Privacy policy
Last updated: ⟦effective date⟧
This policy explains what personal data we collect when you use 101online.net, why we use it, who receives it and what rights you have. We collect only what we need to answer your requests and run the site.
1. Who we are
The site 101online.net (the “site”) is run by the real estate agency One O One (KH) property: ⟦registered company name in English⟧ (บริษัท วัน โอ วัน (เคเอช) พร็อพเพอร์ตี้ จำกัด), registration number ⟦registration (tax ID) number⟧, registered address ⟦registered address⟧ (“we”, “us”). We are the data controller for the personal data described here.
This policy applies to visitors of the site and to people who send us a request through it. It is written to meet the Thai Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and, for visitors in the European Union and the United Kingdom, the General Data Protection Regulation (“GDPR”).
⟦Data protection officer and EU representative: contact details if appointed — otherwise remove this paragraph⟧
2. What we collect
We collect only what you give us and what is needed to run the site:
- Inquiry form: your name, how you want us to contact you (a messenger, phone or email) and that contact, your message if you write one and, for rentals, the move-in and move-out dates you are interested in, if you give them.
- Video viewing request: your name, the app for the call (Yandex Telemost, WhatsApp, Telegram or LINE), your contact for it, and the date, time and time zone that suit you.
- With every request: the listing you asked about (if any), the site language and the time of the request. We do not store your IP address or browser details with a request.
- Messenger and call buttons: when you press one, we record which button, the listing, the site language and the dates if you entered them, but not who you are. The conversation then continues in the app you chose: we see what you send us there, and that app’s own privacy policy applies.
- Account: if you sign in, your email address, the site language and when you created the account and last signed in. You sign in with a one-time code we email you; we keep only a scrambled (hashed) form of the code, for at most 10 minutes of use, and delete codes for emails that never created an account within a day.
- Assistant bot: if you write or send a voice message to our bot in Telegram or LINE: your messenger account id and name, your questions and the bot’s answers. Voice messages are turned into text on our own server and the recording is not kept.
- Visit statistics: pages viewed, the site you came from, browser, operating system, device type and country. Our analytics (Umami, run on our own server) use no cookies and do not store your IP address; we see only totals.
- Technical data: like every website, our server and our network provider Cloudflare receive your IP address and request details to deliver pages and to protect the site and its forms from attacks and spam. Error reports contain no personal data.
Please do not send us sensitive data, such as health information or copies of ID documents, through the site’s forms.
3. Why we use it and on what basis
- To answer your request, arrange viewings and help you rent or buy a property: steps you ask for before a possible contract (PDPA section 24(3); GDPR article 6(1)(b)).
- To keep a record of requests and see which listings and contact channels people use: our legitimate interest in running the agency (PDPA section 24(5); GDPR article 6(1)(f)).
- To give you an account when you sign in or register, and to keep it secure: providing the service you ask for (PDPA section 24(3); GDPR article 6(1)(b)).
- To answer your questions in the assistant bot with what our site shows (or, for our staff, what their account may see): providing the service you ask for (PDPA section 24(3); GDPR article 6(1)(b)).
- To keep the site secure, prevent spam and abuse and fix errors: our legitimate interest.
- To meet legal obligations, for example accounting rules or lawful requests from authorities (PDPA section 24(6); GDPR article 6(1)(c)).
We do not sell your data, do not use it for automated decisions about you, and do not send you marketing messages unless you ask for them.
5. International transfers
Some of these providers store or process data outside Thailand and outside your country, including in Singapore, the European Union and the United States. We use providers that commit to protecting personal data, for example with standard contractual clauses, as the PDPA (sections 28–29) and the GDPR (chapter V) require.
6. How long we keep it
- Requests and their records: ⟦N months⟧ after our last contact with you, unless a contract follows or the law requires longer.
- Account: until you ask us to delete it. Write to us using the contacts below; we then delete the account and the data linked to it.
- Assistant bot conversations: 24 hours after the last message, then deleted; voice recordings are not kept at all.
- Visit statistics: kept only as totals that do not identify you.
- Backups: daily backups are deleted after 30 days, monthly backups after 12 months, so deleted data disappears from them by then.
- Technical logs at our providers: for the short periods those providers set.
7. How we protect it
Data is sent over encrypted connections (HTTPS). Our server accepts connections only through Cloudflare, access is limited to the staff who need it and protected with strong sign-in, and backups are kept in private storage. No system is perfectly secure: if a data breach puts your rights at risk, we will inform the supervisory authority and, where required, you.
8. Your rights
Under the PDPA and the GDPR you have the right to:
- get access to your personal data and a copy of it;
- have inaccurate or incomplete data corrected;
- have your data deleted when we no longer need it or have no legal basis for it;
- ask us to restrict how we use your data;
- object to processing based on our legitimate interests;
- receive the data you gave us in a machine-readable format or have it sent to another company;
- withdraw your consent at any time where we rely on it, without affecting earlier processing;
- complain to a supervisory authority: in Thailand, the Personal Data Protection Committee (pdpc.or.th); in the EU, the authority of your country (list of EU authorities).
To use your rights, contact us. We may ask you to confirm your identity, and we will answer within 30 days.
9. Children
The site is not intended for children. We do not knowingly collect personal data from anyone under 20 (the age of majority in Thailand) without the consent of a parent or guardian. If you believe a child has sent us personal data, contact us and we will delete it.
11. Changes and languages
We update this policy when the site or the law changes. The date at the top shows the current version; we will point out significant changes on the site.
This policy is available in English, Russian, Thai and Chinese. If the versions differ, the ⟦English⟧ version prevails.
12. Contact us
For questions about this policy or to use your rights, contact us. Written requests can also be sent to our registered address above.