Data Subject Rights (PDPA)

As a data subject under the Thai Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), you have the following rights over the personal data we hold about you. This page explains each right and how to exercise it.

Summary of your rights

Right	PDPA section	What it means
Access	§30	Ask for a copy of your data
Data portability	§31	Receive your data in a machine-readable format
Objection	§32	Object to certain processing
Erasure / destruction	§33	Ask us to delete your data
Restriction	§34	Ask us to pause processing
Rectification	§35	Correct inaccurate data
Withdraw consent	§19	Take back consent you gave
Complaint	—	File with the PDPC

1. Right of access (§30)

You may request confirmation of whether we process your data and a copy of it. We will respond within 30 days. We may decline or charge a reasonable fee for repetitive or manifestly unfounded requests, and we will explain why.

2. Right to data portability (§31)

Where we process your data based on consent or contract and by automated means, you may request it in a structured, commonly-used, machine-readable format, and ask us to transmit it to another controller where technically feasible.

3. Right to object (§32)

You may object to processing based on legitimate interest (e.g., analytics, security) or to direct marketing. When you object to marketing, we will stop immediately. For legitimate-interest processing, we will stop unless we can demonstrate compelling grounds that override your interests.

4. Right to erasure (§33)

You may ask us to delete your data when:

• It is no longer necessary for the purpose we collected it for;
• You have withdrawn consent and there is no other lawful basis;
• You have objected and we have no overriding ground;
• It was processed unlawfully.

We may retain certain data where law requires (e.g., tax records for 7 years) and will tell you so.

5. Right to restriction (§34)

You may ask us to pause processing while a correction or objection is being assessed. During restriction we will store the data but not use it.

6. Right to rectification (§35)

You may ask us to correct inaccurate data or complete incomplete data. You can update most profile fields yourself in Settings → Profile.

7. Right to withdraw consent (§19)

You may withdraw consent at any time — it is as easy to withdraw as to give. Withdrawal does not affect the lawfulness of processing that happened before the withdrawal.

Common withdrawals:

• Marketing email — click "Unsubscribe" in any marketing email, or toggle it off in Settings → Notifications.
• Analytics cookies — open the cookie banner (link in the footer) and choose "Essential only".

8. Right to complain

If you believe we have not handled your data properly, you may file a complaint with the Thailand Personal Data Protection Committee (PDPC) at pdpc.or.th. We encourage you to contact us first so we can try to resolve it.

How to make a request

Email privacy@devqo.io with:

• Your full name and the email associated with your devqo account;
• Which right you want to exercise (access, erasure, etc.);
• Any details we need to understand and fulfill the request;
• A copy of a government ID if we cannot otherwise verify your identity.

We will confirm receipt within 3 business days and respond substantively within 30 days. Complex requests may take longer — we will tell you if that is the case.

Verification

To protect you from fraud, we verify the identity of anyone claiming to act on your behalf. For workspace-scoped requests, we may also need the workspace owner's confirmation.

Fees

Requests are free. For requests that are manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or refuse to act, and we will explain the decision.

Contact

privacy@devqo.io

Personal Data Protection Committee (Thailand): pdpc.or.th