Privacy policy

Version 1.0 · Effective 25 September 2026

This policy explains what personal data MAKEiO collects through makeio.co.th, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to everyone who visits the site, applies for a job through it, or emails us at the address shown on it.

We collect as little as we can. The site has no contact form and no user accounts. The only personal data you give us through the site is a job application. We also receive the emails you choose to send us, and we process some basic technical data to run the site.

Who we are

MAKEiO is a group of companies in Thailand, Indonesia and Vietnam. Each company (an "Entity") is a separate data controller: it decides how the personal data it is responsible for is used, and it answers to you and to the data-protection authority in its country.

• MAKEIO CO., LTD. (Thailand), Tax ID 0105558107315, 187/27 (Area 34 Gokart) Soi Chula 3, Banthat Thong Rd., Wang Mai, Pathumwan, Bangkok 10330
• MAKEIO MOBILITAS INDONESIA (Indonesia), AKR Tower Lantai 16 Unit A, Jl. Panjang No. 5, Kebon Jeruk, Jakarta Barat 11530
• MAKEIO VIETNAM CO., LTD (Vietnam), Tầng 4, Tòa Nhà IMC Tower, số 62 Trần Quang Khải, Phường Tân Định, TP. Hồ Chí Minh

Which Entity is responsible depends on the data:

• Job applications: the Entity that is hiring for the job you apply for. Each job page names that Entity.
• Emails you send us: MAKEIO CO., LTD. manages the inbox. If your email concerns Indonesia or Vietnam, we pass it to that country's Entity, which is then also responsible for it.
• Use of the website, cookies and analytics: MAKEIO CO., LTD., which runs the website.

In this policy, "we", "us" and "our" mean the responsible Entity. You can reach all three Entities about privacy at monowheel.bike@gmail.com. None of the Entities has appointed a data protection officer at this time. If one does, we will add their contact details here.

What we collect and why

Job applications

When you apply for a job, we collect:

• your full name, email address, phone number and country of residence
• your CV (a PDF or DOCX file)
• your expected salary
• a LinkedIn or portfolio link and a short message, if you choose to add them
• your answers to the job's screening questions, if it has any
• a record of your consent: when you gave it, which version of this policy applied, and the language it was shown in
• the language you used the site in

Please don't include copies of ID cards, your religion, health information or other sensitive information in your CV or answers. We don't need it to assess your application. If you include it anyway, we will not use it in our decision.

The fields marked as required on the form are needed to consider your application. If you leave them out, we can't process it. You are not required by law or by any contract to apply.

We use this data for the following purposes:

• To assess your application and decide whether to take it further, and to contact you about it (for example to arrange an interview, ask a question or tell you the outcome). Legal basis: your consent, which you give by ticking the box on the application form, and the steps you ask us to take before a possible employment contract.
• To tell the hiring team that a new application has arrived, through our internal messaging tool, Lark. Legal basis: the same as above.
• To keep a record of your consent, so we can show that you agreed and what you agreed to. Legal basis: our legal obligation to be able to prove consent.
• To protect the form from spam and abuse, using Cloudflare Turnstile. Legal basis: our legitimate interest in keeping the form and our systems secure. (For Vietnam, see the Vietnam section.)

People at MAKEiO review every application. We do not make hiring decisions by automated means alone. We do not use your application for marketing and we never sell it. We don't keep a talent pool: if you would like to be considered for another role, please apply for that role.

Emails you send us

If you email monowheel.bike@gmail.com, we receive your email address, your name if it is shown, what you write and any attachments. We use this to read and answer your message and to deal with what you have asked about. Legal basis: our legitimate interest in replying to people who contact us, or, where you ask about working with us (for example a partnership or distribution enquiry), the steps you ask us to take before a possible contract. (For Vietnam, see the Vietnam section.)

The website itself does not store the messages you send.

Using the website

• Technical data. When you visit the site, our hosting provider Vercel processes the technical data needed to deliver pages to you and keep the site secure, such as your IP address, browser and device type, the pages you request and the time of the request. Legal basis: our legitimate interest in running a secure, working website.
• Visit statistics without cookies. Vercel Web Analytics counts page views and shows us, in aggregate, which pages are used. It sets no cookies and does not identify individual visitors. The short-term visitor identifier it uses is discarded within 24 hours. Legal basis: our legitimate interest in understanding how the site is used so we can improve it.
• Google Analytics 4. Used only if you accept analytics cookies in the cookie banner. It helps us understand how visitors find and use the site. Legal basis: your consent.
• Your settings. The site remembers your cookie choice and, if you use the language suggestion banner, your preferred language. Legal basis: this is needed to provide the site the way you asked for it.

Who we share it with

We don't sell personal data. We share it only with the service providers below, who process it on our behalf under their data-protection terms and only as far as they need to provide their service:

• Supabase: the database and file storage that hold applications and CVs, in its Singapore region.
• Vercel: hosts the website, runs the server code that receives your application, and provides Vercel Web Analytics.
• Lark: our internal messaging tool. For each new application, the hiring team receives a message with the job title and hiring Entity, your name, email address, phone number, expected salary and LinkedIn link, and a link to your CV that stops working after 7 days. The CV file itself is not sent to Lark.
• Google: Google Analytics 4 (only after you accept analytics cookies), and Gmail, which hosts the inbox monowheel.bike@gmail.com.
• Cloudflare: Turnstile, which checks that the application form is being sent by a person and not an automated program.
• OpenStreetMap: the map on the Contact page is loaded from openstreetmap.org, which receives your IP address and browser details to deliver the map. It sets no cookies.

Inside MAKEiO, your application is seen only by the people involved in filling that job. MAKEIO CO., LTD. runs the website and these systems for the group, so its staff may handle an application on behalf of the Indonesian or Vietnamese Entity.

We may also disclose personal data to a public authority or court when the law requires us to.

Storage in Singapore

Applications and CVs for jobs in all three countries are stored in Supabase's Singapore region. This means that if you apply for a job in Thailand, Indonesia or Vietnam, your data is transferred to Singapore and stored there. Our other providers (Vercel, Google, Cloudflare and Lark) run their services worldwide and may process data in other countries, including the United States.

We protect these transfers in three ways:

• Contract terms. We use our providers under their data-processing terms (for Supabase, its Data Processing Addendum). These require them to process the data only on our instructions, keep it confidential and secure, and help us respond to your requests.
• Your consent. The application form tells you that your data will be stored in Singapore, and you agree to this when you tick the consent box.
• Security measures. CV files are kept in private storage that the public cannot access, data is encrypted in transit and at rest, and access is limited to authorised people.

Singapore has its own data-protection law, the Personal Data Protection Act 2012. However, none of our three countries has yet formally recognised Singapore as offering the same level of protection as its own law, so we cannot promise that the rules in Singapore match those in your country in every respect. The country sections below add the points that apply in each country.

How long we keep it

• Applications and CVs are deleted automatically 6 months after the job closes. If the job is still open 12 months after you applied, your application is deleted at that point. Deletion covers both your application record and your CV file. You can ask us to delete them earlier at any time.
• If you are hired, the information you gave us becomes part of your employment records, and we will tell you separately how we handle employee data.
• Lark notifications: the link to your CV stops working after 7 days. We delete the notification messages about an application no later than the application itself.
• Emails you send us are kept as long as needed to deal with your message and any follow-up, and are then deleted.
• Technical data held by Vercel is kept only for the short period set by Vercel's standard log retention.
• Google Analytics 4 data is kept for no more than 14 months and then deleted by Google.
• When we delete an application, we keep a short log entry that a deletion took place (an internal reference number, the date and the reason), without your name or contact details.

Cookies and analytics

By default, the site uses only what is essential for it to work. Analytics cookies are set only if you choose "Accept" in the cookie banner. "Accept" and "Reject" are equally easy to choose.

Vercel Web Analytics does not use cookies.

You can change your choice at any time with the "Cookie settings" link in the footer of every page. If you withdraw consent, Google Analytics stops loading from then on. You can also delete cookies in your browser settings.

Your rights

Depending on the law of your country (see the country sections), you have the right to:

• access your personal data and get a copy of it
• correct data that is wrong or incomplete
• delete your data
• withdraw your consent at any time. This is as easy as giving it and does not affect what we did before you withdrew. If you withdraw consent for a job application, we will stop considering it and delete it.
• object to processing based on our legitimate interests
• restrict processing, for example while we check a correction you asked for
• data portability: receive the data you gave us in a common electronic format, or have it sent to another organisation, where this applies
• complain to the data-protection authority in your country

To use any of these rights, email monowheel.bike@gmail.com. Tell us what you would like us to do and, for an application, which job you applied for. We may ask you to confirm your identity, usually by writing from the email address you applied with. Using your rights is free. We will answer within the time limits in your country's law, which are listed in the country sections, and never later than 30 days after we receive your request.

If a security incident puts your personal data at risk, we will notify you and the relevant authority as the law requires.

Thailand

This section applies to MAKEIO CO., LTD., which is the controller for jobs in Thailand, for emails you send us and for the website.

• Law. The Personal Data Protection Act B.E. 2562 (2019) (PDPA).
• Legal bases. Your consent (section 19); steps taken at your request before entering into a contract (section 24(3)); our legitimate interests (section 24(5)); and compliance with the law (section 24(6)).
• Your rights. Access and a copy, and to ask how we obtained data you did not give us (section 30); data portability (section 31); objection (section 32); erasure (section 33); restriction (section 34); correction (section 35); and withdrawal of consent (section 19). We will respond to an access request within 30 days.
• Storage in Singapore. Thailand's Personal Data Protection Committee has not yet published a list of countries with adequate data-protection standards. We rely on your consent, given after you have been told that your data will be stored in Singapore and that Singapore has not been formally recognised as having adequate standards (section 28(2)), on the transfer being necessary for steps you asked us to take before a possible employment contract (section 28(3)), and on our providers' contractual safeguards.
• Complaints. You can complain to the Office of the Personal Data Protection Committee (PDPC): www.pdpc.or.th.

Indonesia

This section applies to MAKEIO MOBILITAS INDONESIA, which is the controller for jobs in Indonesia and for emails about Indonesia that we pass to it.

• Law. Law No. 27 of 2022 on Personal Data Protection (UU PDP). Its implementing regulation, Government Regulation No. 33 of 2026, takes effect on 16 January 2027.
• Language. This policy and the consent statement on the application form are available in Bahasa Indonesia, and on the Indonesian version of the site the consent statement is shown in Bahasa Indonesia.
• Legal bases. Your explicit consent; fulfilling obligations under a contract or taking steps you ask for before a contract; compliance with the law; and our legitimate interests (Article 20).
• Your rights. To be informed about the processing; to correct your data; to access it and get a copy; to have processing ended and your data deleted or destroyed; to withdraw consent; to object to decisions based only on automated processing (we do not make such decisions); to delay or restrict processing; to obtain and use your data in a commonly used format or have it sent to another controller; and to sue and claim compensation for a breach of the law (Articles 5 to 13). When we delete data at your request, we will tell you.
• Storage in Singapore. Article 56 of the UU PDP allows transfers abroad with adequate and binding safeguards or with your consent. The national personal data protection agency has not yet been established, so there is not yet an official list of countries or standard contract clauses. Until then, we rely on our providers' contractual safeguards and on your consent in the application form. We will review this when the agency publishes its rules.
• Changes. If we change how we process your data, we will tell you before the change takes effect.
• Complaints. You can complain to the personal data protection agency once it is established. Until then, complaints go to the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital, Komdigi, formerly Kominfo).

Vietnam

This section applies to MAKEIO VIETNAM CO., LTD, which is the controller for jobs in Vietnam and for emails about Vietnam that we pass to it.

• Law. The Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP, both in force since 1 January 2026.
• Legal bases. Vietnamese law does not recognise "legitimate interests" as a legal basis, so in Vietnam we rely on your consent and on the other grounds the law allows:
  • For a job application, your consent on the application form covers everything described in this policy for applications: assessing it, the anti-spam check, the Lark notification to the hiring team, storage in Singapore and the retention period.
  • For an email you send us, we process it with the consent you give by choosing to write to us. You can withdraw that consent at any time.
  • For Google Analytics, we rely only on the consent you give in the cookie banner. If you reject analytics cookies, Google Analytics does not load. Vercel Web Analytics only produces overall visit counts and does not identify you.
• Candidates who are not hired. Vietnamese law requires us to delete the data of candidates who are not recruited unless they have agreed otherwise. By consenting on the application form, you agree to the retention period in "How long we keep it". You can ask us to delete your application earlier at any time.
• Your rights. To be informed; to give or withdraw consent; to access, correct and delete your data; to restrict processing; to receive your data; to object to processing; and to complain, bring a lawsuit and claim compensation. We will acknowledge your request within 2 working days, and deal with access or correction within 10 days, withdrawal of consent or restriction within 15 days, and deletion within 20 days.
• Storage in Singapore. Where Vietnamese law requires it, MAKEIO VIETNAM prepares an impact assessment for transferring personal data abroad and files it with the Ministry of Public Security.
• Complaints. You can complain to the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.

Changes to this policy

We will update this policy when the way we handle personal data changes or the law changes. Each version has its own number and effective date, shown at the top of this page, and each application records the version that applied when it was sent. If a change affects how we use data we already hold, we will tell the people affected before the change takes effect where the law requires it.

This policy is published in English, Thai, Bahasa Indonesia and Vietnamese. If the versions differ, the English version applies, except where local law requires the local-language version to apply.

Contact

For any question about this policy or your personal data, or to use your rights, email monowheel.bike@gmail.com. Please say which country your question concerns, so we can pass it to the right Entity.

You can also write to the Entity concerned at the address listed in "Who we are".