Roles of the parties
For personal data you load into the system (for example tenants), you are the "data controller": you decide what is collected and why.
We are the "data processor": we handle that data on your behalf, only to provide the platform.
For your own account data (name, email, payment for the service) we are the controller, as described in the Privacy Policy.
Data and data subjects concerned
Data subjects: tenants and residents, guarantors, emergency contacts, and users you invite (managers, staff).
Data types: full name, phone number, email, LINE ID, address, lease details, rent and utility charges, payment evidence, and documents you upload such as ID card or passport copies.
ID card copies can contain sensitive data such as religion and blood type. We recommend masking anything unnecessary before uploading.
Processing on your instructions
We process tenant data only on your documented instructions, which are your use of the platform under the Terms of Service and the settings you choose.
We will not use tenant data for our own marketing, sell it, or disclose it to anyone beyond what clause 6 allows.
If we believe an instruction of yours may breach the law, we will tell you.
Your duties as owner
You must have a lawful basis for collecting and using tenant data, and tell tenants the purposes, retention period and their rights at or before collection.
You must obtain explicit consent from tenants where sensitive data is collected, and collect only what is necessary.
You must manage the access of the users you invite so they see only what their role needs, and revoke access promptly when someone leaves.
Security measures
We keep the data confidential and limit access to personnel who need it and are bound by confidentiality duties.
We apply appropriate technical and organisational measures, such as encryption in transit, separation of data between dormitories, access control, and audit logs.
Sub-processors and third parties
You authorise us to use sub-processors as needed to run the service: infrastructure and storage providers, the payment provider, email and SMS delivery providers, and the LINE notification provider.
We bind every sub-processor to protection no weaker than this agreement and remain responsible to you for their performance.
We will give you reasonable advance notice of any material addition or change of sub-processor.
Assisting with data subject rights
If a tenant contacts us directly to exercise a right such as access, correction or deletion, we will forward the request to you and will not respond to it ourselves unless you instruct us to.
We provide reasonable tools and assistance so you can respond within the time the law allows.
Personal data breaches
If we become aware of a personal data breach affecting your tenant data, we will tell you without undue delay, with the details we have: the nature of the incident, the data affected and the measures taken.
As controller you must notify the Personal Data Protection Committee Office within 72 hours of becoming aware where the breach risks individuals' rights and freedoms, and notify the data subjects where the risk is high. We will provide what you need to do so.
Cross-border transfers
If data is stored or processed outside Thailand, we will make sure the destination or recipient has adequate data protection standards, or that appropriate safeguards under the PDPA are in place.
Return and deletion at the end of the service
After you close your account you may request an export of tenant data within 90 days. After that we delete the data or make it non-identifiable, unless the law requires us to keep it, such as accounting and tax records.
Audit
On your reasonable written request we will provide the information needed to show we comply with this agreement, including the list of sub-processors in use.
Relationship to other documents and changes
If this agreement conflicts with the Terms of Service on the processing of tenant personal data, this agreement prevails.
We may update this agreement from time to time. For material changes we will give advance notice and may ask you to accept it again.