Privacy Policy — BaanMe

Effective date: 2026-06-29

1. Who we are and the role of this notice

BaanMe ("we", "us", "our", or the "Organization") operates the website at [ORGANIZATION'S OWN WEBSITE DOMAIN] (the "Website"), a branded property portal. We are the data controller responsible for the personal data described in this notice — that is, we decide why and how that personal data is processed.

Our Website is built and hosted on the Proplink Agent Websites platform, operated by [LEGAL ENTITY NAME — registered controller entity, to be confirmed] (trading as "Proplink Agent Websites"; "Proplink"). Proplink acts as our data processor: it processes personal data only on our documented instructions, under a written Data Processing Agreement (PDPA s.40). Proplink in turn relies on a number of sub-processors (for example hosting, analytics, and content-delivery vendors — see section 7) engaged on our behalf through Proplink.

The controller / processor / sub-processor chain for your Website is therefore:

• Controller: BaanMe (decides purposes and means).
• Processor: Proplink / [LEGAL ENTITY NAME] (operates the platform on the Organization's instructions).
• Sub-processors: Proplink's vendors (Cloudflare, PostHog and others listed in section 7), engaged through Proplink.

This notice tells you what personal data we collect when you use our Website, why, on what lawful basis, who we share it with, how long we keep it, how your personal data may be transferred outside Thailand, and the rights you have under the PDPA.

Contact for this Website (the controller):

• Organization: BaanMe
• Address: [ORGANIZATION REGISTERED ADDRESS]
• General privacy contact: [ORGANIZATION CONTACT]
• Data Protection Officer (if appointed): [ORGANIZATION DPO]

Platform / sub-processor matters (the processor): for questions specifically about Proplink's role as platform operator or about its sub-processors, Proplink can be reached at [PRIVACY CONTACT EMAIL — e.g. [email protected]] (DPO: [DPO / DATA-PROTECTION CONTACT EMAIL]). To exercise your rights as a data subject, however, please contact us, the Organization, using the details above — see section 11.

You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand.

2. Scope of this notice

This notice covers personal data processed through this Website — pages you view, enquiries and forms you submit, listings you browse, and the analytics and cookies our Website uses. It does not cover:

• Third-party websites or services we link to (each has its own privacy notice);
• The internal back-office systems of the real-estate network (for example the agent-facing professional network and CRM operated by Proplink), which are governed by their own controllers' notices; or
• Any separate relationship you may have with an individual agent off-platform.

Where a listing displayed on our Website is shared with us through a co-broking network (see section 4), the listing content originates from other organizations in that network; we display it to present a fuller inventory to you.

3. The personal data we collect

We collect the following categories of personal data through this Website. Some you provide directly; some is collected automatically as you use the Website.

a. Information you give us

• Enquiry and contact-form data — your name, email address, phone number, LINE ID (if provided), the message you write, the property or project you are enquiring about, and your language preference.
• Any account or saved-search information you create, if our Website offers those features — for example saved properties or a request to receive new-listing alerts (which may require email or LINE confirmation).

b. Information collected automatically

• Product-analytics and pageview data — the pages you view on our Website, referrer, session and a device/visitor identifier, approximate location (country/region/city derived from your IP address), device, screen, browser/user-agent, locale and timezone. Analytics events are attributed to our Website by its domain (tenant_domain). Where you have not consented to analytics, this data is either not collected or is reduced to a de-identified, daily-rotating per-site visitor count that does not retain your raw IP address or user-agent.
• Cookies and similar technologies — see section 9.
• Marketing attribution and advertising identifiers — only if we have enabled advertising or marketing measurement on this Website — for example UTM campaign parameters and ad-click identifiers (such as gclid / fbclid / ttclid), and, where you consent, identifiers used to measure advertising conversions. [ORGANIZATION TO CONFIRM whether advertising/analytics tags are enabled on this Website and update this section accordingly.]
• Diagnostics — limited error and performance telemetry used to keep the Website running.

c. Listing data we display

• Property listings shown on the Website (descriptions, specifications, images, prices) including listings made available to us through the co-broking network. Listing content is generally about properties rather than about you as a visitor; it may, however, include the name and contact details of the listing agent or organization.

We do not intend to collect, through this Website, special-category ("sensitive") personal data as defined in PDPA s.26 (such as health, religion, biometric or criminal-record data). Please do not include sensitive personal data in free-text enquiry messages. [ORGANIZATION TO CONFIRM no sensitive data is collected via any custom form it adds.]

4. Listings and the co-broking network

Our Website may display not only our own listings but also listings shared with us by other organizations through a co-broking arrangement, so that we can present a fuller inventory. Displaying a co-broking listing does not transfer ownership of that listing. Personal data contained in a listing (for example an agent's contact details) is processed for the purpose of marketing the property and connecting interested parties with the responsible agent or organization.

5. Why we process your personal data, and our lawful basis

The table below maps each purpose to the categories of personal data used, the lawful basis under PDPA s.24 (and s.19 for consent), and the retention period. Several lawful-basis and retention entries are policy decisions you must finalise with your lawyer and are shown bracketed.

Note on lawful basis. Thailand does not read "legitimate interest" as broadly as the EU. For marketing, analytics and advertising, consent is the safest basis; for handling an enquiry you have submitted, contract/pre-contract necessity generally applies. You (the Organization) are responsible for selecting and documenting the lawful basis for each purpose and for any legitimate-interest balancing test. The entries above are starting points, not legal conclusions.

6. Sensitive (special-category) personal data

This Website is not designed to collect special-category personal data under PDPA s.26. If you add custom forms or features that collect such data (for example identity-document images), you must obtain explicit consent (or rely on a narrow statutory exception), implement heightened safeguards, and update this notice. [ORGANIZATION TO CONFIRM whether any sensitive data is collected and, if so, the explicit-consent basis.]

For counsel: the broader Proplink platform processes sensitive data on other surfaces (KYC selfie/ID images, passport/MRZ data, bill-payment data), isolated in a private storage bucket. Those surfaces are not part of a standard tenant Website but may become relevant if the Organization enables such features; if so, a dedicated sensitive-data section under s.26 must be added.

7. Who we share your personal data with (recipients, processors and sub-processors)

We share personal data only as needed for the purposes above:

• Proplink (our processor) — [LEGAL ENTITY NAME], which operates the Website platform on our documented instructions under a Data Processing Agreement (PDPA s.40).
• Sub-processors engaged through Proplink — including, as applicable to this Website:
  • Cloudflare — hosting/CDN, object storage of uploaded images, bot protection (CAPTCHA), and IP-based geolocation (global/US; cross-border).
  • PostHog — first-party product analytics (United States; cross-border), used only where analytics consent is given.
  • Resend — transactional email (e.g. enquiry/alert confirmations) (United States; cross-border).
  • Sentry — error and performance diagnostics (United States / EU; cross-border).
  • MapLibre / MapTiler — map rendering and tiles.
  • [OTHER SUB-PROCESSORS as enabled on this Website — confirm with Proplink's current sub-processor list.]
• Advertising recipients (separate controllers), only if we enable advertising — Meta, Google, and/or TikTok receive hashed identifiers and conversion events for advertising measurement; these act as independent controllers for that data and only where you have consented. [ORGANIZATION TO CONFIRM whether any of these are enabled.]
• The responsible agent or organization in the co-broking network to whom your enquiry is routed.
• Authorities or advisers where required by law or to establish/defend legal claims.

We will provide, on request, the current list of sub-processors engaged through Proplink for this Website. You (the Organization) are responsible for keeping the recipient list in this section accurate for the integrations you have actually switched on.

For counsel — red flags to resolve before publishing: (i) confirm no operational notification (e.g. a Telegram/Slack channel) transmits visitor name+email to a third party without a disclosed lawful basis; (ii) confirm ad-platform conversion forwarding fires only after consent (server-side, not just in client SDKs); (iii) confirm PostHog receives raw IP/geo only for consented visitors.

8. The Data Processing Agreement (PDPA s.40)

Proplink processes personal data for this Website only on our documented instructions, under a written Data Processing Agreement (DPA) required by PDPA s.40. The DPA governs, among other things: the scope and purpose of Proplink's processing; confidentiality and security obligations; the use of sub-processors and our right to be informed of and object to changes; assistance with data-subject requests and with breach notification; and the return or deletion of personal data when our agreement with Proplink ends. As the controller, we remain responsible to you for the personal data processed on our behalf.

9. Cookies and tracking technologies; consent

Our Website uses cookies and similar technologies. We distinguish:

• Strictly necessary (always on, no consent required): session, security/CSRF and consent-state cookies needed for the Website to function and to remember your cookie choice.
• Non-essential / consent-gated (off by default until you accept): first-party product analytics (PostHog) and, where enabled, Google Analytics/Ads tags and advertising/attribution cookies. These are wired to Google Consent Mode v2 with a default of "denied", so analytics and advertising tags do not fire before you consent.

You can accept or reject non-essential cookies through the consent banner on the Website, and you can change your choice at any time by reopening the banner. Withdrawing consent is as easy as giving it. We (the Organization) are responsible for configuring which tags are enabled and for ensuring no non-essential tag fires before consent. [ORGANIZATION TO CONFIRM the consent configuration for this Website.]

10. Automated processing and profiling

• Analytics is used in aggregate to understand how the Website is used; it does not make decisions that produce legal or similarly significant effects on you.
• Advertising conversion matching / retargeting (only if we enable advertising) involves sharing hashed identifiers with ad platforms, which may use them to build audiences and retarget advertising. You can object by rejecting non-essential cookies / withdrawing consent (section 9). [ORGANIZATION TO CONFIRM whether advertising profiling is enabled.]

We do not use automated decision-making that produces legal or similarly significant effects on visitors through this Website. You may object to processing as described in section 11.

11. Your rights under the PDPA

Subject to the conditions and exceptions in the PDPA, you have the right to:

1. Access your personal data and obtain a copy;
2. Rectify inaccurate or incomplete data;
3. Erase / destroy / anonymise your personal data;
4. Restrict processing;
5. Data portability — receive your data in a machine-readable form / have it transferred;
6. Object to processing (including direct marketing and certain legitimate-interest processing);
7. Withdraw consent at any time, where processing is based on consent; and
8. Lodge a complaint with the PDPC.

How to exercise your rights. Because we, BaanMe, are the controller, please send requests to us at [ORGANIZATION CONTACT] (or [ORGANIZATION DPO] if appointed). Proplink, as our processor, provides tooling that supports several of these rights, but you exercise them against us, not against Proplink. What is currently supported:

• Withdraw consent / object to analytics and advertising — self-service via the consent banner (reject) on the Website; takes effect immediately.
• Erasure — where the Website creates an account or stored profile for you, account deletion is implemented as a soft-delete followed by a hard-delete after a 30-day recovery window. Other personal data we hold about you can be deleted on request.
• Rectification — where you have an account/profile, you can edit it; otherwise contact us.
• Access, portability and restriction — there is no fully self-service export at present; we will handle these requests manually through the contact channel above, supported by Proplink's tooling.

We will respond without undue delay and, as a service standard, within [30] days (extendable as the PDPA permits, with notice). We do not advertise self-service capabilities the platform does not provide; access, portability and restriction requests are handled manually.

12. Cross-border transfers

Thailand has no published PDPC adequacy ("white") list. Some of the sub-processors engaged through Proplink (section 7) are located outside Thailand — notably in the United States (e.g. PostHog, Cloudflare, Resend, Sentry; and, if advertising is enabled, Meta/Google/TikTok) and potentially other regions. Your personal data may therefore be transferred outside Thailand.

For each such transfer we rely on a lawful mechanism under PDPA ss.28–29 — we do not claim that any destination country has been found "adequate". The mechanism we rely on is [TRANSFER MECHANISM — to be selected per destination by the Organization with counsel: your informed consent to the transfer despite a possible lower level of protection; necessity for the performance of a contract / pre-contractual steps at your request; and/or appropriate safeguards such as Standard Contractual Clauses based on the ASEAN Model Contractual Clauses or the EU SCCs, adapted with Thai-specific obligations including 72-hour importer breach reporting].

For counsel: certain platform features (not part of a standard tenant Website) transfer data to China (AI vendors used for OCR/embeddings). If the Organization enables any such feature, a specific China-transfer mechanism (and possible PIPL analysis) must be added. Do not assert adequacy for any destination.

13. Security

We and Proplink take appropriate organisational and technical measures to protect personal data, including (as implemented in the platform): hashed passwords and signed session tokens; isolation of sensitive uploads in a private storage bucket behind restricted access; analytics views that strip raw IP/user-agent for general access; an internal access-audit log; CAPTCHA and application-level rate limiting; webhook signature verification for any payment flows; and encryption in transit (HTTPS) for external transfers. Encryption at rest and multi-factor authentication are [TO BE CONFIRMED — not asserted here until verified]. No method of transmission or storage is completely secure.

14. Data breaches

If a personal-data breach occurs, we will, with Proplink's assistance under the DPA, notify the PDPC without undue delay and, where feasible, within 72 hours of becoming aware of it (and no later than 15 days with justification where the deadline cannot be met), and we will notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms, consistent with PDPA s.37(4).

15. Retention

We keep personal data only for as long as necessary for the purposes in section 5, then delete or anonymise it. Specific periods are shown in the section 5 table; where a period is bracketed it is a decision the Organization must finalise. Evidenced platform defaults include: account hard-delete after a 30-day soft-delete window; consent cookie up to 1 year; session/verification tokens until expiry; push tokens until revoked. Retention for listings, enquiries, alerts, logs and analytics events is [TO BE DEFINED by the Organization] — undefined retention is inconsistent with the PDPA storage-limitation principle and must be set before publishing.

16. Children

[ORGANIZATION TO DECIDE AND STATE its position on minors: the minimum age to use the Website and submit enquiries, whether an age gate or parental consent is required, and how minors' data is handled. The platform contains no age-verification logic, so this is a policy decision the Organization must make and configure.] If you believe a child has provided personal data without appropriate consent, contact us at [ORGANIZATION CONTACT].

17. Changes to this notice

We may update this notice from time to time. We will post the updated version on the Website with a new effective date and, where changes are material, take additional steps to inform you as required by law.

18. How to contact us

• Controller: BaanMe, [ORGANIZATION REGISTERED ADDRESS]
• Privacy contact: [ORGANIZATION CONTACT]
• Data Protection Officer (if appointed): [ORGANIZATION DPO]
• Platform/sub-processor questions (Proplink): [PRIVACY CONTACT EMAIL]; DPO [DPO / DATA-PROTECTION CONTACT EMAIL]
• Regulator: Office of the Personal Data Protection Committee (PDPC), Thailand — you have the right to lodge a complaint.

This template was prepared as an AI-assisted first draft for review by a Thai-licensed lawyer. Complete all [BRACKETED] items, confirm the integrations actually enabled on your Website, sign the PDPA s.40 Data Processing Agreement with Proplink, and obtain legal review before publishing.