Thailand Privacy Notice (PDPA)

This notice adds Thailand-specific information to the Tanqory Global Privacy Policy. It applies when Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") applies to how Tanqory Inc. ("Tanqory", "we", "us") handles your personal data. Where this notice and the Global Privacy Policy differ for a person in Thailand, this notice applies.

Official references:

• Personal Data Protection Committee (PDPC) Office: https://www.pdpc.or.th/
• PDPA, unofficial English translation: https://pdpa.msu.ac.th/wp-content/uploads/2022/05/EN-PDPA-2019.pdf (the Thai text published in the Royal Gazette on 27 May 2019 is the binding version)

---

1. Who is responsible

• Tanqory Inc. is the data controller for personal data about merchants, developers, visitors to Tanqory websites and users of Tanqory apps. Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA.
• Merchant stores: when you buy from a store that runs on Tanqory, the merchant is the data controller and Tanqory processes that data on the merchant's behalf under our Data Processing Addendum (PDPA s.40 processor duties). Ask the merchant first about your rights; we help the merchant answer.
• Contact for Thailand: privacy@tanqory.com. Our Data Protection Officer can be reached at the same address. Please write "PDPA request" in the subject line.

2. What we collect and why (PDPA s.23)

The categories of data, purposes, recipients and retention periods are listed in the Global Privacy Policy (sections "Personal Data We Collect", "How We Use Personal Data", "Sharing of Personal Data with Third Parties" and "Data Retention and Deletion"). The legal basis we rely on for each purpose under PDPA s.24 is:

We do not ask for sensitive data (PDPA s.26), such as health, religion, biometric or criminal records data, to use Tanqory. If a provider we use for identity checks needs sensitive data, we will ask for your explicit consent first.

If you do not give us data that the contract or the law needs (for example a billing address), we may not be able to open or keep your account.

3. Your rights (PDPA ss.30 to 36)

You can ask us to:

• give you a copy of your personal data, or tell you how we got data you did not consent to (s.30);
• send your data to you or to another controller in a machine-readable format (s.31);
• stop processing based on legitimate interests or for direct marketing (s.32);
• delete, destroy or anonymise your data (s.33);
• restrict processing while a request is checked (s.34);
• correct data that is wrong or incomplete (s.35 and s.36);
• withdraw consent at any time (s.19). Withdrawing is as easy as giving it: use the unsubscribe link, your account settings, or email us. It does not affect processing done before.

Send requests to privacy@tanqory.com. We will check your identity before we act. We answer within 30 days of receiving a complete request (s.30). If we refuse, we tell you why and record the refusal, as s.30 and s.36 require. Requests are free, unless a request is manifestly unfounded or excessive.

You can also complain to the PDPC Office (s.73) through https://www.pdpc.or.th/. We would like the chance to fix the problem first, but you do not need to contact us before you complain.

4. Children

Tanqory is built for businesses and is not meant for children. You must be an adult (20 or older in Thailand, or married, under the Civil and Commercial Code) to open a merchant account. We do not knowingly collect data from children under 10 (s.20). If we learn that we did without the consent of a parent or guardian, we delete it.

5. Cookies and similar technologies

Strictly necessary cookies are always on. For other cookies (analytics and ad measurement) on Tanqory websites, visitors in Thailand see our cookie notice and can switch them off at any time in the cookie settings. We also honour Global Privacy Control signals from your browser. The full list is in our Cookie Policy.

6. Transfers outside Thailand (PDPA ss.28 and 29)

Tanqory is a US company. Today our platform data is hosted by DigitalOcean in Singapore, and some of our service providers process data in the United States and other countries (see the subprocessor list). When personal data leaves Thailand we rely on contractual safeguards of the kind the PDPC accepts in its notifications under ss.28 and 29 (in force since 24 March 2024), or on another ground that s.28 allows, such as performing our contract with you. You can ask us for a copy of the safeguards that apply to your data.

7. Security and data breaches (PDPA s.37)

We protect personal data with the measures described in the Global Privacy Policy section "Data Security Measures". If a personal data breach happens, we notify the PDPC Office without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to risk anyone's rights and freedoms. If the risk is high, we also tell the people affected, and how we are fixing it, without delay (s.37(4)).

8. How long we keep data

We keep personal data only as long as the purposes in section 2 need, or longer if a law requires it (for example Thai or US tax records). Periods are listed in our Data Retention Policy. After that we delete or anonymise the data.

9. Changes and language

We will post changes to this notice here and change the "Last updated" date. For a material change we will also tell you prominently, for example by email or with a notice on our website or app. This notice is in English; a Thai translation will follow.

Change history