Privacy Notice
This notice explains what personal data we collect, why, who we share it with, how long we keep it, and how you can use your rights under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).
Last updated 4 Oct 2026
1. Data controller
The data controller for Tidin Krai (tidinkrai.com) is Friday Limited, a company incorporated in the Hong Kong SAR, company number 77223768, registered office Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong ("we", "us").
- Privacy contact: support@tidinkrai.com
- Representative in Thailand under section 37(5): [PDPA representative in Thailand] [TO CONFIRM: whether required]
- Data protection officer (DPO): [TO CONFIRM: whether required]
We are a private service, not a government agency, and we are not affiliated with the Department of Lands or any other government body.
2. Who this notice covers
- Visitors to the site.
- People who submit requests and buy reports, including agents acting for clients.
- People who contact us, including landowners who object through the For landowners page.
- People who may be named as the probable owner of land in a report (see section 6).
3. Data we collect
- Account and contact data: email address, language, email preferences, account creation date and sign-in data (one-time links or codes, and your session).
- Request data: the parcel you selected, your purpose, any note you add, the request number and status, and how you reached us, such as advertising campaign parameters.
- Acceptance and consent records: the terms version you accepted, your conduct acknowledgement, your marketing choice, the time and your IP address.
- Payment data: status, amount, time and the payment provider's reference. We do not receive your card or bank account details. If a refund has to be made by transfer, we ask for a PromptPay ID or account to receive it and use it only for that refund [TO CONFIRM].
- Technical and security data: IP address, device and browser type, access logs and bot-protection signals, used to prevent misuse.
- Correspondence: emails, LINE messages (if you contact us on LINE) and the contents of landowner objection forms.
- Cookie choices: whether you accepted or rejected each cookie category.
- Our own usage statistics: anonymous events, such as which step was reached, recorded only as predefined values. They contain no email addresses, coordinates or parcel identifiers.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Receiving requests, sending offers or results, taking payment, delivering reports and running your account | Contract (section 24(3)) |
| Sending service emails such as sign-in links, receipts and request status | Contract (section 24(3)) |
| Preventing fraud, harassment and misuse, keeping systems secure, and keeping proof that terms were accepted | Legitimate interests (section 24(5)) |
| Answering questions, handling requests and landowner objections | Legitimate interests (section 24(5)) and legal obligation (section 24(6)) |
| Keeping tax and accounting records | Legal obligation (section 24(6)) |
| Improving the service with our own anonymous statistics | Legitimate interests (section 24(5)) [TO CONFIRM] |
| Measuring usage and advertising with Google Analytics, PostHog and Google Ads | Consent (section 19) |
| Sending news and special offers | Consent (section 19) |
If you do not give an email address, we cannot accept your request or deliver a report.
5. Marketing
Marketing emails are a separate, unticked option and are not a condition of the service. You can withdraw consent at any time through the unsubscribe link in any email or in your account. Withdrawal does not affect processing already carried out or any existing request.
6. Data about landowners in reports
To prepare a report, we process data about the probable owner of a parcel: the name of the individual or company, the type of holder, the link between that name and the parcel or location, and a confidence level. This comes from multiple categories of evidence linked to the parcel or location.
- Purpose: to help people with a legitimate purpose, such as buying, renting, due diligence or a boundary matter, to contact the owner or check the land.
- Legal basis: legitimate interests (section 24(5)), balanced against the landowner's rights [TO CONFIRM: counsel to confirm the legal basis and any duty to notify owners about data collected from other sources under section 25].
- Safeguards: requesters must state a purpose and confirm they will not misuse the data; we limit request volumes, review unusual patterns, and encrypt names; reports never contain national ID numbers, phone numbers, account numbers or meter numbers.
- Right to object: landowners can object on the For landowners page or by email to support@tidinkrai.com. After a light verification review, we stop preparing reports for that parcel. We cannot recall reports delivered before the objection [TO CONFIRM].
7. Cookies and similar technologies
On your first visit we show a banner with "Accept all" and "Reject all" buttons of equal weight. You can change your choice at any time with the "Cookie settings" link at the bottom of every page.
| Category | What it does | Consent needed |
|---|---|---|
| Strictly necessary (first-party) | Sign-in session, remembering your cookie choice, A/B test page assignment and an anonymous visitor ID [TO CONFIRM: classification of A/B and visitor ID] | No |
| Security (Cloudflare, including Turnstile) | Protects against bots and attacks | No |
| Maps (Google Maps Platform) | Shows the map and place search in your browser; Google receives your IP address and map usage under Google's own policy | [TO CONFIRM] |
| Analytics (Google Analytics, PostHog) | Measures visits and page use | Yes |
| Advertising (Google Ads) | Measures and serves advertising | Yes |
You can also delete or block cookies in your browser settings, but blocking necessary cookies may stop you from signing in.
8. Who we share data with
We do not sell your personal data. We share only what is needed with:
- hosting, content delivery and bot-protection providers (Cloudflare, including Turnstile);
- our database and report-processing server provider (Hetzner, in Singapore);
- our map provider (Google Maps Platform, which runs in your browser);
- our payment provider (for example Airwallex) [TO CONFIRM];
- our email delivery provider [TO CONFIRM: provider name];
- analytics and advertising providers (Google Analytics, PostHog and Google Ads), only with your consent;
- an automated text-processing provider that helps draft the explanation in reports [TO CONFIRM: whether to list it and what data is sent];
- professional advisers such as lawyers and auditors;
- government authorities or courts where the law requires;
- a buyer of our business, in a merger or transfer, who must protect the data in line with this notice.
Our processors must use data only on our instructions and keep it appropriately secure.
9. International transfers
Your data is transferred to and stored outside Thailand: in Hong Kong (where our company is), Singapore (our servers) and the countries where the providers in section 8 operate. Some of these places may have different data protection standards from Thailand. We put safeguards in place under sections 28 and 29, such as data protection terms with our providers and encryption [TO CONFIRM: transfer mechanism for each provider].
10. How long we keep data
| Data | Retention (draft) |
|---|---|
| Account data | Until you delete your account [TO CONFIRM: automatic deletion after a period of inactivity] |
| Unpaid requests | 24 months after the request closes [TO CONFIRM] |
| Paid transactions and receipts | As long as tax and accounting law requires [TO CONFIRM: 5–7 years] |
| Report PDFs | Available to download again from your account for a set period, then deleted [TO CONFIRM] |
| Terms acceptance and consent records | For as long as relevant and for the limitation period in which they may be needed as proof [TO CONFIRM] |
| Security logs | About 12 months [TO CONFIRM] |
| Correspondence | 3 years after the last contact [TO CONFIRM] |
| Landowner objections | For as long as the parcel is suppressed, so the suppression keeps working |
| Marketing data | Until you withdraw consent |
After that, we delete, destroy or anonymise the data.
11. Security
We encrypt data in transit and at rest with our own keys, limit access to people who need it, log access to data, and deliver reports through links that expire quickly. Our emails carry links only, never landowner names or report files. No system is completely secure. If a personal data breach occurs, we notify the Personal Data Protection Committee office within 72 hours where the law requires, and we tell you if the risk to you is high.
12. Your rights
Under the PDPA you have the right to:
- access your data and get a copy;
- receive your data, or have it transferred, in a machine-readable format;
- object to processing;
- have your data deleted, destroyed or anonymised;
- have processing restricted;
- have inaccurate or out-of-date data corrected;
- withdraw consent at any time;
- complain to the Office of the Personal Data Protection Committee (PDPC) at www.pdpc.or.th.
Send requests to support@tidinkrai.com. We may ask you to verify your identity, and we reply within 30 days. In some cases we may refuse or act only in part where the law allows, for example when we must keep tax records. You can delete your account yourself in your account.
13. Children and changes to this notice
The service is for people aged 18 and over. We do not knowingly collect data about minors and will delete it promptly if we find we have. We may update this notice from time to time. The current version and its date are shown on this page, and we will announce material changes on the site or by email.