JobThai's Privacy Policy Explained

- The privacy policy is written in a complex and unclear manner, with excessive detail that may confuse users about their rights and how their data is used.
- The policy uses vague and broad language in describing data collection purposes, such as "to develop and improve services," which could allow for extensive data use beyond user expectations.
- There is a lack of specific timeframes for data retention in several sections, with phrases like "as long as necessary" or "as the company sees fit," leading to uncertainty about how long personal data is kept.
- The policy allows the company to share personal data with third-party analytics and advertising providers without explicit user consent for each new purpose, which may infringe on user privacy.
- The company reserves the right to change the privacy policy without prior notice, only notifying users through the website or app, which could leave users unaware of critical changes.
- Users are required to accept all terms by using the service, including those they may not fully understand, limiting their ability to negotiate or opt out of specific data uses.
- The policy includes a broad clause that allows data disclosure for vague reasons like "national security" or "criminal investigations" without clear oversight or user recourse.
- There is insufficient clarity on how the company handles sensitive data, such as religion or disability, despite claiming it does not collect such data, which contradicts the inclusion of these fields in job applicant forms.
- The policy fails to clearly explain how users can exercise their rights, such as data deletion or objection, and sets long processing times (up to 120 days) for such requests.
- The data retention period for certain data (e.g., up to 10 years) after account deletion is not clearly justified and may be excessive, raising concerns about unnecessary data storage.
- The policy does not provide an easy way for users to understand how third-party providers process their data, relying only on links to external privacy policies that may be difficult to access or understand.
- The policy uses automatic consent by continued use of the service after changes, which may not meet the requirement for explicit consent under Thailand's Personal Data Protection Act (PDPA).
- There is a risk of data being used for marketing purposes without clear user opt-in, as the policy states data may be used for "direct marketing" with only an option to object.
- The policy lacks transparency on how artificial intelligence (AI) processes user data, particularly in extracting personal information from resumes and application documents, without detailing oversight or error correction mechanisms.