Privacy Policy

Last Updated: January 31, 2026

1. Data Controller

Condo Pang ("we", "our", or "us") is the data controller responsible for your personal data. You can contact us through our website.

2. Introduction

This privacy policy explains how we collect, use, and protect your personal data in compliance with Thailand's Personal Data Protection Act (PDPA) and the EU General Data Protection Regulation (GDPR) where applicable.

2. Information We Collect

2.1 Information You Provide

Account Information: Name, email address, profile photo
Verification Information: Unit information, age group, gender (for membership verification)
Content: Posts, comments, images, and other content you create or upload

2.2 Automatically Collected Information

Usage Data: Pages visited, features used, time spent on the Service
Device Information: IP address, browser type, operating system
Cookies: Small data files stored on your device to improve user experience

4. Legal Basis for Processing

Under PDPA and GDPR, we process your personal data based on the following legal grounds:

Data Type	Legal Basis
Account Information	Contract (to provide the service)
Verification Data (unit, age, gender)	Consent (explicit opt-in during upgrade)
User Content (posts, comments)	Contract (to provide the service)
Usage Analytics	Legitimate Interest (service improvement)
Key Card Photos	Consent (explicit opt-in, sensitive data)

5. How We Use Your Information

We use the collected information to:

Provide and maintain our Service
Verify membership status and permissions
Communicate with you about Service updates
Improve and personalize user experience
Prevent fraud and ensure Service security
Comply with legal obligations

4. Information Sharing

We do not sell your personal information. We may share your information with:

Other Users: Profile information and public posts are visible to community members
Service Providers: Third-party services that help us operate (e.g., Firebase, Google)
Legal Requirements: When required by law or to protect rights and safety

5. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.

7. Your Rights

Under PDPA and GDPR, you have the following rights:

Right of Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your data ("right to be forgotten")
Right to Data Portability: Receive your data in a machine-readable format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent at any time (without affecting prior processing)

To exercise these rights, please contact us. We will respond within 30 days.

7.1 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection authority:

Thailand: Personal Data Protection Committee (PDPC) - pdpc.or.th
EU: Your local Data Protection Authority

7. Data Retention

We retain your personal data only as long as necessary to provide the Service and fulfill the purposes outlined in this policy. When you delete your account, we will delete or anonymize your personal data within 30 days.

8. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

9. Third-Party Services

Our Service uses third-party authentication services (Google, LINE). Please review their privacy policies:

11. International Data Transfers

Your information may be transferred to and processed in countries outside Thailand, including:

United States: Firebase (Google Cloud), Algolia
Japan: LINE Corporation (adequacy decision under GDPR)

We ensure appropriate safeguards are in place for such transfers, including:

Google's Standard Contractual Clauses (SCCs) and Data Processing Addendum
Algolia's GDPR-compliant Data Processing Agreement
LINE's compliance with Japanese data protection laws (recognized as adequate by EU)

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.

13. Contact Us

For any questions about this Privacy Policy or your personal data, please contact us.

We aim to respond to all requests within 30 days.