Privacy Policy

Personal data we collect

We may collect the following data as necessary to provide our services:

• Account information, such as first name, last name, username, email, phone number, and hashed password.
• Usage data, such as IP address, device type, browser, operating system, pages visited, session time, usage logs, and cookie data.
• Transaction data, such as details of contracts you voluntarily create, packages you purchase, payment history, receipts, and payment status. Payment card data may be processed by an external payment service provider.
• Information you submit to us, such as support requests, form submissions, feedback, file attachments, or content you create in the system.
• Marketing and preference data, such as consent to receive communications, preferred contact channels, and cookie settings.
• Identity-verification data, such as your national ID number and a copy of your national ID card that you voluntarily upload to verify your identity (which may show sensitive data such as religion, retained under your explicit consent or where you have not redacted it).

Purposes of use

We collect, use, or disclose your personal data for the following purposes:

• To register, verify identity, and manage user accounts.
• To provide the web application, conduct transactions, process orders, and provide customer support.
• To maintain security, prevent fraud, monitor abnormal activity, and enforce our terms of service.
• To analyze, improve, fix errors, and develop the user experience.
• To send news, service announcements, or marketing offers, where you have consented or where the law permits.
• To comply with applicable laws, governmental orders, legal process, or accounting and tax obligations.

Legal basis for processing

We may process your data on legal bases such as contractual performance, consent, legal compliance, our legitimate interests, or the prevention of harm to life, body, or health, as provided by the personal data protection law.

Cookies and similar technologies

We use cookies and similar technologies to make the site work correctly, remember settings, analyze usage, and improve the service. Some cookies are necessary for the system to operate; analytics and marketing cookies are used based on your consent where required by law. You can manage cookies through your browser settings or our cookie management tool.

Disclosure of personal data

We may disclose your personal data to the following persons or entities only as necessary:

• Service providers for cloud hosting, databases, email, analytics, customer support, and payment systems.
• Legal, accounting, audit, or other professional advisors.
• Government agencies, courts, or competent authorities, where required by lawful order or applicable law.
• Business transferees in the case of merger, restructuring, sale of business, or asset transfer, with your data protected in accordance with applicable law.

International data transfers

We use cloud providers with data centers both in Thailand and overseas. Such transfers are carried out on the bases provided under sections 28 and 29 of the Personal Data Protection Act.

Data retention

We retain personal data only as long as necessary for the purposes stated — for example, throughout the period you maintain a user account — and thereafter for periods needed for legal, accounting, tax, dispute resolution, or legal-claims purposes. When no longer necessary, we delete, destroy, or anonymize the data, including system usage logs.

Security

We apply appropriate technical, organizational, and administrative measures to prevent unauthorized access, use, alteration, disclosure, or destruction of data — including access controls, encryption, logging, and regular security reviews. However, no system is perfectly secure; please keep your password and login credentials confidential.

We may use automated processes to detect fraud, abnormal usage, or violations of our terms of service, which may result in temporary suspension of your account pending staff review. If you believe such a decision is incorrect, you may request human review at contact@kontrax.co.

Rights of the data subject

Under the personal data protection law, you may have the following rights:

• Request access to, or a copy of, your personal data.
• Request correction so that your data is accurate, current, and complete.
• Request deletion, destruction, or anonymization of your data.
• Request suspension of the use of your personal data.
• Request to receive or transfer your personal data in a form prescribed by law.
• Object to the collection, use, or disclosure of your personal data.
• Withdraw consent where processing relies on consent, without affecting processing carried out before withdrawal.
• Lodge a complaint with the competent regulatory authority.

Changes to this notice

We may update this privacy notice from time to time. If we make material changes, we will inform you via our website, web application, email, or other appropriate channels.