Privacy policy.

Paydeck is provided by TOURISTO COLLECTIVE CO., LTD., a company registered in Thailand with its office at 345/74 Supalai Bella, Moo 1, Nong Prue, Bang Lamung, Chonburi 20150, Thailand. We are the data controller for the personal data described in this notice, which means we decide how and why it is used.

This notice explains how we collect, use, share and protect personal data, and the rights you have under Thailand's Personal Data Protection Act B.E. 2562 (2019) (the PDPA).

For any question about your data or this notice, contact us at paydeckthailand@gmail.com or +66 62 539 5434, or write to us at the address above.

Tenants who pay through Paydeck, hosts who receive payments, brokers, people who visit our website, people who contact us, and people whose details someone else gives us, for example a host whose phone number a tenant enters to invite them.

Account and contact details: your name, phone number, email address, preferred language, and your role (tenant, host or broker).

Identity verification: the result of your identity check and a reference to it, from our verification partner Didit. For hosts, the status of the checks our payment partner Stripe carries out. Your identity document images and your selfie are captured and processed by Didit and Stripe; Paydeck keeps the outcome and a reference, not the images.

Host payout details: a host's Thai identity details (such as their Thai ID number and laser code) and bank account number are sent from the app directly to Stripe. Paydeck never receives or stores them. We keep only the bank's name, the last four digits of the account and the account's status.

Stays: the property and unit, the rent, deposit and dates, who the tenant and host are, invitations, and the history of agreed terms.

Payments: amounts, fees, dates, status, refunds and disputes, and for the card used, its brand, last four digits and issuing country. Your full card number and security code are handled only by Stripe and never reach Paydeck's systems.

Device and usage data: the notification token of your phone, the app version, IP address, and technical logs of how the app and our systems are used, which we need for security and troubleshooting.

Location: the location of a property, which you choose on the map. We use your phone's location only if you allow it, to help you find a property.

Communications: your messages to us and the notices we send you.

Website: cookies, as explained in our Cookie policy.

Identity checks compare a live selfie with the photo on your identity document. This involves biometric data, which the PDPA treats as sensitive. We ask for your explicit consent before the check, and the biometric processing is carried out by Didit and Stripe for the check only.

We do not ask for other sensitive data, such as religion, health or criminal records, unless the law requires it.

From you, when you create an account, set up a stay, pay, contact us or use the app.

From other people using Paydeck, for example when a tenant, host or broker enters your name and phone number to invite you to a stay.

From our partners, such as Didit (identity check results) and Stripe (payment, payout and verification status), and from card networks and banks about payments and disputes.

Automatically, from your device when you use the app or the website.

To provide Paydeck under our contract with you: creating your account, setting up stays and invitations, calculating totals, taking payments, paying hosts, running Rent AutoPay, keeping your records and giving support.

To comply with the law: keeping accounting and tax records, checks required by anti-money-laundering law, keeping computer traffic data as the Computer-Related Crime Act requires, and responding to lawful requests from courts, regulators and other authorities.

For our legitimate interests, where these are not outweighed by your rights: preventing fraud and misuse, keeping our systems secure, handling disputes and legal claims, and improving Paydeck.

With your consent: the biometric part of identity checks, marketing messages, and analytics cookies on our website. You can withdraw consent at any time; this does not affect anything done before you withdrew it, but without it we cannot verify your identity and you cannot make or receive payments.

If you do not give us the data we need to provide Paydeck or to meet the law, we may not be able to open or keep your account.

Service providers who work for us under contract and only on our instructions, or as independent controllers where the law makes them so: Stripe (card payments, host payouts and host verification), Didit (identity verification), Bird (SMS and email delivery), Google (Firebase push notifications and Google Maps), Cloudflare (network security and file storage), and the providers who host our servers and databases.

The other people in your stay, only as much as they need: a tenant and a host see each other's name and a masked phone number, and the agreed terms of the stay. A broker sees the stays they set up. Nobody sees another person's identity check, verification steps or bank details; a tenant sees only whether the host can receive payments: yes or not yet.

Card networks, banks and card issuers, when a payment is processed, refunded or disputed.

Courts, regulators, the police and other authorities, when the law requires it, including under Thailand's Computer-Related Crime Act and anti-money-laundering law.

Our professional advisers, such as lawyers, auditors and accountants, and a buyer or successor if our business is sold or reorganised, who must protect your data as this notice describes.

We do not sell your personal data.

Some of our service providers store or process data outside Thailand, for example in the United States, the European Union and Singapore. When we send personal data abroad, we make sure it is protected as the PDPA requires: the destination has adequate data protection standards, or appropriate safeguards are in place, such as contractual commitments from the provider, or the transfer is needed to provide the service you asked for.

We keep personal data only as long as we need it for the purposes in this notice.

Payment, refund and accounting records are kept for at least 5 years, and up to 10 years where Thai accounting, tax or anti-money-laundering law requires. Records of identity verification and of stays linked to those payments are kept for the same period.

Other account data is kept while your account is open and deleted or anonymised when it is no longer needed after the account is closed, unless we need it to handle a dispute or a legal claim.

Computer traffic data, such as records of when and from where our app and systems were accessed, is kept for at least 90 days, as Thailand's Computer-Related Crime Act B.E. 2550 (2007) requires, and for longer if an authority lawfully orders it. Other technical logs are kept only as long as we need them for security and troubleshooting.

Data is encrypted in transit. Sensitive fields, such as contact details used for matching invitations, are encrypted or stored only as secure hashes. Access to personal data is limited to people who need it for their work and is recorded in an audit trail. Card numbers, identity documents and bank account numbers never reach Paydeck's systems.

If a personal data breach puts your rights at risk, we will tell the Personal Data Protection Committee and you as the PDPA requires.

Under the PDPA you have the right to: be told how your data is used; get a copy of your data and ask how we obtained it; receive your data in a commonly used format or have it sent to another organisation; object to our use of your data; ask us to delete, destroy or anonymise your data; ask us to restrict how we use it; ask us to correct it; and withdraw your consent.

Some rights have limits, for example we cannot delete payment records that the law requires us to keep.

To use your rights, contact us at paydeckthailand@gmail.com. We may need to confirm your identity first. We reply within 30 days.

If you believe we have not handled your data lawfully, you may complain to the Office of the Personal Data Protection Committee (PDPC) in Thailand.

Some checks are automated, such as calculating the service fee from your card's issuing country, identity checks by our verification partners, and fraud and risk checks. If an automated decision affects you significantly, you may ask for a person to review it.

We send marketing messages only if you have agreed to receive them, and you can stop them at any time in the app or by contacting us. Service messages about your account, stays and payments are not marketing and are always sent.

Paydeck is not intended for anyone under 20 years old. We do not knowingly collect personal data from minors. If you believe a minor has given us their data, please contact us.

We update this notice when the way we use personal data changes. Every version has a version number and an effective date. If a change is significant, we tell you in the app or by email before it takes effect.

TOURISTO COLLECTIVE CO., LTD. (Paydeck), 345/74 Supalai Bella, Moo 1, Nong Prue, Bang Lamung, Chonburi 20150, Thailand. Email: paydeckthailand@gmail.com. Phone: +66 62 539 5434.