Privacy Policy

Introduction

This Privacy Policy explains how we collect, use, store and protect your personal data when you use our service. We are committed to protecting your privacy in accordance with applicable data protection law.

Data We Collect

• Identity data: name, username or similar identifier
• Contact data: email address
• Purchase data: what you bought and when, the amount and currency, and Paddle's order reference. We never receive your card or bank details.
• Usage data: pages visited, features used, search queries
• Device data: IP address, browser type, operating system
• Approximate location data (if permitted by you)

Legal Basis for Processing

We process your personal data on the following legal bases:

• Consent: you have given clear consent to processing
• Contract: processing is necessary for a contract with you
• Legitimate interests: where not overridden by your rights
• Consent to cookies: analytics, marketing and external content run in your browser only with your consent, which you can withdraw at any time in the privacy settings (see the cookie policy)
• Legitimate interests in error reports: when something on the site fails, a technical error report (the error, the page, and technical details of the browser and the connection) goes to our error-monitoring provider so that we can fix it; nothing is stored on your device for this

Your Data Subject Rights

Under the Personal Data Protection Act B.E. 2562 (2019) you have the following rights:

• §19 — Right to withdraw consent at any time without affecting lawfulness of prior processing
• §22 — Right to object to processing of your personal data
• §30-37 — Rights to access, rectification, erasure, restriction, portability and to lodge a complaint

Your rights under the GDPR

We apply the standard of the EU General Data Protection Regulation (GDPR) to every visitor, wherever you are. You therefore have the following rights, which you can exercise free of charge by writing to us. We reply within one month (Art. 12(3) GDPR); if we need to confirm your identity, we may ask you for information that lets us do so.

• Access (Art. 15): confirmation of whether we process your data, a copy of it and information about how we use it
• Rectification (Art. 16): correction of inaccurate data and completion of incomplete data
• Erasure (Art. 17): deletion of your data where, for example, it is no longer needed or you withdraw the consent the processing was based on
• Restriction (Art. 18): limiting the processing while, for example, the accuracy of the data or your objection is being checked
• Portability (Art. 20): your data in a structured, commonly used and machine-readable format, or sent to another controller, where the processing is based on consent or a contract and is automated
• Objection (Art. 21): to processing based on our legitimate interests, on grounds relating to your particular situation, and at any time to direct marketing
• Automated decisions (Art. 22): we take no decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you
• Withdrawal of consent (Art. 7(3)): at any time, without affecting the lawfulness of processing before the withdrawal; for cookies, in the privacy settings
• Complaint (Art. 77): to a supervisory authority, in particular in the EU or EEA country where you live or work or where the alleged infringement took place

To exercise these rights, write to: privacy@tripinthai.com

Data Retention

We retain personal data for as long as necessary to provide our services and comply with legal obligations. Account data is retained for the duration of your account and up to 3 years after closure unless a longer period is required by law. Anonymised analytics data may be retained indefinitely.

Subprocessors

We use trusted third-party service providers (subprocessors) to operate our service. A current list of subprocessors is available on request. All subprocessors are bound by data processing agreements.

Transfers outside the EEA

Some of our service providers process personal data outside the European Economic Area (EEA), in particular in the United States. We transfer data only where the European Commission has decided that the country or framework ensures an adequate level of protection — such as the EU-US Data Privacy Framework for certified US companies — or on the basis of standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR), with additional safeguards where needed. You can ask for a copy of these safeguards at the privacy contact. The cookie policy names the safeguard for each provider of cookies and similar technologies. The service runs on Amazon Web Services servers in Singapore, and our e-mails are sent from Singapore; these transfers rely on the standard contractual clauses of the AWS Data Processing Addendum.

Updates to This Policy

We may update this policy from time to time. We will notify registered users of material changes. Continued use of the service after changes constitutes acceptance.