Last updated 13 September 2026
Privacy Policy
This policy explains what personal data we collect through this website, why we collect it, who else handles it, how long we keep it, and the rights you have. It is written to meet Thailand's Personal Data Protection Act B.E. 2562 (2019) (the PDPA) and, for visitors in Europe and the United Kingdom, the GDPR.
Who is responsible for your data
Lead Sync Hub, trading as Staffly ("Staffly", "we", "us", "our"), is the data controller for the personal data described in this policy. We are headquartered in Bangkok, Thailand.
For any question about this policy, or to exercise the rights set out below, contact us at info@stafflyconsulting.com.
What this policy covers
This policy covers the Staffly website at this domain: the pages you browse, and the two forms you can submit.
It does not cover:
- Personal data we handle when delivering services to a client. That is described in summary in the services section below and in detail in the engagement documents and privacy notice we provide to that client.
- The Staffly ATS+ application. Candidate data processed in that product is covered by the agreement with the employer who uses it — see candidates and ATS+.
- Third-party websites we link to. They have their own policies.
What we collect
We collect only what you type into a form, plus the technical records any website generates when a browser requests a page. We do not run analytics, advertising or tracking scripts on this site, and we do not build profiles of visitors.
| Source | Data | Required? |
|---|---|---|
| Enquiry form (home page) | First name, last name, email address, phone number, and company name | Company name is optional; the rest are required to submit |
| Early-access form (Staffly ATS+ page) | Work email address, and what you hire for | What you hire for is optional |
| Email and other correspondence | Whatever you choose to include when you write to us, and our replies | You choose |
| Technical records | IP address, browser and device type, requested URL, referring page and timestamp, recorded by our hosting provider as part of serving the page | Automatic; generated by any web request |
| Language cookie | Your chosen interface language — see cookies | Set only to remember your language choice |
Both forms contain a hidden field that a real visitor never sees. Only automated bots fill it in, and a submission that does is silently discarded. It exists to block spam, and it collects nothing about you.
We do not knowingly collect sensitive personal data through this site — data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, sexual orientation, criminal records, trade union membership, health or genetic or biometric data. Please do not include any of it in a form or an unsolicited email. If you send it anyway, we will delete it unless we need it for an engagement, in which case we will ask for your explicit consent first.
How a form submission is handled
It is worth being precise about this, because it is short: when you submit a form, its contents are formatted into an email and sent to our team. This website does not store them in any database. Our mailbox is the only permanent record.
Your email address is set as the reply-to address on that email, so that replying to you is a single click.
If the email fails to send — a misconfiguration, or an outage at our email provider — the submitted values are written to our server logs instead, so that your enquiry is not silently lost and we can still follow it up. Those logs are held by our hosting provider, are accessible only to our technical staff, and are deleted on that provider's rolling retention schedule.
Why we use it, and our legal basis
Under the PDPA and the GDPR we must have a lawful basis for each purpose. Ours are:
| Purpose | Legal basis (PDPA) | Legal basis (GDPR) |
|---|---|---|
| Replying to your enquiry and discussing whether we can help | Steps taken at your request prior to entering a contract, s.24(3); and our legitimate interest in responding to people who contact us, s.24(5) | Art. 6(1)(b) pre-contractual steps; Art. 6(1)(f) legitimate interests |
| Managing the Staffly ATS+ early-access list and contacting you about it | Steps taken at your request, s.24(3) | Art. 6(1)(b) |
| Keeping the site available, secure and free of spam and abuse | Legitimate interest in protecting our systems, s.24(5) | Art. 6(1)(f) |
| Sending you marketing about our services, where you have asked for it | Your consent, s.19 — withdrawable at any time | Art. 6(1)(a) |
| Meeting our accounting, tax, anti-money-laundering and other legal obligations | Legal obligation, s.24(6) | Art. 6(1)(c) |
| Establishing, exercising or defending a legal claim | Legitimate interest, s.24(5) | Art. 6(1)(f) |
We do not sell personal data, and we do not share it with anyone for their own marketing. We do not use your data to make automated decisions that produce legal effects for you.
Marketing
Answering your enquiry is not marketing, and we will always reply to what you asked.
Beyond that, we will only send you updates about our services if you have asked us to, or where we are permitted to contact an existing client about services closely related to those we already provide. Every marketing message has an unsubscribe link, and you can opt out at any time by replying or by emailing us. Opting out of marketing does not affect messages about work we are doing for you.
Transfers out of Thailand
Some of the providers above are based outside Thailand, so your data may be transferred, stored or accessed abroad, including in the United States and the European Union.
Where we transfer personal data out of Thailand, we do so on a basis permitted by sections 28 and 29 of the PDPA — typically because the transfer is necessary to perform a contract with you or at your request, or because appropriate safeguards are in place. For transfers of data covered by the GDPR out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable.
You can ask us for details of the safeguards applying to a specific transfer at info@stafflyconsulting.com.
How long we keep it
We keep personal data only as long as we have a reason to, and then delete it.
| Data | Kept for |
|---|---|
| Enquiries that do not become an engagement | Up to 24 months from our last contact with you, so that we have context if you come back to us — then deleted |
| Early-access list entries | Until Staffly ATS+ leaves private beta, or until you ask to be removed, whichever is sooner |
| Client records | For the duration of the engagement, then for as long as Thai law requires us to retain accounting and tax records — generally five years — and for any longer period needed to defend a claim |
| Server and access logs | On our hosting provider's rolling retention schedule, typically no more than 30 days |
You can ask us to delete an enquiry sooner. See your rights.
How we protect it
The site is served over HTTPS, form submissions are transmitted encrypted, and access to our mailbox and hosting accounts is restricted to the staff who need it and protected by multi-factor authentication. Form input is length-limited and escaped before it is placed in an email, so a submission cannot be used to attack our systems or the people who read it.
No system is perfectly secure, and as noted in the terms of use, email is not a secure channel. Please do not send identity documents, financial details or credentials through a web form or unencrypted email. Once an engagement is under way we will give you a secure channel for those.
If a personal data breach occurs that is likely to affect your rights, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it where the PDPA requires, and will notify you where the breach is likely to result in a high risk to you.
Your rights
Under the PDPA — and, where it applies to you, the GDPR — you have the right to:
- Be informed about how we use your data. That is what this page is for.
- Access the personal data we hold about you, and obtain a copy of it.
- Rectify data that is inaccurate, out of date, incomplete or misleading.
- Erase your data, or have it anonymised, where we no longer have a lawful reason to keep it.
- Restrict our use of your data while a question about it is being resolved.
- Object to processing we carry out on the basis of legitimate interests, and to direct marketing at any time.
- Portability — receive data you gave us in a machine-readable format, or have it sent to another controller where technically feasible.
- Withdraw consent at any time, where we relied on your consent. Withdrawing it does not affect processing already carried out.
- Complain to a supervisory authority.
To exercise any of these, email info@stafflyconsulting.com. We may ask for enough information to confirm who you are before we act — we do not want to disclose your data to someone else claiming to be you. We will respond within 30 days of receiving a valid request, as the PDPA requires, or within one month where the GDPR applies. These rights are free to exercise; we will only charge where a request is manifestly unfounded or excessive, and we will tell you before we do.
In limited cases we may be unable to act on a request — for example where retaining the data is required by Thai tax or accounting law, or where it is needed to establish or defend a legal claim. If so, we will tell you why.
If you are a job candidate
This website does not collect resumes or job applications. If you send one to a form here, please do not — see the terms of use.
When an employer uses Staffly ATS+ to screen applications, that employer decides what to collect and why: they are the controller, and Staffly acts as their processor, handling the data on their instructions under a separate agreement. If you applied to a job and want to know what is held about you or want it deleted, please contact the employer you applied to. If you are not sure who that is, write to us and we will point you in the right direction.
Where Staffly runs a recruitment process itself as part of a client engagement, or is hiring for its own team, we are the controller for that process and everything in this policy applies to it.
Personal data we handle when delivering services
Delivering our services necessarily means handling personal data about people other than the person who contacted us: directors, shareholders and authorised signatories for a company registration or a BOI application; employees and their dependants for work permits, visas, payroll, social security and tax filings.
That processing is governed by the engagement we sign with the client, not by this website policy. In outline: we collect it from the client or from the individual, we use it only to carry out the instructed work and to meet our own legal obligations, we submit it to the Thai authorities the matter requires, and we retain it for the periods Thai law sets. Where the client is the controller and we act as processor, the client's own privacy notice governs, and a data processing agreement sets out what we may do.
If you are an employee or family member whose data has been given to us by a company we work for, and you want to know what we hold or how to exercise your rights, write to us and we will help you, or direct you to the right controller.
Children
This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 20 (the age of majority in Thailand) through this website without the consent of a parent or guardian, as the PDPA requires. If you believe a child has given us personal data here, contact us and we will delete it.
Changes to this policy
We will update this policy when what we do changes — a new processor, a new purpose, a new form. The date at the top of this page shows when the current version took effect. Where a change materially affects your rights, we will take reasonable steps to tell you rather than relying on you to re-read the page.
Contact and complaints
Privacy and data protection requests: info@stafflyconsulting.com
General enquiries: marketing@stafflyconsulting.com
We would rather hear a complaint directly, and will try to resolve it. But you can also complain to a regulator. In Thailand that is the Office of the Personal Data Protection Committee (PDPC), pdpc.or.th. In the EEA it is the supervisory authority in your country of residence or work; in the UK, the Information Commissioner's Office, ico.org.uk.