Privacy Policy

Introduction

Elefy Move ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our property rental platform.

This policy complies with Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).

Data Controller

Company Name: Elefy Move Co., Ltd.
Address: [Your Business Address]
Email: [email protected]
Data Protection Officer: [email protected]

Data We Collect

Personal Information

Account Information: Name, email address, phone number, date of birth
Identity Verification: Government ID, passport details (for KYC compliance)
Profile Data: Profile photo, preferences, bio

Booking & Payment Data

Booking Information: Property preferences, check-in/check-out dates, number of guests
Payment Information: Payment details (processed by PayPal), billing address
Transaction History: Booking history, payment records

Property Data (Landlords)

Property Listings: Property details, photos, descriptions, pricing
Legal Documents: Property ownership documents, rental agreements

Usage Data

Technical Information: IP address, browser type, device information
Usage Patterns: Pages visited, search queries, time spent on platform
Cookies: Session cookies, preference cookies, analytics cookies

Communications

Messages: In-platform messages between tenants and landlords
Support Tickets: Customer service communications
Marketing Preferences: Email subscription status

Legal Basis for Processing

Under the PDPA, we process your personal data based on:

Consent: When you accept our terms and privacy policy
Contract: To provide our services and process bookings
Legal Obligation: For tax, accounting, and KYC compliance
Legitimate Interest: To improve our services and prevent fraud

How We Use Your Data

We use your personal data to:

Service Provision

Create and manage your account
Process bookings and payments
Facilitate communication between tenants and landlords
Provide customer support
Send booking confirmations and updates

Business Operations

Analyze usage patterns to improve our platform
Conduct research and development
Prevent fraud and ensure platform security
Comply with legal and regulatory requirements

Send promotional emails about new properties
Share updates about Elefy services
Conduct surveys and gather feedback

Note: You can withdraw marketing consent at any time.

We may share your information with:

Service Providers

Payment Processors: PayPal (PCI-DSS certified)
Cloud Hosting: AWS (data stored in Thailand/Singapore regions)
Analytics: Google Analytics (anonymized data)
Email Services: SendGrid

Other Parties

Property Owners/Tenants: When you make or receive a booking
Legal Authorities: When required by Thai law
Business Transfers: In case of merger, acquisition, or sale

We do NOT sell your personal data to third parties.

International Data Transfers

Your data is primarily stored in:

Primary: AWS Thailand (Bangkok region)
Backup: AWS Singapore (for redundancy)

All transfers comply with PDPA requirements and use standard contractual clauses.

Data Retention

We retain your personal data for:

| Data Type | Retention Period | Reason | |-----------|-----------------|---------| | Account Data | Account lifetime + 30 days | Service provision | | Booking Records | 7 years | Tax & legal compliance | | Payment Data | 7 years | Financial regulations | | Marketing Data | Until consent withdrawal | Marketing purposes | | Support Tickets | 3 years | Customer service | | Analytics Data | 26 months (anonymized) | Google Analytics policy |

Your Rights (PDPA)

Under Thailand's PDPA, you have the right to:

1. Access Right

Request a copy of your personal data we hold

2. Rectification Right

Correct inaccurate or incomplete data

3. Erasure Right

Request deletion of your data (subject to legal obligations)

4. Restriction Right

Limit how we process your data

5. Portability Right

Receive your data in a structured, machine-readable format

6. Objection Right

Object to processing based on legitimate interest

Withdraw consent at any time (doesn't affect prior processing)

To exercise your rights: Email [email protected] with your request.
Response Time: Within 30 days

Data Security

We implement industry-standard security measures:

Technical Measures

Encryption: SSL/TLS for data in transit, AES-256 for data at rest
Authentication: Strong password requirements, optional 2FA
Access Control: Role-based access, principle of least privilege
Network Security: Firewalls, DDoS protection, intrusion detection

Organizational Measures

Employee Training: Regular privacy and security training
Access Audits: Quarterly reviews of access permissions
Incident Response: 24-hour breach notification protocol
Third-Party Audits: Annual security assessments

Compliance

PCI-DSS: handled by PayPal
ISO 27001: In progress
PDPA: Fully compliant

Cookies and Tracking

We use cookies for:

Essential Cookies

Session Management: Keep you logged in
Security: CSRF protection

Functional Cookies

Preferences: Language, currency settings
User Experience: Search history

Analytics Cookies

Google Analytics: Anonymized usage data
Retention: 26 months

Facebook Pixel: Remarketing
Google Ads: Conversion tracking

Cookie Control: Manage via browser settings or our Cookie Preferences page.

Children's Privacy

Our services are NOT intended for users under 18 years of age.

We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us immediately at [email protected].

Automated Decision-Making

We use automated processing for:

Fraud Detection: Algorithm analyzes booking patterns
Property Recommendations: Based on search history
Price Suggestions: Market-based pricing algorithm

Your Right: You can request human review of automated decisions.

Data Breach Notification

In case of a data breach:

PDPC Notification: Within 72 hours (as required)
User Notification: If high risk to your rights
Breach Response: Immediate containment and investigation

Changes to This Policy

We may update this Privacy Policy to reflect:

Changes in our practices
Legal or regulatory requirements
New features or services

Notification: Significant changes will be communicated via email.
Last Updated: June 25, 2026

Contact Us

Privacy Questions

Email: [email protected]
Phone: +66 (0) 93-149-5284

Data Protection Officer

Email: [email protected]

Exercise PDPA Rights

Email: [email protected]
Subject Line: "PDPA Rights Request"

Complaints

If you're not satisfied with our response:

Personal Data Protection Committee (PDPC)
Website: https://www.pdpc.or.th
Phone: 02-142-1033
Email: [email protected]

プライバシーポリシー

クイックナビゲーション