Privacy Policy · นโยบายความเป็นส่วนตัว

HappyToVolunteer ("we", "us", the "Platform") operates happytovolunteer.com and related services, including our LINE Official Account (@278weles / HappyToVolunteerTH), to connect volunteers with organisations in Thailand and Singapore.

During this POC stage, HappyToVolunteer is unincorporated and operated from Singapore and Thailand. We are the data controller for personal data processed as described in this policy, unless stated otherwise. We may incorporate a company later (likely in Singapore) if the product continues. If our legal form changes, we will update this policy and (where required) ask users to re-accept.

Privacy contact: happytovolunteerapp@gmail.com

This policy covers personal data we process when you visit the site, create an account, browse or join events, manage an organisation, upload content, link LINE, contact us, or use donation-display features. Organisations that receive volunteer data through the Platform are independent controllers for their own subsequent use (see Section 7).

• Account data: name, email, password (hashed), Google account identifier (if you use Google sign-in), date of birth (when provided or needed for age-restricted volunteering), province, profile photo, language and country preference, email verification status, terms acceptance version and timestamp.
• Organisation data: organisation name, description, contact email/phone/address/ website, type, province, logos and cover images, verification documents (e.g. registration or tax documents), admin invite emails, profile details you choose to publish, and donation display fields (bank / PromptPay / QR) if an organisation chooses to publish them.
• Activity data: event registrations, occurrence bookings, waitlists, attendance / check-in timestamps, bookmarks, reports (reason/description), and related operational status fields.
• User content: photos, descriptions, and other materials you upload. Please do not upload other people's personal data without a lawful basis.
• Technical data: essential cookies and similar technologies (see our Cookie Policy), basic server / security logs (IP address, timestamps, device/browser information), and audit logs of sensitive admin actions where applicable.
• LINE data (if you connect LINE): LINE user ID, display name / profile picture provided by LINE where available, reminder preferences, and message delivery status for service notifications you opt into.
• Individual donation profiles (if used): name, story, photo, video URL, province, and payment display details published only after our offline / documented consent process. Identity numbers collected on consent forms are for verification and are not meant for public display. Donors transfer money directly to third-party accounts; we do not process those payments as a payment provider.

We do not intentionally collect special-category / sensitive personal data (such as health, religion, biometric templates, or political opinions) unless you choose to provide it. Please avoid submitting sensitive data unless an Organisation specifically requires it for a lawful reason. Our standard signup form does not request Thai national ID numbers.

We process personal data where:

• necessary to perform a contract with you (account, registrations, service messaging you request);
• necessary for our legitimate interests in securing the Platform, preventing fraud and abuse, verifying organisations on a best-effort basis, and improving reliability during the POC (balanced against your rights);
• necessary to comply with law; and/or
• based on your consent (for example optional LINE linking, publishing certain personal stories/payment details, marketing if introduced later, or non-essential cookies if introduced later).

You may withdraw consent at any time without affecting prior lawful processing. Withdrawal may limit optional features.

• Operate the Platform (accounts, volunteering discovery, registration, waitlists, attendance).
• Verify organisations on a best-effort basis and prevent abuse.
• Send transactional messages (confirmations, reminders, waitlist updates) by email and/or LINE when enabled.
• Show roster information where an organisation enables that feature and where it is needed for coordination (see Section 7).
• Improve reliability and security during the POC.
• Comply with applicable law (including Thailand PDPA and, where relevant, Singapore PDPA) and respond to lawful requests.
• Protect our rights, users, and the public in connection with safety, fraud, or legal claims.

We do not sell personal data. We do not use LINE messaging for unrelated advertising.

If you add our LINE Official Account as a friend and link it to your HappyToVolunteer account, we may send you service messages such as booking confirmations and volunteering reminders. You can turn reminders off in your account settings (when available), mute or block the Official Account in LINE, or unlink by contacting us.

LINE Corporation processes messaging under its own policies. See LINE Privacy Policy.

We share data only as needed to run the service:

• with the Organisation hosting volunteering you join (name, email, attendance and related details as required for that activity); if an organisation enables a public or co-volunteer roster, limited name information may be visible to others on that event;
• with infrastructure processors (hosting, email delivery, storage, security) - in particular Cloudflare (Workers / D1 / R2 / security), email providers such as Resend, LINE Corporation when you link LINE, and Google if you use Google sign-in (and Google Fonts / similar technical services as loaded by the site);
• with professional advisers if needed; and
• if required by law, court order, or to protect rights, safety, or security.

We require processors to process data only on our instructions and with appropriate security, to the extent contracts and provider terms allow at POC stage. Organisations receiving Volunteer data act as independent data controllers for their own use and must comply with PDPA. Organisations must use volunteer data only for the stated volunteering activity and lawful related administration, not for unrelated marketing unless they have their own lawful basis.

Personal data may be transferred to and processed in countries outside Thailand (and outside Singapore), including locations used by Cloudflare, email providers, LINE, and Google. For this POC, transfers are made as needed to provide the service you request / use, relying on contractual and provider safeguards where available and on exceptions permitted by law (for example where the transfer is necessary to perform a contract with you). Contact us if you want more information about the safeguards we use.

We keep personal data only as long as needed for the purposes above, including:

• Account profile: while your account is active, and typically up to 24 months after a deletion request (or longer if needed for disputes or legal holds).
• Registration / attendance logs: typically up to 36 months for disputes, safety, and legal obligations.
• Server security logs: typically up to 12 months.
• Organisation billing / commercial records (if any): as required by tax and accounting law.
• Backups: retained on rolling cycles, then purged. During POC, backup and restore processes may temporarily retain copies longer than primary records.
• Individual donation consent records: kept as needed to demonstrate consent and handle withdrawals / disputes.

You may request account deletion from your profile or by emailing us. Some records may be retained where the law requires or where we need them to establish, exercise, or defend legal claims. Soft-deletion may anonymise login identifiers while retaining activity history linked to an internal ID.

Subject to applicable law (including Thai PDPA and, where relevant, Singapore PDPA), you may request:

• access to your personal data;
• a copy of your data (including portability where applicable);
• correction of inaccurate data;
• erasure or restriction of processing;
• objection to certain processing;
• withdrawal of consent; and
• to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand, and/or Singapore's PDPC where applicable.

Contact happytovolunteerapp@gmail.com. We may need to verify your identity. We aim to respond within 30 days, or as otherwise required by law. During POC, some rights requests (especially export) may be handled manually by email.

The Platform is not directed at young children. For this POC, the Platform is intended for users aged 20 or older (Thai age of majority). If you are under 20 (or the applicable age of majority), you should use the Platform only with parent or guardian consent. Where we collect date of birth for age-restricted volunteering, we use it to help Organisations and the Platform apply age rules - not as a substitute for parental consent or Organisation safeguarding.

Organisations that involve children or vulnerable persons are solely responsible for child protection, parental consent, and on-site safeguarding. Parents or guardians may contact us to request correction or deletion of a minor's account data, subject to legal holds.

We use technical and organisational measures appropriate to the risk for a small POC, including HTTPS encryption in transit, access controls, hashed passwords, bot protection on sensitive forms, and private handling of organisation verification documents. No method of transmission or storage is completely secure.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the PDPC and affected individuals as required by PDPA and related regulations, and take reasonable steps to contain and remediate the incident.

We use essential cookies so sign-in and preferences work. We do not currently run optional analytics or advertising cookies. Details are in our Cookie Policy. If we add non-essential cookies later, we will update that policy and obtain consent where required.

Content you post (profiles, photos, listings) may be visible to other users as needed for the Platform to function. Please do not post other people's personal data without a lawful basis. We may remove content as described in our Terms of Use.

This is an early validation product. Features, processors, and retention processes may change. We may pause, reset, or shut down parts of the service. If we discontinue the POC, we will handle personal data consistently with this policy (including deletion / anonymisation timelines where practicable) and notify users via the site and/or email where reasonable.

We may update this policy. The "Last updated" date will change when we do. For material changes, we will try to provide reasonable notice and may require re-acceptance in the app. Where processing relies on consent, we will seek fresh consent if required by law. Please review this page periodically.