Privacy Policy

Introduction

Elefy Group Co., Ltd. ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our property rental platform.

This policy is prepared under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA) and explains what personal data we process, why, on what legal basis, who receives it, how long we keep it, and how you can exercise your rights.

---

Data Controller

Company Name: ELEFY GROUP COMPANY LIMITED
DBD Registration No.: 0245563000221
Registered Office: Saphan Sung District, Bangkok, Thailand
Email: [email protected]
Privacy Contact: [email protected]

---

Data We Collect

Personal Information

• Account Information: Name, email address, phone number, date of birth
• Identity Verification: Government ID or passport details (and, for companies, registration documents; for landlords, any professional licences you add), and a selfie for face comparison (for KYC compliance; the selfie is biometric data, processed only with your explicit consent and deleted once a decision is made)
• Profile Data: Profile photo, preferences, bio, nationality, occupation

Booking & Payment Data

• Booking Information: Property preferences, check-in/check-out dates, number of guests
• Payment Information: Payment details (processed by Stripe or PayPal), billing address
• Transaction History: Booking history, payment records

Property Data (Landlords)

• Property Listings: Property details, photos, descriptions, pricing
• Legal Documents: Property ownership documents, rental agreements
• Payout and Tax Details: Bank account or PromptPay details, bank-book image, tax ID and withholding-tax certificates (also collected from referral and affiliate partners we pay)

Tenancy Records

• Contracts and Signatures: Signed rental contracts and your signature, with the IP address and device information recorded when you sign
• Move-in, Move-out and Claims: Handover inspection photos and notes, damage and rent-guarantee claim photos, and Tenancy Records evidence

Usage Data

• Technical Information: IP address, browser type, device information, login/session records and device push tokens
• Usage Patterns: Pages visited, search queries, time spent on platform (including our own on-site usage events, if you consent to analytics)
• Cookies: Session cookies, preference cookies and, if you consent, analytics cookies

Communications

• Messages: In-platform messages between tenants and landlords
• Support Tickets: Customer service communications
• Marketing Preferences: Email subscription status
• Reviews and Community Posts: Reviews you write (including landlords' reviews of tenants) and community posts, which other users or the public may see

---

Legal Basis for Processing

Under the PDPA, we rely on the following legal bases:

1. Contract: To create and run your account, process bookings and payments, let tenants and landlords message each other, and provide support
2. Legal Obligation: To keep tax and accounting records and to respond to lawful requests from authorities
3. Legitimate Interest: To keep the platform secure, prevent payment and referral abuse, verify identities, show landlords a trust score for tenants who book or apply with them, and improve our services. You can object to processing based on legitimate interest (see "Your Rights")
4. Consent: Only where the law requires it — marketing emails, analytics and advertising cookies, and the comparison of your selfie with your ID photo (biometric data, a sensitive category under Section 26 of the PDPA, processed only with your explicit consent). You can withdraw consent at any time

---

Do You Have to Give Us Your Data?

Some data is needed to provide the service; the rest is optional:

• Needed for an account: Your name and email address (and a password, unless you sign in with Google)
• Needed to book (tenants) or to publish a listing (landlords): Identity verification (KYC)
• Needed to pay you (landlords, referral and affiliate partners): Bank account or PromptPay details, and the tax details needed for withholding-tax certificates
• Optional: Marketing emails, analytics and advertising cookies, and profile extras such as a photo or bio

If you do not provide data that is needed, we cannot provide that part of the service (for example, you cannot book until your identity is verified).

---

How We Use Your Data

We use your personal data to:

Service Provision

• Create and manage your account
• Process bookings and payments
• Facilitate communication between tenants and landlords
• Provide customer support
• Send booking confirmations and updates

Business Operations

• Analyze usage patterns to improve our platform
• Conduct research and development
• Prevent fraud and ensure platform security
• Comply with legal and regulatory requirements

Marketing (with consent)

• Send promotional emails about new properties
• Share updates about Elefy services
• Conduct surveys and gather feedback

Note: You can withdraw marketing consent at any time.

---

Data Sharing and Disclosure

We may share your information with:

Service Providers

• Payment Processors: Stripe (cards and PromptPay) and PayPal — both PCI-DSS certified
• Cloud Hosting: AWS (data stored in the Asia-Pacific — Singapore region)
• Identity Checks: Amazon Rekognition in the AWS Singapore region, and Amazon Bedrock with a model configured for the Singapore region (identity images are never sent through Bedrock's global cross-region routing), both in our AWS account (automated KYC document checks and face comparison)
• AI Features: Amazon Bedrock (Anthropic Claude models) for the AI-assisted features described under "Automated Decision-Making"
• Translation: Amazon Translate, to show listings, reviews, community posts and messages in your language (automatically or when you choose to translate)
• Email Services: Amazon Web Services (Amazon SES)
• SMS: Amazon Web Services (Amazon SNS), if we send you a text message (for example phone verification, where enabled)
• Push Notifications: Expo, which delivers notifications to the mobile apps through Apple and Google
• Website Delivery and Security: Cloudflare
• Analytics: Google Tag Manager and Google Analytics 4. Google Tag Manager loads on our pages, so Google receives your IP address and browser information. Google Analytics sets cookies only after you consent to analytics cookies; without consent it may send Google limited cookieless measurement data (such as the page visited and device/browser information). With your consent, our own servers also record pseudonymous on-site usage events
• Sign-in: Google, if you choose "Sign in with Google"
• Maps and Address Search: OpenStreetMap (map tiles shown in your browser, and Nominatim address lookups made by our servers)

Other Parties

• Property Owners/Tenants: When you make or receive a booking
• Other Users and the Public: Your public profile, and reviews and community posts you publish
• Revenue Department: Withholding-tax filings for payments we make or withhold tax on
• Landlords of Foreign Tenants (TM30): A landlord may have to notify Thai Immigration of a foreign tenant's stay (TM30). This is the landlord's own legal duty; we remind landlords about it but do not file TM30 ourselves
• Legal Authorities: When required by Thai law
• Business Transfers: In case of merger, acquisition, or sale

We do NOT sell your personal data to third parties.

---

International Data Transfers

Your data is primarily stored in:

• Primary: AWS Asia-Pacific — Singapore region (ap-southeast-1)

Some of our service providers process data outside Thailand and Singapore. AI features that run on Amazon Bedrock may be processed in other AWS regions. Google (Analytics, Tag Manager and Sign-in), Cloudflare, Expo with Apple and Google push services, Stripe, PayPal and OpenStreetMap may also process data in other countries. For these transfers we rely on the providers' data-processing terms and on the safeguards that Sections 28 and 29 of the PDPA permit.

---

Data Retention

We keep personal data for these periods:

| Data Type | Retention Period | Reason | |-----------|-----------------|---------| | Account Data | Until you delete your account. On a deletion request your profile is anonymised; records shared with other users (such as bookings and messages) and records the law requires us to keep are retained | Service provision | | KYC Selfie | Until the verification decision | Identity verification (face comparison) | | KYC Documents (ID, company documents, bank-book image) and Saved Landlord Bank Accounts | Until you delete your account, then deleted (we keep a record that verification took place) | Identity verification and payouts | | Referral and Affiliate Payout Details | Kept with the records of payouts made to you, as required by Thai accounting and tax law | Payouts and tax compliance | | Contracts and Signatures | For the tenancy, and afterwards as long as the law requires | Contract performance and legal compliance | | Messages and Tenancy Records Evidence (handover and claim photos) | Kept with the booking; not deleted automatically at present. Your name and contact details are removed when your account is anonymised | Tenancy Records and legal claims | | Booking Records | As required by Thai accounting and tax law (generally at least 5–7 years) | Tax & legal compliance | | Payment Data | As required by Thai accounting and tax law (generally at least 5–7 years) | Financial regulations | | Marketing Data | Until consent withdrawal | Marketing purposes | | Support Tickets | As long as needed to resolve the request and handle follow-ups | Customer service | | Analytics Data (Google Analytics) | Per our Google Analytics retention setting (maximum 14 months) | Usage analytics | | On-site Usage Events (with analytics consent) | Kept while useful for improving the platform; there is no fixed deletion schedule at present | Usage analytics |

---

Your Rights (PDPA)

Under Thailand's PDPA, you have the right to:

1. Access Right

Request a copy of your personal data we hold

2. Rectification Right

Correct inaccurate or incomplete data

3. Erasure Right

Request deletion of your data (subject to legal obligations)

4. Restriction Right

Limit how we process your data

5. Portability Right

Receive your data in a structured, machine-readable format

6. Objection Right

Object to processing based on legitimate interest, to direct marketing at any time, and to processing for research or statistics

7. Withdrawal of Consent

Withdraw consent at any time (doesn't affect prior processing)

8. Right to Complain

Complain to the Personal Data Protection Committee (see "Complaints" below)

To exercise your rights: Email [email protected] with your request.
Response Time: Within 30 days

---

Data Security

We implement industry-standard security measures:

Technical Measures

• Encryption: SSL/TLS for data in transit, AES-256 for data at rest
• Authentication: Passwords are hashed with bcrypt; two-factor authentication is available for staff accounts
• Access Control: Role-based access, principle of least privilege
• Network Security: Firewalls, DDoS protection, audit logging and alerting

Organizational Measures

• Staff Access: Access to personal data is limited to staff who need it
• Messages: Our staff may access in-platform message content only for Tenancy Records evidence, safety/fraud investigation, legal compliance, or support you request
• Incident Response: Prompt investigation and notification in line with PDPA requirements

Compliance

• PCI-DSS: handled by Stripe and PayPal

---

Cookies and Tracking

We use cookies for:

Essential Cookies

• Session Management: Keep you logged in
• Security: Protect your session against cross-site requests

Functional Cookies

• Preferences: Language, currency settings
• User Experience: Search history

Analytics Cookies (with consent)

• Google Analytics: Pseudonymous usage data. Analytics cookies are set only after you consent; without consent, Google may receive limited cookieless measurement data (see "Data Sharing and Disclosure")
• Retention: Per our Google Analytics retention setting (maximum 14 months)

Advertising Cookies (with consent)

• Google Ads: Our tag setup includes Google's conversion linker, which can store ad-click information in cookies only if you consent to advertising cookies. No Google Ads conversion tracking is active at present
• Meta, TikTok and LinkedIn: Used only if you consent to advertising cookies. Not active at present

Cookie Control: Manage via browser settings or our Cookie Preferences page.

---

Children's Privacy

Our services are NOT intended for users under 18 years of age.

We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us immediately at [email protected].

---

Automated Decision-Making

We use automated processing for:

1. Fraud Prevention: Rule-based checks to prevent payment and referral abuse
2. Property Recommendations: Based on your searches, saved properties, enquiries, bookings and on-site activity
3. Price Suggestions for Landlords: AI-assisted price suggestions based on the listing and the market (see item 6)
4. Identity Verification (KYC): Automated document checks and comparison of your selfie with your ID photo, with your explicit consent. These checks can only approve a verification; anything that does not pass, or cannot be checked, is reviewed by a person. See the "Automated identity checks and face comparison" section on this page.
5. Tenant Trust Score: When you book or apply for a property, the landlord (and our staff) can see a trust score from 0 to 100, with a short summary, calculated by rules from six factors: profile completeness, booking history, payment history, communication on the platform, account age, and reviews and ratings. Landlords can also see a rule-based estimate of whether a current tenant is likely to move out, based on booking and lease activity, message activity, failed payments and reviews the tenant has left. These scores do not accept or reject a booking by themselves; the landlord decides.
6. AI-Assisted Features: Features that use AI models from Anthropic (Claude) running on Amazon Bedrock include: the support chatbot; support ticket summaries and reply drafts for our staff; automatic replies sent on a landlord's behalf to messages they have not answered (on by default; landlords can turn them off in their settings); review sentiment analysis; damage-photo assessment; rental contract analysis; the relocation concierge; community post headlines; price suggestions for landlords; sorting emails sent to our business mailboxes; and drafting replies that suggest listings to renters who message us and follow-up emails to people who enquire with us (both approved by our staff before sending). The text and images used by these features are sent to the model to produce the result.

Your Right: You can ask for human review of a score or automated result that concerns you, ask how it was reached, and contest it, by emailing [email protected].

---

Data Breach Notification

In case of a data breach:

• PDPC Notification: Without undue delay and, where feasible, within 72 hours of becoming aware of the breach
• User Notification: If high risk to your rights
• Breach Response: Immediate containment and investigation

---

Changes to This Policy

We may update this Privacy Policy to reflect:

• Changes in our practices
• Legal or regulatory requirements
• New features or services

Notification: Significant changes will be communicated by email or by a notice on our website or in the app.
Last Updated: October 10, 2026

---

Contact Us

Privacy Questions

Email: [email protected]
Phone: +66 (0) 93-149-5284

Privacy Contact

Email: [email protected]

Exercise PDPA Rights

Email: [email protected]
Subject Line: "PDPA Rights Request"

Complaints

If you're not satisfied with our response:

Personal Data Protection Committee (PDPC)
Website: https://www.pdpc.or.th
Phone: 02-142-1033
Email: [email protected]

---

Additional Resources

• Terms and Conditions
• Cookie Policy
• Data Subject Rights Form
• Security Best Practices

---

© 2026 Elefy Group Co., Ltd. All rights reserved.