Privacy Policy
Privacy has been our top priority since day 1 of Datasabai. Learn about how we collect, use, share, and protect your personal information.
DataSabai ("we," "our," or "us") provides secure data entry and document processing services for Enterprise Resource Planning (ERP) systems, including Electronic Data Interchange (EDI), Intelligent Document Processing (IDP), regulatory compliance management, and Web EDI solutions. We are committed to protecting the privacy and security of the personal data and business information entrusted to us by our customers and their trading partners.
This Privacy Policy describes how we collect, use, store, disclose, and protect information when you access our platform, website (datasabai.com), and related services (collectively, the "Services"). It applies globally to all users, clients, and data subjects whose information we process.
Please read this policy carefully. By using our Services, you acknowledge the practices described herein.
1. Scope and Data Controller
DataSabai acts as both a data controller (for account and website data) and a data processor (when processing business documents and transactions on behalf of our enterprise clients). Where we act as a processor, our processing activities are governed by our Data Processing Agreement (DPA) with the relevant client.
If you are an employee, supplier, or trading partner whose data is processed through a client's integration with DataSabai, please contact that client (the data controller) directly for information about their privacy practices.
2. Information We Collect
2.1 Account and Contact Information
When you register or engage with us, we may collect:
- Full name, job title, and business email address
- Company name, registered address, and industry
- Phone number and preferred communication channels
- Account credentials (passwords are stored in hashed form)
- Billing and payment information
2.2 Business Transaction Data
As part of delivering our core EDI, IDP, and Web EDI services, we process structured and unstructured business documents on your behalf, which may include:
- Purchase orders, invoices, advance ship notices (ASNs), and other EDI transaction sets (e.g., ANSI X12, EDIFACT)
- Scanned or digital documents submitted for Intelligent Document Processing (IDP)
- Compliance documentation and regulatory filings
- Supplier and trading partner identifiers (e.g., GLN, DUNS numbers)
This business data is processed solely to fulfill our contractual obligations to you and is not used for any secondary commercial purpose.
2.3 Technical and Usage Data
We automatically collect certain technical data when you use our platform:
- IP address, device type, browser type and version, and operating system
- Log data: login timestamps, pages visited, API calls made, and session duration
- Platform performance data and error reports
- Cookie and tracking technology data (see Section 5)
2.4 Compliance and Audit Data
Given the regulated nature of EDI and ERP compliance, we maintain audit logs of data transactions, user actions, and system events. These logs are essential for compliance with trading partner agreements, regulatory requirements, and our security obligations.
3. How We Use Your Information
We use the information we collect for the following purposes:
- To provision, operate, and maintain our EDI, IDP, compliance, and Web EDI services
- To onboard trading partners and manage ERP integration configurations
- To translate, validate, and route electronic business documents between parties
- To perform intelligent document capture and data extraction (IDP workflows)
- To monitor transaction compliance against trading partner standards and regulations
- To process payments and manage billing
- To provide technical support and respond to service requests
- To send service notifications, security alerts, and product updates
- To maintain audit trails and generate compliance reports
- To detect, investigate, and prevent fraudulent or unauthorized activity
- To improve platform performance, accuracy, and reliability
- To fulfill our legal and regulatory obligations
- To send marketing communications (only with your consent, where required by law)
4. Legal Basis for Processing
We rely on the following legal bases to process personal data:
4.1 Contract Performance
Processing is necessary to provide the Services you have contracted for, including EDI transaction processing, IDP, and compliance management.
4.2 Legitimate Interests
We process certain data to operate our business securely, improve our platform, detect fraud, and maintain audit integrity — provided this does not override your fundamental rights.
4.3 Legal Obligation
We process and retain certain data to comply with applicable laws, including tax regulations, financial record-keeping requirements, and data protection laws.
4.4 Consent
Where required by law (e.g., for marketing emails or non-essential cookies), we rely on your explicit consent. You may withdraw consent at any time without affecting prior lawful processing.
4.5 Data Processing on Behalf of Clients
When we act as a data processor on behalf of an enterprise client, our processing is governed by that client's instructions and our Data Processing Agreement (DPA). Clients are responsible for ensuring they have a valid legal basis for the personal data they submit to our platform.
5. Cookies and Tracking Technologies
We use cookies and similar technologies on our website and web-based platform to:
- Maintain secure user sessions and authentication state
- Remember user preferences and configuration settings
- Analyze usage patterns to improve platform usability
- Monitor platform performance and uptime
We do not use third-party advertising cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may impair the functionality of our secure platform.
6. Sharing and Disclosure of Information
We do not sell, rent, or trade your personal information or business transaction data. We may share information in the following limited circumstances:
6.1 Trading Partners and ERP Systems
As part of EDI and Web EDI operations, business transaction data (e.g., purchase orders, invoices) is transmitted to the intended recipient trading partners or ERP systems as directed by you or your client. This is the core function of our service.
6.2 Subprocessors and Service Providers
We engage vetted third-party subprocessors to support our operations (e.g., cloud infrastructure, security monitoring, payment processing). All subprocessors are bound by data processing agreements and may only process data on our documented instructions. A list of key subprocessors is available upon request.
6.3 Legal and Regulatory Disclosure
We may disclose information where required by law, court order, or competent regulatory authority, or where necessary to protect the rights, property, or safety of DataSabai, our clients, or others.
6.4 Business Transfers
In the event of a merger, acquisition, or sale of business assets, data may be transferred as part of that transaction. Affected parties will be notified and given choices where required by law.
6.5 With Your Consent
We may share information with third parties where you have provided explicit prior consent.
7. International Data Transfers
DataSabai is headquartered in Thailand and operates globally. Your data may be stored or processed in countries other than your own, including countries that may have different data protection standards.
For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland, we implement appropriate safeguards including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data Processing Agreements (DPAs) with all relevant parties
- Technical and organizational security measures appropriate to the risk
For transfers involving other jurisdictions, we apply equivalent protections in accordance with applicable local law.
8. Data Retention
We retain data only as long as necessary to fulfill the purposes for which it was collected, meet our contractual commitments, and comply with legal obligations. Our general retention schedules are:
- Account and profile data: retained for the duration of the customer relationship and up to 24 months after account closure
- EDI and IDP transaction records: typically retained for 7 years to satisfy trading partner agreement requirements and tax/audit obligations, unless a different period is contractually agreed
- Audit logs and security logs: retained for a minimum of 12 months, or longer as required by applicable law or client agreement
- Marketing and consent records: retained until consent is withdrawn, plus a reasonable period thereafter
Upon expiry of the applicable retention period, data is securely deleted or anonymized in accordance with our data disposal procedures.
9. Data Security
Protecting business-critical ERP and EDI data is central to our mission. We implement robust technical and organizational security measures including:
- Encryption of data in transit using TLS 1.2 or higher
- Encryption of data at rest using AES-256 or equivalent
- Role-based access controls (RBAC) and principle of least privilege
- Multi-factor authentication (MFA) for platform access
- Regular vulnerability assessments and penetration testing
- Comprehensive audit logging and anomaly detection
- Business continuity and disaster recovery planning
- Employee security training and background screening
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected parties and relevant supervisory authorities as required by applicable law, within the legally mandated timeframes.
10. Your Rights and Choices
Depending on your country of residence, you may have the following rights regarding your personal data:
- Access: obtain a copy of the personal data we hold about you
- Rectification: request correction of inaccurate or incomplete data
- Erasure: request deletion of your data (subject to legal and contractual retention obligations)
- Restriction: request that we limit certain processing activities
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interests or for direct marketing
- Withdraw Consent: revoke previously provided consent at any time
- Opt Out of Marketing: unsubscribe from commercial communications at any time
To exercise any of these rights, please submit a request to privacy@datasabai.com . We will verify your identity and respond within 30 days (or within the timeframe required by your local law). Note that where we act as a data processor on behalf of an enterprise client, you should direct your request to that client in the first instance.
11. Regional Privacy Rights
11.1 European Economic Area and United Kingdom (GDPR / UK GDPR)
If you are in the EEA or UK, you have the rights described in Section 10 under the General Data Protection Regulation (GDPR) or UK GDPR. You also have the right to lodge a complaint with your local data protection authority (DPA). For EU residents, a list of national DPAs is available at edpb.europa.eu .
11.2 California (CCPA / CPRA)
California residents have the right to know what personal information we collect and how it is used, to request deletion, to opt out of the sale or sharing of personal information (DataSabai does not sell personal information), and to non-discrimination for exercising their rights. To submit a verifiable consumer request, contact privacy@datasabai.com .
11.3 Thailand (PDPA)
DataSabai complies with the Thailand Personal Data Protection Act B.E. 2562 (PDPA). Thai residents have the rights to access, correct, delete, restrict, and object to processing of their personal data, as well as the right to data portability, subject to applicable exceptions.
11.4 Other Jurisdictions
We are committed to respecting applicable privacy and data protection laws in all jurisdictions where we operate. If you have questions about your rights under local law, please contact us at privacy@datasabai.com .
12. Children's Privacy
Our Services are designed for business use and are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently received data from a minor, please contact us at privacy@datasabai.com and we will promptly delete it.
13. Third-Party Links and Integrations
Our platform may connect to third-party ERP systems, trading partner portals, and external services as part of EDI and Web EDI integrations. This Privacy Policy does not govern those third-party systems. We encourage you to review the privacy policies of any systems you integrate with. DataSabai is not responsible for the privacy practices of third-party platforms.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data practices. When we make material changes, we will:
- Update the "Last Updated" date at the top of this document
- Notify registered users by email or prominent in-platform notice
- Where required by law, seek renewed consent
Continued use of our Services following notification of changes constitutes acceptance of the revised policy. We encourage you to review this page periodically.
15. Contact Us
For any questions, concerns, or data subject requests regarding this Privacy Policy or our data practices, please contact:
DataSabai — Privacy Office
Email: privacy@datasabai.com
Website: www.datasabai.com
Address: Bangkok, Thailand
For EU/EEA users: if you are unsatisfied with our response, you have the right to lodge a complaint with your national data protection authority. For UK users, this is the Information Commissioner's Office (ICO) at ico.org.uk