privacy-policy

Staffo App Privacy Notice

Version 1.0.0  |  Effective date: 22 September 2026

UNIVERZA COMPANY LIMITED ("we", "us" or "our") issues this notice to explain how the Staffo app collects, uses, and discloses your personal data under Thailand’s Personal Data Protection Act B.E. 2562 (2019).

This notice is read together with our organisational personal data protection policy. For matters relating to the Staffo app, this notice applies. It is separate from the privacy policy for the informational website at univerza.co.

1. Parties and scope

Platform provider / app publisher: UNIVERZA COMPANY LIMITED (บริษัท ยูนิเวอร์ซ่า จำกัด), company registration no. 0205569041361.

Your employer organisation sets HR policies and access rights and is generally the data controller of employee personal data for HR processing. We provide the Staffo platform and process data according to the organisation’s configuration, instructions, and applicable agreements.

This notice applies to:

• the Staffo mobile application on iOS and Android for employees; and
• backend services and HR integrations used by the app to provide those services.

2. Data we collect

Category	Details	Source
Account and profile	Name, email, user/employee ID, phone number (if in organisation profile), and profile photo when displayed or uploaded	You; organisation IdP/HR systems
Organisation sign-in	Data needed for authentication via the organisation’s OIDC/IdP (e.g. account identifiers, email, access tokens required for use)	Organisation IdP; you
Attendance / time records	Check In / attendance records and related status	You; our systems
Leave and other HR content	Leave requests, reasons, attachments, and other content you submit through HR features	You
Precise location	GPS coordinates when you use Check In / attendance evidence	Your device
Photos or videos	Evidence media when required by features or organisation policy, and profile photos	You
Device identifiers and remote config	App installation identifiers and data needed for remote configuration (e.g. Firebase Remote Config) so the app can reach the correct servers	Your device; providers
Usage and security	Server request logs, sign-in status, and technical data needed for service delivery and security	Our systems
In-app PDPA consent	Accepted document version and timestamp (when in-app consent is required)	Our systems

Camera use for QR scanning happens on-device; scan frames are not uploaded as evidence unless you explicitly capture or attach media through an evidence feature.

3. Device permissions

• Location — for Check In / attendance evidence
• Camera — for evidence capture or QR scanning
• Microphone — when recording video evidence with audio
• Photo library — when you choose to upload images (e.g. profile photo)

You may deny or revoke these permissions in device settings, but some features may not work.

4. Purposes and legal bases

Purpose	Legal basis
Authenticate users, control access, and let you use the app under your organisation account	Contract / employment relationship; legitimate interests
Provide HR features such as Check In, leave, profile, and related employee information	Contract / employment relationship
Record attendance evidence under organisation policy, including location and media when required	Contract / employment relationship; legitimate interests
Prevent fraud, maintain security, and keep systems reliable	Legitimate interests
Comply with law or lawful authority requests and keep legally required records	Legal obligation
Obtain device permissions where required by the OS (location, camera, microphone)	Consent / device permission, as applicable

If you do not provide data needed for the service (such as organisation sign-in), we may be unable to provide the app.

We do not sell your personal data and do not use it to track you across third-party apps or websites for advertising.

5. Recipients

• People in your organisation with system rights (e.g. HR, managers), according to access settings
• Cloud, hosting, and file/image storage providers
• Your organisation’s identity provider (OIDC/IdP)
• Remote configuration providers such as Google Firebase Remote Config
• Our legal advisers and auditors when needed
• Public authorities, courts, or officials as required by law

External providers process data under relevant instructions for the purposes in this notice and must protect the data.

6. International transfers

Our systems and some providers may store or process data on servers outside Thailand. We transfer data only to providers with adequate personal-data protection measures under applicable law.

7. Retention

Data	Period
Account, profile, and access rights	While the organisation account remains active, or as required by employer policy
Attendance, leave, and attachments	According to employer HR/document retention policy and applicable law
Check In location and evidence media	As needed for evidence and review under organisation policy
Technical and security logs	As needed for security and troubleshooting, then deleted or de-identified
In-app PDPA consent records	As needed to demonstrate consent and comply with law

After the applicable period, we or the relevant organisation delete, destroy, or de-identify the data under applicable processes.

8. End of use and deletion

Staffo is an employee app. Unlike typical consumer apps, there is no in-app self-serve account deletion button. To revoke access, handle offboarding, or request deletion, contact your organisation’s HR and/or email us below. We will coordinate according to law and our agreement with the organisation.

9. Security

• Encrypted transmission (HTTPS)
• Organisation-account authentication and role-based access
• Secure storage of access tokens on device
• Appropriate technical and organisational measures to reduce unauthorised access risk

If a personal-data breach poses a risk to your rights and freedoms, we will notify as required by law.

10. Your rights

• Access and obtain a copy of your data
• Data portability in a commonly used machine-readable format
• Object to collection, use, or disclosure
• Request deletion, destruction, or de-identification
• Request restriction of processing
• Request correction and updates
• Withdraw consent previously given, without affecting processing already carried out
• Lodge a complaint with the Office of the Personal Data Protection Committee

Employee/HR data of your organisation: contact your organisation’s HR first.
Staffo platform matters: email developer@univerza.co.

We may ask for additional information to verify identity and will respond within 30 days of receiving the request. In some cases we may refuse a request as permitted by law and will explain the reason.

11. Minors

This service is for organisation employees and is not directed at minors. If you are under 20 years of age, parental/guardian consent is required before use as required by law and organisation policy. If we learn that a minor’s data was collected without such consent, we will delete or restrict it as appropriate.

12. Changes

We may update this notice from time to time. The latest version is published with a version number and effective date. For material changes, we may notify you via the app, organisation announcements, or other appropriate channels.

13. Contact us

UNIVERZA COMPANY LIMITED (บริษัท ยูนิเวอร์ซ่า จำกัด)
800/108 Sukhumvit Road, Saensuk Subdistrict, Mueang Chonburi District, Chonburi 20130, Thailand
Company registration no. 0205569041361
Email developer@univerza.co
Phone 087 148 3537
Contact page https://www.univerza.co/contact