Privacy Policy

This Privacy Policy explains how Bexsys Co., Ltd. (“Bexsys”, “we”, “us”) collects, uses, and protects your personal data when you use the Bexsys Timesheet mobile application and web portal (together, the “Service”).

The Service is a workforce and timesheet management tool provided to employees and other authorized personnel of Bexsys and its affiliates. By creating an account, signing in, or otherwise using the Service, you acknowledge the practices described in this policy.

1. Information we collect

We collect the following categories of information to operate the Service:

• Account & profile. Your name, work email address, role/position, department, and password (stored in encrypted/hashed form). You may also add a profile photo and a signature image.
• Attendance & location. When you check in or out, we record the time, check-in type, and your device’s geographic location (GPS coordinates and the resolved address) at that moment. Location is collected only at the time you perform a check-in action — the Service does not track your location in the background.
• Timesheet & work data. Work details you submit — projects, tasks, hours, phases, and related expense information (travel, fuel, per-diem, etc.).
• Leave & HR records. Leave requests and their type, dates, reasons, and approval status.
• Documents you upload. Files you attach — for example timesheets, leave documents, or other supporting PDFs and images.
• Device & notification data. A push-notification token and basic device identifiers so we can deliver reminders and approvals to your device, plus technical data such as app version and log information needed to run and secure the Service.

2. Device permissions

The mobile app may ask for the following permissions. You can grant or revoke them in your device settings:

• Location — to record where an attendance check-in takes place.
• Camera & photos — to capture or upload a profile photo, signature, or supporting documents.
• Notifications — to send timesheet reminders, approvals, and status updates.

Declining a permission may disable the related feature but does not otherwise prevent you from using the rest of the Service.

3. How we use your information

• To authenticate you and provide the Service’s attendance, timesheet, leave, and reporting features.
• To verify attendance and the integrity of submitted timesheets.
• To route submissions and requests to the appropriate managers and HR personnel.
• To send you reminders and notifications about your obligations and their status.
• To administer payroll, HR, and internal operations in accordance with your employment relationship.
• To maintain the security, reliability, and lawful operation of the Service.

4. How we share your information

We do not sell your personal data. We share it only as needed to operate the Service:

• Internally — with your managers, HR, and administrators who need it for approvals, payroll, and HR administration.
• Email delivery — timesheet and form submissions may be emailed to HR through Microsoft 365.
• Service providers — infrastructure and notification providers (for example, Google Firebase Cloud Messaging for push notifications) that process data on our behalf under appropriate safeguards.
• Legal — where required by law, regulation, or valid legal process.

5. Data storage & security

Your data is stored on servers and databases controlled by Bexsys. We apply reasonable technical and organizational measures — including access controls, encrypted credentials, and signed sessions — to protect it against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data retention

We retain your personal data for as long as your account is active and as necessary to fulfil the purposes described in this policy, to comply with our legal, tax, and accounting obligations, and to resolve disputes. When data is no longer required, we delete or anonymize it.

7. Your rights

Subject to applicable law — including Thailand’s Personal Data Protection Act (PDPA) — you may have the right to access, correct, update, or request deletion of your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us using the details below. Some data may need to be retained where we have a legal basis or obligation to keep it.

8. Children’s privacy

The Service is intended for use by Bexsys personnel and is not directed to children. We do not knowingly collect personal data from anyone under the age of 18.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by other appropriate means, and the “Last updated” date above will be revised. Your continued use of the Service after an update constitutes acknowledgment of the revised policy.

10. Contact us

If you have questions or requests regarding this policy or your personal data, contact:

Bexsys Co., Ltd.
88 PASO Tower, 27th Floor, Unit A2, Silom Rd., Bangkok, Thailand
Tel. 02-235-8003 · Fax 02-235-8005
Email: swan@bexsys.com