Privacy Notice

1. Data controller and contact

Accify Accounting Co., Ltd.

• Email for privacy matters: accify.th@gmail.com

2. What we collect

We collect only what we need, by type of user:

• Website visitors: IP address, device and browser type, pages viewed and data stored via cookies as described in the cookie policy (usage statistics are collected only with your consent).
• Accify users: name, email or username, password (stored using one-way encryption, so it cannot be read back), the companies linked to the account and system activity logs (who did what, when).
• Self-service sign-ups: full name, company or shop name, e-mail, phone number, the time you accepted this policy, plus IP address and browser details at sign-up.
• Data that business customers load into the system, such as employee, payroll, supplier, customer and accounting records (see section 10).

3. Why we use it, and the legal basis

• To provide the Accify system to customers (sign-in, documents, tax preparation) — performance of a contract.
• To keep the system secure and prevent abuse and bot spam — our legitimate interest in protecting the service.
• Measure and improve our ads on Facebook/Instagram with the Meta Pixel — with your consent (withdraw at any time).
• To analyse website usage so we can improve our service — with your consent (you can withdraw it at any time).
• To comply with the law, such as accounting and tax law or orders from authorities.
• Contact you, create a trial account for people who sign up, notify our staff through an internal LINE group, and prevent duplicate sign-ups — to act on your request before entering a contract and on our legitimate interest in security.

4. Cookies and similar technologies

We always use cookies that are necessary for the system to work. Analytics cookies are used only if you consent. Details are in the cookie policy, and you can change your choice at any time.

5. Who we share data with

We do not sell your personal data. We disclose it only as needed to:

• LINE (a messaging application provider) — used to send an internal notification to our staff group when someone signs up; the message contains the applicant’s name, company, e-mail and phone number.
• The cloud infrastructure provider that hosts the system (Huawei Cloud), which processes data on our instructions and under confidentiality terms.
• Meta Platforms (Facebook / Instagram) through the Meta Pixel on the home page, only if you consent to marketing cookies, to measure and improve ads.
• Providers of the page’s fonts and libraries (Google Fonts, jsDelivr, Tailwind CSS, jQuery), which receive your IP address and browser details when the page loads fonts or scripts from them.
• Cloudflare (Turnstile service), which checks that whoever fills in the sign-up form is human and receives your IP address and browser details when you open the sign-up page.
• Authorities or other parties entitled by law, when a lawful request or order requires it.

6. Transfers abroad

System data is stored on servers of the cloud provider we use, which may be outside Thailand.

If data is sent to a country with a lower level of data protection, we will put appropriate safeguards in place as required by law.

Meta (if you consent to marketing cookies) may process data outside Thailand. We load this tool only after you consent.

7. How long we keep data

• Quote requests received earlier: no longer than 12 months from the request date, then deleted automatically (quote requests are no longer accepted through the website).
• IP address and browser details in a request: no longer than 90 days, then deleted automatically.
• User accounts and data loaded by customers: for as long as the service is used and afterwards as the law requires (for example accounting records for at least 5 years), or until the customer asks us to delete it, unless we must keep it by law.
• Website usage statistics (with your consent): according to the retention set in the analytics tool, no longer than 14 months.
• Sign-up requests: kept for no more than 12 months from the request date, then deleted automatically (accounts already created follow the user-account retention below).

8. Security measures

• Traffic is encrypted with HTTPS.
• Passwords are stored using one-way encryption.
• Access is split by user role and each company’s data is kept separate.
• System activity is recorded (audit log) so it can be reviewed later.
• If a data breach is likely to put people’s rights at risk, we will notify the Personal Data Protection Committee Office within 72 hours of becoming aware, and tell affected people where the risk is high.

9. Your rights

Under the PDPA you may exercise the rights below by emailing us at the address in section 1. We will reply within 30 days.

• Access your data and get a copy.
• Have inaccurate data corrected.
• Have data deleted, destroyed or anonymised.
• Restrict use of your data, or object to its collection, use or disclosure.
• Receive or transfer your data in a machine-readable format.
• Withdraw consent at any time (this does not affect processing done before withdrawal) — you can change cookie choices with the “Cookie settings” link in the footer.
• Complain to the Personal Data Protection Committee Office if you believe we have not complied with the law.

10. Data that business customers load into the system

When a business customer loads data about employees or other people into Accify, that customer is the data controller for those people, and we act as a data processor following the customer’s instructions and our data processing agreement. If you are an employee or other person whose data is in a customer’s system, please contact that employer or company directly to exercise your rights.

11. Minors

Our service is not aimed at collecting data from minors. If we learn that we hold a minor’s data without a parent’s consent we will delete it promptly.

12. Changes to this notice

We may update this notice from time to time. When there is a significant change we will tell you on this page.