Data Protection (PDPA)

1. Data Controller

BIRTHEORY Co., Ltd. is the data controller responsible for processing your personal data.

• Headquarters: Spaces Chamchuri Square, 24th Floor, 319 Phayathai Road, Pathumwan, Bangkok 10330, Thailand

2. PDPA Compliance

We comply with the Thailand Personal Data Protection Act B.E. 2562 (2019) (PDPA). This page supplements our Privacy Policy with PDPA-specific details.

Under PDPA, we process your personal data based on:

• Consent (Section 19): Marketing emails, newsletter, cookie analytics
• Contract (Section 24(3)): Delivering purchased services
• Legitimate Interest (Section 24(5)): Service improvement, fraud prevention
• Legal Obligation (Section 24(6)): Tax, regulatory compliance

3. Sensitive Data

We collect certain sensitive personal data with your explicit consent:

• Blood type (optional, provided during profile creation)
• Gender identity (optional)

This data is used solely for generating your personalized Birth Code, Mission Code & Life Code analysis. You can choose not to provide this data, though it may affect the depth of certain insights.

4. Third-Party Personal Data Consent Requirement

BIRTHEORY allows users to create sub-profiles for family members, friends, and clients. When you input another person's data (including their name, date of birth, time of birth, place of birth, or any other personal information), you are acting as a data intermediary.

Before entering any third party's personal data, you MUST:

• Obtain their explicit, informed consent to enter their data into BIRTHEORY
• Inform them about what data will be collected and how it will be processed
• Inform them about their rights under PDPA and GDPR (access, deletion, etc.)
• Inform them that their data will be used to generate personalized analysis using AI
• Inform them that their data may be stored and processed in Thailand

By entering another person's data, you represent and warrant that you have obtained all necessary consents. You agree to indemnify BIRTHEORY against any claims, damages, or legal proceedings arising from your failure to obtain proper consent. BIRTHEORY reserves the right to delete any data entered without proper consent and suspend the responsible account.

5. Your Rights Under PDPA

As a data subject under PDPA, you have the following rights:

• Right to Access (Section 30): Request a copy of your personal data
• Right to Data Portability (Section 31): Receive your data in a commonly used format
• Right to Object (Section 32): Object to data processing based on legitimate interest
• Right to Erasure (Section 33): Request deletion of your personal data
• Right to Restrict Processing (Section 34): Limit how we process your data
• Right to Rectification (Section 35): Correct inaccurate personal data
• Right to Withdraw Consent (Section 19): Withdraw consent for marketing, newsletter, etc.
• Right to Complain: File a complaint with the Personal Data Protection Committee (PDPC)

To exercise any of these rights, contact us via the Contact page. We will respond within 30 days.

6. Data Security Measures

• All data is encrypted in transit (TLS/SSL) and at rest
• Passwords are hashed using industry-standard algorithms
• Payment processing handled by Stripe (PCI DSS Level 1 certified)
• Access to production data is restricted to authorized personnel only
• Regular security reviews and monitoring
• Community content moderation with OTP email verification
• Support chat requires email verification for non-logged-in users

7. Cross-Border Data Transfer

Your personal data may be transferred to and processed in:

• Thailand (headquarters, primary data processing)

We ensure adequate data protection safeguards are in place for all cross-border transfers, including standard contractual clauses, data processing agreements, and compliance with local regulations.

8. Cookie Policy

We use the following types of cookies:

• Essential Cookies: Required for authentication, session management, and core functionality. Cannot be disabled.
• Analytics Cookies: Help us understand how visitors use the site (page views, traffic sources). Can be managed via the cookie consent banner.
• Preference Cookies: Remember your settings (font size, language preferences).

You can manage cookie preferences at any time through your browser settings or the cookie consent banner on the site.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in high risk to your rights and freedoms, we will:

• Notify the Personal Data Protection Committee (PDPC) within 72 hours
• Notify affected data subjects without undue delay
• Document the breach, its effects, and remedial actions taken

10. Contact for Data Protection

For data protection inquiries, requests, or complaints:

• Contact: Contact Page
• Address: Spaces Chamchuri Square, 24th Floor, 319 Phayathai Road, Pathumwan, Bangkok 10330, Thailand

If you are unsatisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Committee (PDPC), Office of the Personal Data Protection Committee, Thailand.