J.K. House 16 Co., Ltd. ("the Company", "Chaochao", "we" or "our"), the operator of the Chaochao platform, recognizes the importance of protecting the personal data of its users. This Policy explains how the Company collects, uses, discloses, stores, and protects personal data, as well as the rights of data subjects, in accordance with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and other applicable law.
The Company may collect your personal data through the following channels:
The Company may also receive personal data from other persons or sources, to the extent necessary and permitted by law, such as authentication providers, payment providers, map providers, technology service providers, or other persons you have authorized to disclose data to the Company.
The Company may collect the following categories of personal data, depending on how you use the Platform:
| Category of Data | Examples |
|---|---|
| Identification data | First name, last name, or the name displayed on the Platform |
| Contact data | Phone number, email, address |
| User account data | User account, usage history, listing history, and other account-related data |
| Data from external login services | Name, email, profile picture, or account ID received from Google, Facebook, or LINE, to the extent that provider permits disclosure |
| Listing contact data | Messages, inquiries, contact details, and other information you send to a Lister |
| Property data | Property address or coordinates, price, images, property details, and other related information |
| Transaction and payment data | Payment history, membership plan, price, transaction date, and payment status. The Company does not store full credit card data where such data is processed by a third-party payment provider |
| Technical data | IP address, device information, browser information, cookie ID, usage logs, and other data related to system usage |
| Location data | Approximate location from IP or device location data, where you have permitted the Company to access such data, including location data you search for or select on the map |
| User-uploaded data | Images, text, descriptions, and other content you submit to the Platform |
| Identity-verification data | Documents or information required for identity verification, where the Company has a service or process requiring such verification |
The Company will collect data only to the extent necessary and appropriate for the purposes of providing the service, and will not collect any category of data without such necessity.
Chaochao does not intend to provide its services to persons who are unable to give legal consent on their own behalf.
If you are a minor or a person with limited capacity to give consent, use of the service and provision of personal data must be authorized by your parent, guardian, or other legally authorized person, where required by law.
If the Company becomes aware that personal data of such a person has been collected without a valid legal basis or valid consent, the Company will take appropriate action, including deleting or destroying such data where no law requires it to be retained.
Your personal data may be stored in electronic form on computer systems, cloud storage databases, or servers of the Company and the service providers the Company uses.
Such service providers may be located in Thailand or abroad. The Company will ensure appropriate measures and conditions are in place to protect personal data as required by law.
The Company restricts access to personal data to only those persons or service providers who need such access to perform their duties or provide services to the Company, and will implement appropriate security measures to prevent unauthorized access, use, alteration, loss, or disclosure of data.
The Company will collect, use, or disclose personal data only to the extent necessary for the purposes stated, and on an appropriate legal basis under the PDPA, which may include the following:
The Company may process data to:
The Company may process data to comply with legal obligations, such as tax law, accounting law, court orders, or orders of a competent government authority.
The Company may process data where necessary for the legitimate interests of the Company or another person, provided that such interests do not unduly override the fundamental rights and freedoms of the data subject.
For example:
Where the law requires consent, the Company will request your consent before processing, and you may withdraw your consent in accordance with legal requirements.
Examples include certain types of marketing communications, or the use of certain categories of data that require specific consent.
Withdrawing consent does not affect the lawfulness of processing already carried out by the Company before the withdrawal.
When you make an inquiry, express interest, or send a message about a listing, the Company may process such data to carry out your request.
To enable the Lister to respond to or act on your request, the Company may disclose necessary data, such as:
The Company will endeavor to limit the data disclosed to what is appropriate for the purpose of the contact.
Once data has been passed on to the Lister, the Lister may retain, use, or further process such data for the purposes of contact, negotiation, or transactions between the parties, and the Lister is responsible for processing such data in accordance with applicable law.
The Company cannot control the Lister's use of the data once it has been received.
The Company may disclose your personal data, to the extent necessary and on an appropriate legal basis, to the following persons or organizations:
When you contact or express interest in a listing, the Company may disclose necessary data to the property owner, broker, or agent associated with that listing, in order to carry out your request.
The Company may use third-party service providers to support its operations, such as:
Such service providers will receive only the data necessary for the services they provide, and the Company will implement appropriate measures to protect personal data as required by law.
The Company may disclose data to affiliates or related service providers to the extent necessary for its business operations and provision of services.
In the event of a merger, acquisition, corporate restructuring, or transfer of assets, the Company may transfer relevant personal data to the transferee to the extent necessary, in accordance with applicable law.
The Company may disclose data where:
Because the Company may use technology providers for cloud, hosting, payment, authentication, analytics, or other services that operate in Thailand or abroad, your personal data may be transmitted to, or accessed from, a foreign country.
Where personal data is transferred or transmitted abroad, the Company will comply with the requirements and measures prescribed by applicable personal data protection law, including appropriate measures to protect personal data as required by law.
The Company will retain personal data only for as long as necessary for the purposes stated in this Policy, or for the period required by law.
The retention period may vary depending on the type of data, for example:
Once the necessary period has elapsed, the Company will delete, destroy, or anonymize the data, unless the Company has a lawful basis to continue retaining it.
Under the PDPA, you may have the following rights with respect to your personal data:
The exercise of these rights may be subject to limitations prescribed by law, and the Company may need to verify your identity before acting on a request.
You may exercise your rights by contacting the Company using the details provided in the "Contact" section at the end of this document.
The Company will act on requests within the period and under the conditions required by law, and where a request cannot be fulfilled, the Company will provide the reasons as required by law.
The Company may send information, news, promotions, or offers about its services via email, notifications, or other appropriate channels.
Where the law requires consent, the Company will obtain your consent before doing so.
You may opt out of marketing communications by:
Opting out of marketing communications will not affect communications necessary for the service, such as notifications about your account, payments, security, or transactions.
The Company may use third-party advertising services or technologies, such as Google or Meta, to display advertisements, measure campaign performance, or analyze usage. The use of such technologies will be subject to relevant privacy settings and legal bases.
The Company uses cookies and similar technologies to support the operation of the Platform, such as:
Some cookies may be necessary for the Platform to function, while others may depend on your settings or consent as required by law.
You can control or delete cookies through your browser or device settings. However, disabling certain cookies may cause some Platform functions to work incompletely.
The Company may use usage data to improve search results, rank listings, or recommend properties that may match your interests.
Such processing is intended to improve the property-search experience and the service, and the Company will not use automated decision-making systems in a manner that has a significant effect on your rights or status without an appropriate legal basis and safeguards as required by law.
Where the Company implements automated decision-making systems that fall within the scope of data subject rights under the law, the Company will comply with the relevant requirements of the PDPA.
The Company has implemented administrative, technical, and physical security measures for personal data, appropriate to the nature and risk of the data.
Such measures may include:
However, no electronic system or transmission of data over the internet can guarantee complete security. The Company will take reasonable steps to mitigate such risks.
In the event of a personal data breach, the Company will investigate, assess the risk, and act in accordance with its legal obligations.
Where the law requires the Company to notify the Office of the Personal Data Protection Committee, the Company will do so within the period required by law.
If a breach poses a high risk to the rights and freedoms of data subjects, the Company will notify affected data subjects without undue delay, in accordance with legal requirements, including providing information about the nature of the breach and relevant remedial measures, as appropriate.
The Platform may contain links or connections to websites, applications, or services of third parties.
When you choose to use such services or visit such websites, the collection, use, and disclosure of personal data will be governed by the policies and terms of that provider.
The Company cannot control, and is not responsible for, the data-processing policies or practices of third parties.
The Company may amend or update this Privacy Policy from time to time to reflect changes in its services, technology, law, or business practices.
Where a material change is made, the Company will notify you through an appropriate channel as reasonably practicable.
The date of the most recent revision will be shown at the top of this Policy.
If you have questions about this Policy, wish to exercise your rights as a data subject, or have inquiries about the processing of personal data, you may contact the Company at:
Data Controller
Data Protection Officer (DPO)
The Company may request additional information to verify your identity before acting on a request to exercise your rights, in order to prevent disclosure of data to unauthorized persons.