1. Data Controller
Neonex Technologies Co., Ltd. ("Company", "DeployNex", "we", "us", or "our") acts as the Data Controller in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand ("PDPA") with respect to personal data collected through the DeployNex platform, website, API, and associated services.
2. Contact Information & Data Protection Officer (DPO)
If you have questions, inquiries, or wish to exercise your rights under the PDPA, please contact our Data Controller or Data Protection Officer using the following details:
- Data Controller: Neonex Technologies Co., Ltd.
- Registered Address: 72/173 Moo 1, Khlong Nueng, Khlong Luang, Pathum Thani 12120, Thailand
- General Privacy Inquiries: info@deploynex.com
- Data Protection Officer (DPO): Chonvarin Methachotwatcharakul (email: info@deploynex.com)
3. Personal Data Collected
We collect only the personal data necessary to provide and operate the DeployNex platform. Depending on your interactions with the Service, we collect the following categories of data:
3.1 Account & Identity Information
Full name, email address, password hashes (cryptographically hashed; plaintext passwords are never stored or accessible), multi-factor authentication (MFA) secrets, organization name, and assigned role permissions.
3.2 Server & Infrastructure Configuration Metadata
Server IP addresses, machine hostnames, operating system distribution and version (e.g., Ubuntu 24.04), preflight check logs, SSH public keys, and firewall rule configurations.
Security note: Customer server credentials, SSH private keys, and application environment variables are encrypted and masked. Platform administrators cannot browse or view customer secrets.
3.3 Application Deployment & Job Metadata
Git repository URLs, branch names, commit hashes, deployment execution logs, runtime configuration flags (PHP-FPM, Node.js), cron schedule configurations, and audit trail of background jobs.
3.4 Technical & Usage Data
IP addresses of client browsers connecting to the web console, browser user agent, login timestamps, session identifiers, and security audit event logs.
4. Purposes and Lawful Bases for Processing
We process personal data under lawful bases provided in Section 24 and Section 26 of the PDPA:
- Contractual Performance (Section 24(3) PDPA): To fulfill our contractual obligations to you, including creating accounts, authenticating users, orchestrating deployments, executing scheduled jobs, and providing customer support.
- Legitimate Interests (Section 24(5) PDPA): To ensure information security, detect unauthorized access or fraudulent operations, maintain platform resilience, prevent cyber threats, and improve platform performance.
- Legal Obligations (Section 24(6) PDPA): To comply with applicable laws and regulatory requirements in Thailand, including the Computer Crime Act B.E. 2550 (and amendments) regarding log retention, and financial reporting standards.
- Consent (Section 19 PDPA): Where specific explicit consent is requested, such as optional communication preferences or non-essential features. You may withdraw consent at any time.
5. Data Retention Period
We retain personal data only for as long as necessary to achieve the purposes for which it was collected or to satisfy statutory retention requirements.
- Account & Profile Data: Retained for the active duration of your account and organization subscription.
- System & Job Logs: Retained for audit and diagnostic purposes in accordance with a 30-day platform retention cycle and statutory computer crime log retention rules.
- Financial & Transaction Records: Retained for statutory periods prescribed by Thai tax laws (typically 5 to 7 years).
- Upon account termination and expiry of statutory retention obligations, personal data is securely erased, destroyed, or irreversibly anonymized.
6. Data Processors & Third-Party Disclosure
We do not sell personal data. We disclose personal data only to trusted third-party service providers ("Data Processors") who process data on our instructions under strict confidentiality and data processing agreements:
- Cloud Hosting, Infrastructure & Network: On-premise / Self-hosted infrastructure and Cloudflare, Inc. (USA - DNS, CDN network, DDoS mitigation, and Email Routing).
- Transactional Email Providers: Resend, Inc. (USA - transactional email delivery for alerts, magic links, and verification).
- Security & Certificate Authorities: Internet Security Research Group / Let's Encrypt (USA - automated SSL/TLS issuance).
- Third-Party Identity Providers (OAuth): GitHub, GitLab, Microsoft, and LINE Corporation (when users select social authentication).
- Off-Server Backup Storage: Amazon Web Services, Inc. (AWS) or customer-configured S3-compatible object storage providers.
- Payment Processors & Merchant of Record: Stripe, Inc. (payment processing for Thai transactions in THB) and Paddle.com Inc. / Paddle Payments Ltd. (Merchant of Record and reseller for international transactions in USD, handling international sales tax and remittance).
7. Cross-Border Data Transfers
Where personal data is transferred across borders outside the Kingdom of Thailand (such as to cloud infrastructure or third-party service providers situated internationally), we ensure that destination jurisdictions or recipients maintain adequate personal data protection standards in compliance with Section 28 and Section 29 of the PDPA.
Transfers are executed using appropriate legal transfer mechanisms, including standard contractual clauses or binding contractual data protection commitments.
8. Rights of Data Subjects under the PDPA
Under the Thailand Personal Data Protection Act, you have the following legal rights regarding your personal data:
- Right of Access (Section 30): Right to request access to and obtain a copy of personal data relating to you held by us.
- Right to Rectification (Section 35): Right to request that incomplete, inaccurate, or outdated personal data be corrected and updated.
- Right to Erasure / Deletion (Section 33): Right to request the deletion, destruction, or anonymization of your personal data where retention is no longer justified under law.
- Right to Restriction of Processing (Section 34): Right to request restriction on the use of personal data under statutory conditions.
- Right to Data Portability (Section 31): Right to obtain personal data in a readable, structured electronic format, or request direct transfer to another controller when technically feasible.
- Right to Object (Section 32): Right to object to the collection, use, or disclosure of personal data for legitimate interests or marketing.
- Right to Withdraw Consent (Section 19): Right to withdraw consent at any time for processing based on consent.
- Right to Lodge a Complaint (Section 73): Right to lodge a complaint with the Personal Data Protection Committee (PDPC) in Thailand if you believe your rights under the PDPA have been violated.
9. How to Exercise Your Rights
To exercise any of your rights under the PDPA, please submit a written request to our Data Protection Officer at:
- Data Protection Officer: Chonvarin Methachotwatcharakul (Email: info@deploynex.com)
- Alternative Contact: info@deploynex.com
Verification & Response Timeline
We will verify your identity before processing the request to protect your data from unauthorized disclosure. We will respond to your request within thirty (30) days of receipt, as mandated by the PDPA. If a request is rejected under statutory exceptions, we will document the reasons.
10. Changes to this Privacy Policy
We may revise this Privacy Policy periodically to reflect technological developments, service updates, or regulatory requirements. Material revisions will be notified through web console notices or email communications.
The current effective revision date is displayed at the top of this document (Version: 2026-10-15). We encourage you to review this policy periodically.