that the Company send or transfer your personal data to a third party, or to request personal data that the Company has sent or transferred to a third party, except where this is not technically feasible or where the Company has a lawful ground to refuse your request. |
| 5.7 Right to Withdraw Consent | You have the right to withdraw the consent you have given to the Company at any time, in accordance with the procedures and methods established by the Company, except where withdrawal is restricted by law or by the nature of the consent. Withdrawal of your consent will not affect the collection, use, or disclosure of your personal data that was lawfully carried out based on your consent prior to such withdrawal. |
| 5.8 Right to Lodge a Complaint | You have the right to lodge a complaint with the Personal Data Protection Committee or the Office of the Personal Data Protection Committee, if the Company acts in violation of the PDPA. |
6. Retention Period
expand_more
The Company will retain your personal data for as long as is appropriate and necessary for the purposes for which each type of personal data is used and processed, taking into account the purposes and necessity prescribed by the PDPA. Such retention period will be consistent with the applicable statute of limitations or the retention period prescribed by relevant laws, such as accounting law, tax law, labor law, and other laws with which the Company must comply. In addition, the Company may need to retain records from closed-circuit television (CCTV) cameras at its office, and/or video and audio recordings, in order to prevent fraud and maintain security, including investigating suspicious behavior that may be reported to the Company by you or other related persons.
7. Security and Confidentiality Measures
expand_more
The Company maintains internal security measures and strictly enforces policies to keep your personal data secure, including data encryption and measures to prevent unauthorized access to data. The Company requires its personnel and external service providers to comply with appropriate standards and privacy policies, and to maintain appropriate standards for the care, use, transmission, or transfer of your personal data.
8. Cross-Border Transfer of Personal Data
expand_more
Where the Company transfers and/or sends data to a foreign country, the Company will establish standards for entering into agreements and/or business cooperation contracts with the agency or organization receiving such personal data, requiring that recipient to maintain recognized personal data protection standards consistent with applicable law, in order to ensure that such personal data is securely protected. For example, in the case of processing on a cloud computing system, the Company will consider organizations that maintain internationally recognized security standards, and will store personal data in encrypted form or by other means that prevent the identification of the data subject.
In linking personal data with other persons or agencies, the Company will clearly identify the party collecting the data and the party entitled to the collected data, so that you are informed accordingly. The Company will also record such data linkage as evidence.
9. How to Contact the Company
expand_more
If you have any questions or require further information regarding this Privacy Notice, or if you wish to exercise your rights under the PDPA, please contact the Company and/or the Data Protection Officer through the channel or address below:
QAi Consulting & Services Co., Ltd.
Head Office: 219/2 Soi Asoke, Sukhumvit 21 Road, Khlong Toei Nuea, Watthana, Bangkok 10110
Data Protection Officer email: dpo@qaidconsulting.com
10. Monitoring, Review, and Policy Updates
expand_more
The Company shall monitor the effectiveness of its operating procedures to ensure compliance with this Privacy Notice, and shall review this Privacy Notice at least once a year, or whenever there are relevant changes to business operations, operating procedures, technology, or reports of personal data security breaches that may relate to this Privacy Notice. The Company may amend or supplement this Privacy Notice from time to time, and will publish the current version of this Privacy Notice on the Company's website at www.qaiconsulting.com.