LEGAL

Privacy Notice

Last updated: 3 November 2026.

This notice is provided under Thailand's Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). It explains Weeboon's processing; it is not blanket consent. Where consent is required, Weeboon requests it separately in a clear, optional form.

1. Controller and contact

The data controller for Weeboon is VISEO COMPANY LIMITED (Thai: บริษัท วิเสโอ จำกัด; company registration no. 0105560173729), Thailand. Privacy questions and rights requests may be sent to support@weeboon.com with subject “Privacy request”.

1697/148, 14th Floor
Lat Phrao Road, Samsen Nok, Huai Khwang
Bangkok 10310, Thailand

If Weeboon becomes legally required to appoint a data protection officer, the DPO's contact details will be published here and notified as required. If you act for another person, we verify your authority and request only identity evidence reasonably necessary to prevent unauthorised disclosure.

2. Data we collect and sources

• Account and contact: name, email, password hash, language, age-threshold confirmation, preferences, account status and activity.
• Campaign and public content: campaign text, photographs, updates, comments, categories, creator and beneficiary details, reports and other content submitted for publication.
• Contribution, payment and withdrawal: amount, currency, method, transaction and payment references, billing/contact details, bank or payout details, settlement status, refunds, chargebacks and risk signals. Payment providers—not Weeboon—receive full card details through their payment interfaces.
• Identity and compliance: evidence reasonably required to verify creators, beneficiaries, authority, withdrawals, fraud, safety reports or lawful requests.
• Support and safety: messages, complaints, reports, attachments, decisions and related communications.
• Technical: IP address, device/browser, timestamps, requested pages, session and security events, cookies and similar identifiers.
• Communication choices: marketing opt-in, wording/version, method, language and timestamp, unsubscribe and suppression status.

We collect data directly from you; automatically from your browser and use of the Services; and, where relevant, from campaign creators, beneficiaries, contributors, payment providers, banks, Google Identity, other users, fraud/security providers, public sources and lawful authorities. If PDPA section 25 requires notice for data obtained from another source, we provide it within the applicable period unless a legal exception applies.

3. Required and optional data

Fields marked required, login credentials, age confirmation, essential campaign information, payment references and information necessary for verification or law are required to provide the requested account, campaign, contribution or withdrawal service. If you do not provide them, we may be unable to create the account, publish the campaign, complete the transaction, pay funds or respond to the request. Marketing choices are optional and refusing them does not prevent access to core Services. Weeboon currently operates no optional analytics or advertising tracker.

4. Purposes and lawful bases

• Contract or requested pre-contract steps: create and secure accounts, publish and administer campaigns, process contributions and withdrawals, provide support and send essential service messages.
• Legal obligation: accounting, tax, payment, identity, regulatory, court and lawful-authority requirements.
• Legitimate interests, balanced against your rights: prevent fraud and abuse, secure and improve the Services, investigate reports, moderate content, recover amounts, enforce terms and establish or defend legal claims.
• Consent: marketing and sensitive data where explicit consent is the appropriate basis. Consent may be refused or withdrawn without losing core access.
• Other PDPA exceptions: vital interests, public interest or another basis may apply only where the legal conditions are met.

Campaigns may contain health, religion, disability or other sensitive data. A creator must not publish another person's sensitive data without informed explicit permission or another specific lawful exception. We may request evidence, restrict access or remove the data. Public content can be copied by others and cannot always be fully retrieved.

5. Disclosure and recipients

We disclose only what is reasonably necessary to authorised personnel; campaign creators, beneficiaries or contributors where the transaction or campaign requires it; payment and banking providers; hosting, email, security and identity providers; professional advisers; insurers; acquirers in a lawful corporate transaction; and courts, regulators or authorities where required or permitted by law.

Principal providers currently include P&T Hosting, Postmark, payment/banking providers including SiamPay/Thai payment channels, and Google reCAPTCHA and Google Identity when invoked. We retain limited legacy Facebook account-link identifiers for existing records, but current sign-in uses Google and Weeboon no longer loads Meta Pixel, Segment analytics or LinkedIn Insight. A provider may act as Weeboon's processor or as an independent controller depending on the service. We do not sell personal data.

6. International transfers

Some providers may process data outside Thailand. Before a transfer, we use a mechanism permitted by PDPA sections 28–29 and applicable PDPC notifications, such as an adequate destination, binding corporate rules where available, appropriate contractual and organisational safeguards that support enforceable rights, contractual or legal necessity, or informed consent where legally appropriate. You may contact us for information about the relevant safeguard, subject to confidential information.

7. Retention

We retain personal data only for its purpose, legal obligations, fraud and safety needs and defensible claims, then securely delete or anonymise it. Expected maximum periods, subject to a documented legal hold or shorter deletion where appropriate, are:

• active account and profile data: for the account life; core account, acceptance and closure evidence may be retained for up to five years after closure;
• public campaign content: while published and normally up to five years after closure where needed for contributor information, disputes, fraud or legal claims; content may be removed from public view earlier;
• contribution, payout, accounting, tax, refund, chargeback and fraud records: up to ten years where required for law, audit or claims;
• support, complaints and ordinary safety cases: up to three years after closure; serious incident and legal-claim records up to ten years;
• ordinary technical and security logs: normally up to twelve months, unless needed for an incident or claim;
• marketing data: until withdrawal or objection; consent and suppression evidence up to five years afterwards;
• browser privacy choices: normally 180 days; privacy-rights request records up to five years after closure.

Identity evidence is limited and removed when verification, fraud, payment or legal need ends. Backups expire through controlled cycles and are not restored for ordinary use after an approved deletion. When deletion is not legally possible, access is restricted to the retained purpose.

8. Your rights

Subject to PDPA conditions and exceptions, you may withdraw consent; request access, a copy and source information; request portability where applicable; object, including to direct marketing; request deletion, destruction or anonymisation; restrict use; correct inaccurate data; and complain to Thailand's Personal Data Protection Committee (PDPC).

Email the contact in section 1, preferably from your account email, and identify the right, account/campaign and data concerned. We may verify identity and authority. We respond without delay and complete a valid access request within 30 days, unless a lawful extension or exception applies. We record and explain lawful refusals. Direct-marketing objections and valid consent withdrawals are applied without delay.

9. Security and personal-data breaches

We use measures designed for the risks, including role-based access, password hashing, encrypted transport, logging and monitoring, backups, provider review and incident procedures. No online system is absolutely secure. We review measures when risks or technology change.

We assess suspected personal-data breaches. Where a breach is not unlikely to risk people's rights and freedoms, we notify the Thai PDPC without delay and, where feasible, within 72 hours after awareness. Where high risk is likely, we also notify affected people without delay and explain protective measures, subject to applicable PDPC rules.

10. Children

Accounts are limited to people aged 20 or older. We record an age-threshold declaration rather than a full birth date for this control. If we learn that an account holder is under 20, we may restrict the account and address deletion or a lawful representative's request under the PDPA. General public pages remain viewable without an account.

11. Cookies, communications and changes

See the Cookie and Tracking Policy and use “Privacy settings” in the footer to review technologies currently used. Essential account, campaign, contribution, withdrawal, security and legal messages are separate from marketing.

We may update this notice when practices or law change. We publish the date, highlight material changes and request new consent where legally required. The English and Thai texts are intended to communicate the same notice; Thai wording and mandatory Thai law prevail where required.

You may complain directly to the Thai PDPC. Contacting Weeboon first may help us investigate but does not remove that right.