Privacy Policy
Contents
(being updated) (the "Company", "we" or "us"), as the data controller of the SOREALTH platform, protects your personal data in line with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). This policy explains what we collect, why, who we share it with, how long we keep it and your rights. The Thai version of this policy prevails.
1. Data we collect
| Type | Examples |
|---|---|
| Account | Username, display name, e-mail, phone, password (stored as a one-way hash), profile photo |
| From sign-in providers | When you sign in with Google, Apple, Microsoft, LINE or WeChat: that service's user ID, your name and e-mail (if shared) |
| Verification documents | ID card / passport, a photo of you holding it, title deed, power of attorney — only when you submit them for verification |
| Listings and property | Address and map position, rent, photos, clips, property details |
| Rental | Viewings, offers, bookings, leases, electronic signatures, bills, meter readings, repair requests |
| Payments | Amount, method, transaction reference (we never store card numbers — the payment provider processes them) |
| Communications | Chat messages, messages to our team, reviews, clip comments |
| Places and preferences | My places (e.g. workplace), saved searches, favourites, search sentences |
| Usage and device | IP address, access times, browser type, system logs, cookies (see the Cookie Policy) |
Sensitive data: Thai ID cards may show religion or blood group, which we do not need — please cover them before uploading. Staff compare your photo with the card by eye only; we do not process biometric data (no automated face recognition).
2. Purposes and legal bases
| Purpose | Legal basis (PDPA s. 24 / 26) |
|---|---|
| Creating and running your account, sign-in, OTP | Contract |
| Listings, chat, viewings, offers, bookings, leases, bills, collecting payments and paying landlords | Contract |
| Checking identity / ownership documents and showing badges | Your consent (submitting documents is optional) |
| Trust scores, preventing fraud and scam listings, system security | Legitimate interests |
| Improving the service, aggregate statistics, AI area advice and AI search | Legitimate interests |
| Keeping accounting and tax records, computer traffic data, answering authorities as required | Legal obligation |
| News, promotions and marketing recommendations | Your consent (withdraw any time) |
| Analytics and marketing cookies | Your consent |
If you do not provide data needed for a contract, we may be unable to provide some services, such as online leases or payments.
3. Who we share data with
We do not sell your personal data. We share only what is needed with:
- Other users — listing information, display name, profile photo, agent profile, reviews, and what you choose to send to people you chat with, sign with or meet for viewings.
- Service providers working for us (data processors) — hosting and storage, e-mail and SMS, payment providers, maps and place data (OpenStreetMap, Google Maps/Places), sign-in providers and AI providers (only the search text and listing facts needed, never your name or contact details), under contracts that require them to protect the data.
- Authorities, courts or officials when the law requires or on a lawful order.
- A buyer or successor of the business, who must keep protecting your data under this policy.
4. Transfers abroad
Some of our providers run servers outside Thailand (cloud, e-mail, maps, sign-in and AI). We transfer only what is necessary, to countries or recipients with adequate protection or with the safeguards required by PDPA sections 28–29.
5. How long we keep data
| Data | Period |
|---|---|
| Account and usage data | While you have an account; deleted or anonymised when the account is closed |
| Verification document files | Deleted automatically after the set period following review (only the result is kept) |
| Leases, bills and payment records | At least 5 years under accounting and tax law, or until legal claims are time-barred (up to 10 years) |
| Computer traffic data | At least 90 days under the Computer Crime Act |
| Consents and policy acceptances | While you have an account and as long as needed to prove consent |
6. Your rights
Under the PDPA you may:
- Withdraw consent at any time (without affecting earlier processing)
- Access and obtain a copy of your data
- Receive or transfer your data in a machine-readable format
- Object to collection, use or disclosure
- Ask for erasure, destruction or anonymisation
- Ask us to restrict use of your data
- Ask for correction so your data is accurate, current and complete
- Complain to the Office of the Personal Data Protection Committee (PDPC)
Use these rights on the Privacy & my data page (you can download a copy of your data straight away) or contact us as in section 9. We respond within 30 days of receiving a request and may refuse where the law allows, giving our reasons.
7. Security
We use appropriate measures such as encrypted connections, encrypted secrets, a private store for verification documents that is never public, role-based staff access and an audit log. If a personal data breach occurs we notify the PDPC within 72 hours of becoming aware of it, and notify you if there is a high risk to your rights and freedoms.
8. Minors
The service is for adults. We do not knowingly collect minors' data without the consent of a parent or guardian.
9. Contact / Data Protection Officer (DPO)
- Data controller: (being updated), (being updated)
- Data Protection Officer: (being updated), e-mail (being updated)
10. Changes
We may update this policy from time to time. For material changes we will let you know on the Platform before they take effect. The effective date of the current version is shown at the top of this page.
