This Privacy Policy explains how The Gang Technology Co., Ltd. ("we", "us") collects, uses, discloses and protects personal data in Testndex, a pre-screening assessment platform, in line with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). It replaces the general Marketplace privacy policy for this service.
It applies to three groups of people:
- Users — staff of a company or organization ("Customer") who sign in to Testndex to create tests, invite candidates and review answers;
- Candidates — people a Customer invites to take an assessment; and
- Visitors — people who browse the Testndex website.
This policy is published in Thai and in English. If the two versions differ, the Thai version prevails.
1. Who Is Responsible for Your Data
- For Candidates: the organization that invited you is the data controller of your data. It decides why you are assessed and how your results are used. We process your data on its behalf as a data processor. The organization's own data-protection details, where it has provided them, are shown to you before you begin the assessment.
- For Users and Visitors: we are the data controller of your account data, usage data and website data.
The Gang Technology Co., Ltd., company registration no. 0105558183399, 1/7, 1/8 Soi Phetkasem 66, Bang Khae Nuea, Bang Khae, Bangkok 10160, Thailand. Email: [email protected]
2. Personal Data We Collect
(a) Candidates
- Invitation details the organization enters: your name and email address, the test, the date your link expires, and the organization's staff who invited you or will review your answers.
- Verification and consent: the email address you confirm before starting, and the time you accepted these documents.
- Your answers: selected choices, written answers, links you provide, and uploaded files (up to 5 files per question, 10 MB each, in PDF, Word, Excel, PNG or JPEG format), with the times you started and submitted.
- Assessment results: automatic scores for multiple-choice questions, reviewers' scores and comments, your total score, and pass/fail against the passing score the organization set.
- Access records: events such as opening your link, starting and submitting, with your IP address and browser information (user agent).
We do not ask Candidates for national ID numbers, bank details or sensitive personal data (such as religion, health or biometric data). Please leave such data out of your answers and files unless a question genuinely requires it.
(b) Users
- Account data: name, email address, the identifier from our authentication provider, the language you use, and when you signed in.
- Organization membership: the organizations you belong to, your role, your job positions, whether your access is active, and invitations sent to you.
- Activity records: an audit trail of changes to tests, scoring and membership (for example role changes, invitations sent and members who joined or left), plus in-app notifications.
- Product preferences: which product tours and release notes you have seen.
- Support: if you use the in-app support chat, your name, email address, user identifier and the messages you send.
(c) Customer information
The organization's name, industry, team size, how it heard about Testndex, its description and logo, the data-protection contacts it enters, and its settings. Tests, questions and job descriptions are Customer content and may contain personal data only if a User puts it there.
(d) Visitors
Your language choice, your cookie preferences (kept in your own browser), and server logs such as IP address, browser information and the pages requested.
3. Purposes and Legal Bases
| Purpose | Legal basis (PDPA) |
|---|---|
| Running assessments for the organization: sending invitations, verifying the Candidate, saving answers, scoring, and reporting results | On the organization's instructions as its processor; the organization's own basis is typically steps before entering into an employment contract (s. 24(3)) or legitimate interests (s. 24(5)) |
| Providing Users' accounts, sign-in, organizations, roles and notifications | Performance of a contract (s. 24(3)) |
| Security, fraud prevention, access records and audit trails | Legitimate interests (s. 24(5)) |
| Support and service announcements, such as release notes | Performance of a contract and legitimate interests (s. 24(3), (5)) |
| Improving the Service using aggregated or de-identified information | Legitimate interests (s. 24(5)) |
| Analytics or marketing cookies, if we introduce them | Consent (s. 19) |
| Complying with the law and establishing or defending legal claims | Legal obligation and legitimate interests (s. 24(5), (6)) |
We do not sell personal data, and we do not use Candidate data for our own marketing.
4. AI and Automated Processing
- AI question drafting. When a User asks Testndex to draft questions, we send the AI model the job position and level, the test title and description, the skills to measure, a job description the User pastes, any additional context, and the organization's name and profile. No Candidate data and no Candidate answers are sent to the AI model. We ask Users not to include personal data in this information.
- The AI model runs on infrastructure operated by us or by our cloud providers. Data sent to it is used only to produce the requested draft and is not used to train AI models.
- AI does not score Candidates and makes no decision about them. Answers that need judgement are scored by people the organization assigns as reviewers.
- Automatic scoring. Multiple-choice answers are scored automatically against the organization's answer key, and pass/fail is calculated from the passing score it set. These are rule-based calculations, not AI. The organization reviews the results and makes any hiring decision; you may ask it to explain a result or to have it reviewed by a person.
- An organization's owner can turn AI drafting off.
5. Who We Share Data With
- The inviting organization. A Candidate's data is available to the organization that invited them, and within it only to staff whose role or job position gives them access to that test, and to the reviewers assigned to it.
- Service providers who process data for us under contracts requiring them to protect it and follow our instructions:
- user sign-in and organization membership — WorkOS, Inc. (United States);
- application hosting, database and file storage — DigitalOcean, LLC;
- transactional email delivery (invitations, verification and result emails);
- network security and connectivity — Cloudflare, Inc.;
- hosting of the AI model used for question drafting (section 4);
- the in-app support chat for signed-in Users — operated by us.
- Authorities, where the law or a court order requires it.
- A successor, if our business is merged, acquired or transferred, under the same protections.
6. International Transfers
Some of our service providers store or process data outside Thailand, for example in the United States or in the data-centre region where the Service is hosted. Where a destination country's protection standards may not be adequate, we transfer data only with appropriate safeguards under sections 28 and 29 of the PDPA, such as contractual data-protection commitments, encryption in transit, and access controls.
7. How Long We Keep Data
- Candidate data is kept for the retention period the inviting organization sets. Once that period has passed since an assessment was submitted, an invitation was cancelled, or an unused link expired, the invitation, answers, uploaded files and scores are deleted automatically. An attempt still in progress is never deleted. If the organization has not set a period, the data is kept until the organization deletes it or deletes its organization.
- Candidate access records (including IP address and browser information) are deleted after 90 days.
- In-app notifications are deleted after 90 days.
- User account data is kept while you have access to an organization. Audit-trail entries are kept for the life of the organization, so that it keeps an accurate record of who had access and who changed what.
- Deleting an organization immediately removes its tests, invitations, Candidate answers and memberships from the Service.
- Copies in system backups are removed in the ordinary backup cycle. We may keep data longer where the law requires it or to establish or defend legal claims.
8. Security
- Data is encrypted in transit (HTTPS).
- Each organization's data is kept separate from every other organization's, and access within an organization depends on the User's role and job positions.
- Each Candidate receives a unique, unguessable link and must confirm their email address before starting.
- Uploaded files are kept in private storage, are not publicly listed, and can be reached only through unguessable links shown to people with access.
- Users sign in through an established authentication provider, and changes to access, tests and scores are recorded in an audit trail.
No system is completely secure. We review these measures regularly and will notify affected organizations, and where required the authorities, of a personal data breach as the law requires.
9. Your Rights
Subject to the conditions and exceptions in the PDPA, you have the right to:
- access your personal data and obtain a copy;
- have inaccurate or incomplete data corrected;
- have your data deleted, destroyed or anonymised;
- restrict or object to processing;
- receive your data in a commonly used electronic format, or have it sent to another controller;
- withdraw consent at any time, without affecting processing that took place before; and
- complain to the Personal Data Protection Committee (www.pdpc.or.th).
Candidates: please send requests to the organization that invited you first, as it is the data controller — its contact details are shown before the assessment starts. If you contact us instead, we will pass your request to that organization and help it respond.
Users and Visitors: email [email protected]. We will respond within the time the PDPA requires and may need to verify your identity first.
10. Cookies and Similar Technologies
- Necessary cookies keep you signed in, protect forms against forgery, and remember your language. The Service cannot work without them.
- Your cookie choices on the website are kept in your own browser's storage.
- We do not currently use analytics or marketing cookies. If we introduce them, we will use them only with your consent, given through the cookie settings.
- Signed-in Users see a support chat widget that is identified to their account so that we can respond to their requests.
11. Children
Testndex is meant for recruitment, and Candidates are expected to be of working age. An organization that invites a minor is responsible for obtaining any consent the PDPA requires from the minor's parent or guardian. If we learn that we hold data about a child without the required consent, we will work with the organization to delete it.
12. Changes to this Policy
We may update this policy as the Service or the law changes. The date at the top of this page shows when it last changed. We will notify Users of material changes by email or in the Service before they take effect, and ask for consent again where the law requires.
13. Contact Us
The Gang Technology Co., Ltd.
1/7, 1/8 Soi Phetkasem 66, Bang Khae Nuea, Bang Khae, Bangkok 10160, Thailand
Email: [email protected]
We have not appointed a data protection officer, as the PDPA does not currently require one for our processing. We will appoint one if that changes.