Privacy Policy

Checku is a web application developed and operated by OrbitInnotive Co., Ltd.

This Privacy Policy (“Policy”) describes how OrbitInnotive Co., Ltd. (“OrbitInnotive,” “we,” “us,” or “our”) collects, uses, shares, and protects personal data in connection with our websites, mobile and web applications, assessments, résumé/profile uploads, AI Companion, analytics, payments, and related services (collectively, the “Services”).

By accessing or using the Services, you agree to this Policy and our Terms of Service. If you do not agree, please discontinue use.

Company details: OrbitInnotive Co., Ltd., 496–502 Gaysorn Amarin Building, 5th Floor, Room 5057, Phloen Chit Road, Lumpini, Pathumwan, Bangkok 10330, Thailand.
Contact: tech@orbit-people.com Tel. (66) 094-669-2391

1. Overview; Scope; Acceptance
This Policy applies to all personal data processed by OrbitInnotive in connection with the Services. It explains what data we collect, how we use it, whom we share it with, how we protect it, and what rights you have under applicable laws such as the Thai Personal Data Protection Act B.E. 2562 (PDPA), the EU/UK GDPR, and other relevant regulations.

2. Data Controller and Contact

OrbitInnotive Co., Ltd. is the data controller responsible for your personal data. Our Data Protection Officer (DPO) can be reached at info@checku.work If required by EU or UK law, we will appoint and publish details of our local representative.

3. Personal Data We Collect

We collect only what is necessary for lawful and transparent processing. This may include account and contact information such as your name, email, country, and organization; résumé or profile data such as education and work history; responses to assessments and generated reports or insights; chat and AI Companion data, including messages and reflection history; temporal and birth data (date, time, and place of birth) collected only with explicit consent; usage and device information such as cookies, IP addresses, and analytics logs; payment metadata handled through PCI-DSS-compliant gateways; and any communication you voluntarily send to us such as emails or support requests.

We do not intentionally collect health, religious, or biometric data unless required for a specific purpose and supported by explicit consent.

4. How We Collect Data

We collect data directly from you when you register, upload content, or communicate with us; automatically through cookies, SDKs, and system logs; and from authorized third parties such as enterprise customers or analytics providers acting under contract. Our cookie banner allows you to accept, reject, or manage non-essential cookies. We honor Global Privacy Control (GPC) signals where supported.

5. Purpose of Processing

We process personal data to operate and improve the Services, provide personalized insights, ensure security and integrity, develop new features, communicate with users, and comply with legal obligations.

Our lawful bases include performance of contract, legitimate interests, consent (for optional or sensitive processing), and compliance with legal obligations. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Sensitive and Special Data

We treat date, time, and place of birth as sensitive data under the PDPA. Such data are used only for statistical and personalization purposes, not for spiritual or deterministic predictions. If we ever need to process special categories such as health or belief data, we will obtain explicit consent and apply heightened security safeguards.

7. Automated Processing and Profiling

We use automated systems to generate insights, behavioral analyses, and personality reflections. These systems may process multiple data inputs to produce descriptive results. They do not make decisions with legal or similarly significant effects, such as employment, credit, or medical determinations.

We will provide meaningful information about the logic and purpose of such profiling upon request, and we offer human review where required by law. However, detailed algorithms, model architectures, training datasets, and proprietary heuristics remain confidential trade secrets in accordance with Section 23 of the Terms of Service.

8. Consent and User Choices

We obtain explicit, informed consent where required by law—particularly for sensitive data, marketing communications, and optional career-related features. Consent is never pre-checked or bundled. You may withdraw consent or request deletion of data at any time to the extent technically and legally feasible in accordance with applicable law. by contacting info@checku.work

9. Children and Minors
Our Services are not directed to children under 13. In Thailand, users aged 10 to under 20 are considered minors under civil law. To comply with the PDPA and the Thai Civil and Commercial Code, our system automatically restricts access to paid or marketing features for accounts that are likely to belong to users under 20, based on country settings and account behavior. We may request age or parental verification only where legally required before re-enabling such features. Freemium or educational features remain fully available to all users.

10. Data Sharing and Disclosure

We share data only as necessary for service delivery and compliance. This includes service providers and sub-processors (such as hosting, analytics, support, and payment vendors) bound by data-processing agreements; enterprise customers when we act as a processor under a Data Processing Addendum; business partners providing regional support under confidentiality obligations; legal authorities where disclosure is required by law; and lawful corporate transfers such as mergers or acquisitions.

We do not sell personal information. Certain limited uses, such as aggregated analytics or privacy-safe audience measurement, may involve data sharing under applicable law, but never in exchange for direct monetary value.

10.1 Community Visibility and Public Profiles

When you complete an assessment, your name and result type may be visible to other users within Checku by default to enable community or social features.
Only limited non-sensitive data (name and result category) are displayed.
You may change this visibility setting at any time once the profile toggle feature becomes available, or you can request withdrawal of consent by contacting info@checku.work.
Default visibility is based on voluntary consent obtained during registration, and users can withdraw such consent at any time without affecting prior lawful processing.

11. International Data Transfers

When data is transferred outside Thailand, the EU, or the UK, we use lawful mechanisms such as Standard Contractual Clauses, the UK IDTA, adequacy decisions, or PDPA Sections 28–29. We also apply encryption, pseudonymization, and strict access control to protect data during transfer.

12. Retention and Deletion

We retain personal data only as long as necessary for the purposes stated in this Policy. Typically, chat data are kept for 12 months (or six months for Freestyle mode), assessments and reports for up to five years, and payment records as required by tax and accounting law. Account data may be retained for up to 24 months after deactivation.

When retention periods expire, we securely delete or anonymize data according to PDPC guidelines. Ephemeral Chat sessions are not stored beyond temporary security logs.

13. Security Safeguards

We implement administrative, technical, and physical safeguards to protect personal data. Measures include TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access control, multi-factor authentication, secure software development, annual penetration testing, DDoS protection, and continuous monitoring. We maintain a documented incident-response plan and will notify affected users and regulators where required by PDPA Section 37(4) or equivalent law.

14. Your Rights

You have rights under applicable data-protection laws to access, correct, delete, restrict, or object to processing; to obtain a copy of your data; to withdraw consent; and to lodge a complaint with the Personal Data Protection Committee (PDPC) or your local authority. We may request reasonable verification of your identity before fulfilling requests and will respond within the timeframe required by applicable law (generally within 30 days).

15. Marketing Communications

We send marketing emails or personalized recommendations only with your opt-in consent. You may unsubscribe or withdraw consent at any time. For business-to-business communications, we rely on legitimate interests with a simple opt-out mechanism. We honor Do Not Sell/Share signals and local opt-out frameworks.

16. Cookies and Analytics

Cookies and similar technologies help operate the Services, maintain security, remember preferences, and analyze usage. Advertising and audience-measurement cookies are used only with consent. You can manage preferences through our cookie banner or browser settings. Further details are available in our Cookie Policy.

17. Enterprise and Processor Roles

When OrbitInnotive acts as a processor for enterprise customers, we process data only under the customer’s documented instructions. We implement equivalent security safeguards, manage sub-processors transparently, assist with data-subject requests and breach notifications, and delete or return data upon termination. A full Data Processing Addendum (DPA) is available on request.

18. Legitimate Interests

We rely on legitimate interests for essential service functions such as security, fraud prevention, service optimization, and aggregated product analytics. We conduct balancing tests to ensure these interests do not override user rights and freedoms.

19. Regional Compliance

We comply with all applicable regional privacy laws.
In Thailand, we follow the PDPA, including Sections 19–29 on consent, transfer, and retention.
In the EU and UK, processing complies with GDPR/UK-GDPR principles and ePrivacy requirements.
In the United States, we honor CCPA/CPRA and similar laws, including “Do Not Sell/Share” options.
In other jurisdictions, equivalent protections are applied.

20. Data Breaches and Notifications

If a personal-data breach occurs that may risk your rights, We will assess and, where required by applicable law, notify affected users and regulators within a reasonable period in accordance with applicable legal obligations, following PDPA Section 37(4) and international standards. We maintain a register of incidents and continuously improve safeguards.

21. Dispute Resolution and Governing Law

This Policy and any related disputes are governed by the laws of Thailand.
Disputes will be resolved by confidential arbitration at the Thai Arbitration Center (THAC) in Bangkok, in accordance with the rules referenced in Section 15 of the Terms of Service. You may also contact the PDPC or your local authority for assistance where permitted.

22. Updates to This Policy

We may revise this Policy to reflect legal or operational changes. Material updates will be communicated by email or in-app notice, and the effective date will be updated accordingly. Continued use of the Services after such updates constitutes acceptance of the revised Policy.

23. Relationship to Terms of Service

This Policy complements the Terms of Service. In the event of any inconsistency between this Policy and the Terms, the Terms of Service shall prevail for matters relating to contract formation, liability, or dispute resolution.

24. Contact and Acknowledgement

For questions, rights requests, or privacy complaints, contact our Data Protection Officer at info@checku.work
For general or business inquiries, contact info@checku.work

By using the Services, you acknowledge that you have read and understood this Privacy Policy and agree to its terms in conjunction with the Terms of Service.

Checku is a brand operated by OrbitInnotive Co., Ltd.