Eaxy4U Products and Applications Privacy Policy

1. Introduction

Eaxy4U Company Limited is a Thailand-based software service company providing Eaxy4U HRM and Payroll, Enterprise Restaurant ERP, Advanced Restaurant POS, mobile application, cloud, implementation, training, maintenance, backup, and technical-support services.

This Products and Applications Privacy Policy explains how personal data may be processed when organizations and authorized users use Eaxy4U products and related services. The separate Website Privacy Policy applies to visitors of our public website, website enquiries, contact forms, cookies, and website security.

2. Scope

This policy applies, as relevant, to Eaxy4U HRM and Payroll, the Eaxy4U HRM and Payroll mobile application, Enterprise Restaurant ERP, Advanced Restaurant POS, Employee Self-Service, and related modules for inventory, stock, purchasing, suppliers, accounting, finance, Central Kitchen Management, attendance, leave, overtime, Daily Checklist, notifications, attachments, cloud hosting, client databases, support, maintenance, backups, implementation, and training.

It also applies to related Eaxy4U software modules and future product features where this policy is referenced. Client contracts, client privacy notices, and Data Processing Agreements may provide additional or more specific terms.

Not every product processes every category described below. Processing depends on the product used, features enabled by the client organization, user permissions, client configuration, device permissions, and applicable contracts.

3. Information We May Process

A. Account and identity information

This may include a full name, employee ID, username, email address, telephone number, job title, department, branch, organization, user role, profile photo, authentication information, and account status. Where passwords are used, they should be stored in protected or hashed form where applicable; Eaxy4U does not require plain-text password storage as a normal product practice.

B. Eaxy4U HRM and Payroll information

Depending on enabled features, this may include employment history, position, department, salary, payroll records, allowances, deductions, tax and social-security information, bank-payment details, leave, overtime, shifts, attendance, onboarding and offboarding, training, asset assignments, and performance-related records.

C. Attendance and location information

Precise or approximate location may be collected when an employee performs an attendance-related action, where enabled, to verify that the user is within an authorized workplace location. Location is not necessarily collected continuously. Collection depends on client configuration, the attendance feature used, and device permission. A user may deny location permission, but location-dependent attendance functions may then be unavailable.

D. POS information

This may include customer names, telephone numbers, delivery addresses, orders, receipts, sales transactions, loyalty information, discounts, table or reservation details, refunds, and payment-method references. If payment services are integrated, payment information may be processed by a separate payment provider. This policy does not state that Eaxy4U stores full payment-card numbers.

E. Enterprise Restaurant ERP and business information

This may include supplier and customer contacts, purchase orders, sales invoices, inventory, stock movements, accounting records, products, branches, internal approvals, operational records, Central Kitchen data, delivery records, batches, and expiry information.

F. Device and technical information

This may include device model, operating-system and application versions, device identifiers, push-notification tokens, IP address, login timestamps, security logs, API request records, error logs, and performance diagnostics. Device identifiers are used for service, security, diagnostics, and notification purposes—not third-party behavioral advertising.

G. Attachments and uploaded content

Users may select and upload images, documents, PDF files, Daily Checklist attachments, leave or HR request documents, supplier documents, business records, or other files. Users should avoid uploading sensitive or unrelated information that is not required for the business purpose.

H. Support and communications

This may include support tickets, emails, phone communications, screenshots, error reports, training records, and implementation communications.

4. How Information Is Collected

Information may be collected from users, authorized client administrators, client imports, mobile permissions, device and application logs, API integrations, client-selected third-party services, and technical-support, implementation, maintenance, or training interactions.

5. Purposes of Processing

Depending on the service and context, information may be processed to:

• Provide Eaxy4U HRM and Payroll, Enterprise Restaurant ERP, Advanced Restaurant POS, mobile, cloud, and related services.
• Authenticate users and manage accounts, roles, and permissions.
• Process attendance, payroll, approvals, operational records, and reports.
• Support restaurant, inventory, purchasing, supplier, finance, and Central Kitchen operations.
• Send work-related notifications and provide customer support.
• Maintain backups, monitor security, and prevent fraud, abuse, or unauthorized access.
• Diagnose errors, improve reliability and performance, fulfil contracts, and meet legal or regulatory obligations.

Eaxy4U does not process product data for third-party behavioral advertising.

6. Legal Bases

Where Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) or another applicable law applies, processing may rely on performance of a contract, compliance with legal obligations, legitimate interests, consent where required, protection of vital interests where applicable, or another lawful basis permitted by law.

The appropriate legal basis depends on the client organization, data, purpose, applicable agreement, and processing context. This policy is general information and does not constitute legal advice or state that consent is always required.

7. Sensitive Personal Data

Where configured or legally required, Eaxy4U HRM and Payroll records may include health-related records, disability information, government identifiers, biometric-related information supplied through a client-selected integration, or other legally protected categories. Biometric data is not described here as collected by default.

Sensitive personal data should be collected and processed only where an appropriate lawful basis exists and suitable organizational and technical protections are applied.

8. How Information May Be Shared

Information may be made available, only for authorized purposes, to the user’s employer or client organization, authorized administrators, permitted branches or departments, authorized Eaxy4U support personnel, hosting and cloud-infrastructure providers, backup providers, notification or email providers, Firebase Cloud Messaging, integrated payment providers, professional advisers, or government authorities where legally required.

Eaxy4U does not sell personal data and does not share it for third-party behavioral advertising. Client administrators may access information according to permissions configured by their organization.

9. Third-Party Services

Depending on the product, client configuration, and enabled integration, Eaxy4U products may use or connect with Google Firebase, Firebase Cloud Messaging, cloud hosting, email or SMS providers, payment services, mapping or location services, and client-selected third-party integrations. Third-party providers maintain their own privacy terms and may process data under their agreements with Eaxy4U or the client organization.

10. International Data Transfers

Depending on hosting location, client configuration, cloud providers, support arrangements, and third-party integrations, information may be processed or stored outside the user’s country. Eaxy4U will use appropriate safeguards where required by applicable law and contract. This policy does not state that all product data is stored only in Thailand.

11. Data Security

Eaxy4U applies reasonable safeguards appropriate to the product and context, which may include HTTPS encryption in transit, authentication, role-based access, access controls, password hashing, logging, backups, monitoring, restricted administrative access, security updates, and incident-response procedures.

No method of transmission or storage is completely secure. Eaxy4U cannot provide an absolute guarantee against every security risk.

12. Data Retention

Retention depends on client instructions, subscription period, legal obligations, payroll and accounting requirements, backup cycles, security requirements, and contractual terms. After service termination, information may be deleted, returned, anonymized, or retained where legally or contractually required.

Deletion from active systems may not result in immediate removal from every backup. Backup copies may remain until their scheduled cycle expires, subject to security and legal requirements.

13. Data Accuracy

Users and client administrators are responsible for providing and maintaining accurate information. Authorized users may review or update records according to their assigned permissions and their organization’s procedures.

14. User and Data Subject Rights

Subject to the PDPA and other applicable laws, a person may have rights to access, correct, delete, restrict, or object to processing; receive portable data where applicable; withdraw consent where processing relies on consent; and complain to an appropriate authority.

When an employer or client organization controls the information, users should normally contact that organization first. Eaxy4U will support client organizations with valid requests where required by law and contract. A request will not always result in deletion where another lawful basis or retention obligation applies.

Account and Data Deletion Requests

Employees cannot normally create their own Eaxy4U employment accounts. Accounts are created and managed by the employer or an authorized administrator. Employees should contact their employer or HR administrator to request correction, deactivation, or deletion of an account or associated data.

A client organization may contact Eaxy4U for technical assistance. Eaxy4U may need to verify the requesting organization and follow contractual, legal, payroll, accounting, security, and backup-retention requirements before completing a request. No self-service deletion button is provided by this policy.

15. Mobile Application Permissions

The Eaxy4U HRM and Payroll mobile application may require internet access and, where enabled, location permission for attendance verification, notification permission for work-related updates, and access to the system file picker for user-selected attachments.

• Location collection depends on client configuration, attendance action, operating system, and device permission; it is not described as continuous background tracking.
• The application does not require broad access to a user’s full photo or video library for normal attachment selection. Files are selected through the device’s system picker where supported.
• The application does not require call-log or SMS permissions for login.
• Camera access is not described as required unless a future feature is introduced and separately disclosed.

Permissions may vary by operating system, application version, and enabled feature. Denying a permission may make the related feature unavailable without disabling unrelated services.

16. Push Notifications

Firebase Cloud Messaging tokens may be processed to deliver leave or overtime approvals, announcements, payslip availability, attendance reminders, and other work-related updates. Users may disable notifications in device settings. Disabling notifications does not necessarily disable other product functions.

17. Children

Eaxy4U business products are intended for organizations and authorized workforce or business users. They are not designed for anonymous use by children or for child-directed random chat. If a client processes information about a minor, the client is responsible for determining and meeting applicable legal requirements.

18. Automated Decision-Making and AI

Eaxy4U does not use product user data for decisions producing significant legal or similarly important effects unless a specific feature is configured and separately disclosed. If future AI integrations are introduced, their use will be subject to appropriate notices, data-sharing limitations, client instructions, and applicable consent or other lawful basis. This statement does not imply that AI is currently used.

19. Service Changes and Product Updates

Products and services may change over time. This policy may be updated when new features are introduced, data practices or legal requirements change, or new integrations are added. Material changes will be communicated or made available through appropriate channels where required.

20. Relationship With Client Policies

Client organizations may provide their own employee, customer, supplier, or user privacy notices. Users should also read their organization’s privacy notice and follow its request procedures.

Clients are responsible for informing relevant people, selecting lawful purposes, managing permissions, configuring retention, handling requests relating to data they control, and providing notices or obtaining consent where required. This policy does not replace a client organization’s legal obligations.

21. Contact Information

22. Complaints

Users may raise a concern with their employer or client organization, contact Eaxy4U using the details above, or complain to the relevant personal-data protection authority where applicable. Eaxy4U may need to coordinate with the client organization when that organization controls the information.

23. Effective Date and Updates

Effective date: 19 July 2026
Last updated: 19 July 2026

Eaxy4U may update this policy to reflect product, operational, contractual, or legal changes. The current version will be published at this URL with a revised “Last updated” date.