Privacy Policy

1. Who is responsible for your data

The data controller is PRIVATE OFFICE PROPERTY CO., LTD., registered in Thailand under number 0835569011482, registered office 64/244 Moo 5, Choeng Thale, Thalang, Phuket 83110, Thailand.

We have not appointed a data protection officer. Our privacy contact handles all privacy questions, access requests, correction requests and deletion requests. Write to privateofficeth@gmail.com with the subject line "Privacy request", or call +66822344067 (every day, 09:00–21:00 Thailand time (ICT, UTC+7)).

2. What this policy covers

This policy applies to privateoffice.ltd in all its language versions, to the enquiry and owner-request forms on it, and to the messages you send us through the contact channels linked from it. It does not cover third-party websites we link to, which have their own policies.

3. Information we collect

We collect information you give us directly, and technical information generated when you use the website. How technical information is collected in the browser is explained in our Cookie Policy.

We do not ask for sensitive personal data as defined in section 26 of Thailand's Personal Data Protection Act, for example religion, health data, biometric data or criminal records. Please do not send us this kind of information. If a transaction later requires identity or source-of-funds documents, we will request them separately and explain why at that point.

• Contact details: name, email address, phone number, preferred contact channel, language and currency preference, and the content of your message.
• Property enquiry context: listing URL, property ID, enquiry type, city, deal type and the page you enquired from.
• Owner request details: property location, property type, asking-price context, and any photographs, floor plans or documents you choose to share with us.
• Technical data: IP address, browser type and version, device type and operating system;
• approximate location derived from your IP address;
• pages viewed, referring page and session identifiers;
• for every visitor, without cookies: page-level signals such as the page, time, browser and screen type, referring page and on-page interactions, sent to Google Analytics and Microsoft Clarity without identifiers that link visits; only if you accept analytics cookies: Google Analytics and Clarity identifiers and usage events, such as pages viewed, outbound link clicks and whether you stayed on a page for five minutes;
• security events such as failed form submissions and suspected automated access.

4. Why we use your information, and on what legal basis

Under the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), we rely on the following grounds (section 24 for general personal data and section 19 for consent):

• To reply to your enquiry and take the next steps you asked for, necessary for steps taken at your request before entering a contract, and our legitimate interest in running an agency.
• To assess an owner request and prepare sale representation, steps taken at your request before entering a contract.
• To check listing accuracy, availability, ownership path, viewing logistics and project context, our legitimate interest in publishing accurate listings.
• To protect the website, prevent abuse and keep audit records, our legitimate interest in security, and legal obligation where applicable.
• To meet accounting, tax and other statutory obligations, legal obligation.
• To send you marketing about properties or market updates, your consent, which you can withdraw at any time.
• To run Google Analytics and Microsoft Clarity, for cookieless measurement without identifiers, our legitimate interest in understanding and improving how the website works (section 24(5)); for analytics cookies and identifiers, your consent, given through our cookie banner. No analytics cookies are set until you accept them.

5. Marketing

We will only send you marketing messages if you have asked for them or agreed to receive them. Every marketing message includes a way to unsubscribe, and you can also opt out at any time by writing to privateofficeth@gmail.com. Withdrawing consent does not stop us replying to an active enquiry, because those replies are service messages, not marketing.

6. Who we share information with

Public pages show published property and article information only. Private lead contact details are never shown on public pages, in the sitemap, in llms.txt, in public API responses or through anonymous retrieval tools.

We do not use a third-party CRM, advertising pixels (such as the Meta pixel) or other marketing trackers. We do not sell private lead data, and we do not share it with third parties for their own marketing.

We share information only where it is needed, with:

• service providers who process data on our instructions: Cloudflare, Inc. (content delivery, security and bot protection), our virtual private server provider (server located in the Singapore region), Google LLC (Google Tag Manager and Google Analytics 4, cookieless for every visitor, with cookies only after analytics consent, and Gmail for our business email), Microsoft Corporation (Microsoft Clarity, cookieless for every visitor, with cookies only after analytics consent);
• messaging platforms, WhatsApp (Meta), Telegram or LINE, only if you choose to contact us through them;
• owners, developers or partner agencies, where that is necessary to progress a viewing or an offer you have asked us to arrange, and only with the details needed for that step;
• legal, tax and technical advisers bound by confidentiality;
• government authorities, courts or regulators where the law requires it.

7. How long we keep information

When a retention period ends we delete the data or anonymise it so it can no longer identify you.

• Active buyer enquiries: 24 months from the last contact.
• Enquiries that did not proceed: 12 months from the last contact, then deleted or anonymised.
• Owner requests and mandates: for the term of the relationship, then 5 years to meet accounting, tax and dispute-limitation requirements.
• Server and security logs: 12 months.
• Google Analytics data: kept by Google for the retention period set in our Analytics property (Google Analytics 4 allows event-level data to be kept for 2 or 14 months).
• Marketing consent records: for as long as the consent is active, plus 12 months as proof that consent was given.

8. Security

Access to enquiry and owner-request records is limited to the people and systems that need it for company work. We use encrypted connections (HTTPS), access controls, bot protection and logging of administrative actions. No transmission over the internet is completely secure, so we cannot guarantee absolute security. Where a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it unless the breach is unlikely to result in a risk to your rights, and we will notify you without delay where the risk is high, as section 37(4) of the PDPA requires.

9. Transfers outside Thailand

Where data is transferred abroad, we rely on the grounds in sections 28 and 29 of the PDPA: the provider's standard contractual data protection terms (including standard contractual clauses where the provider offers them) as appropriate safeguards, the performance of steps you requested, or your consent where that is required. You can ask us for more information about these safeguards by writing to our privacy contact.

Some of the providers we use store or process personal data outside Thailand:

• Cloudflare, Inc. (United States), content delivery, security and bot protection for every page request; data may be processed in Cloudflare data centres worldwide.
• Our virtual private server provider, the website, its database and server logs are hosted on a server in the Singapore region.
• Google LLC (United States), Google Tag Manager and Google Analytics 4 (cookieless for every visitor, cookies only after consent), and Gmail for business email; Microsoft Corporation (United States), Microsoft Clarity (cookieless for every visitor, cookies only after consent).
• WhatsApp (Meta Platforms), Telegram and LINE, only for messages you choose to send us through those apps; each provider processes data under its own policy and may do so outside Thailand.

10. Your rights

Send requests to privateofficeth@gmail.com with the subject line "Privacy request", including enough detail for us to identify the relevant enquiry. We may ask you to confirm your identity. We will act on an access request within 30 days of receiving it, as section 30 of the PDPA requires, and we aim to answer every other request within the same period. If we cannot act on a request, we will explain why.

If you are not satisfied with our answer, you may complain to the Office of the Personal Data Protection Committee (PDPC), Thailand, website www.pdpc.or.th, email saraban@pdpc.or.th.

Subject to the conditions and exceptions in the PDPA, you may ask us to:

• confirm whether we hold data about you, and give you access to it or a copy of it;
• correct data that is inaccurate, incomplete or out of date;
• delete, destroy or anonymise data where there is no longer a lawful ground to keep it;
• suspend or restrict our use of it while a request is being resolved;
• object to processing based on legitimate interest, or to direct marketing;
• receive certain data in a portable format, or have it sent to another controller;
• withdraw a consent you previously gave.

11. Visitors from the European Economic Area and the United Kingdom

Where the GDPR or UK GDPR applies to our processing, you have equivalent rights and you may also complain to your national supervisory authority. The legal bases in section 4 map to Article 6 of the GDPR: contract and pre-contractual steps, legitimate interests, legal obligation, and consent.

12. Children

This website is intended for adults. Under section 19 of the Thai Civil and Commercial Code a person becomes sui juris at 20 years of age, and under section 20 of the PDPA consent from a minor may require the consent of the person exercising parental power. We do not knowingly collect data from anyone under 20 without that consent. If you believe a minor has submitted data to us, contact us and we will delete it.

13. Changes to this policy

We may update this policy when our service, our tools or the law changes. The "last updated" date at the top shows the current version. Material changes will be flagged on the website.

14. Contact

PRIVATE OFFICE PROPERTY CO., LTD., 64/244 Moo 5, Choeng Thale, Thalang, Phuket 83110, Thailand

Privacy contact: privateofficeth@gmail.com

Phone: +66822344067 (every day, 09:00–21:00 Thailand time (ICT, UTC+7))