Privacy Policy

### 1. Controller, scope and language 1.1 HAPPY HOMES ESTATE CENTER CO., LTD. / บริษัท แฮปปี้โฮมซเอสเตทเซ็นเตอร์ จำกัด, company registration number 0105564149130, trading as Happy Homes Estate Center ("HHEC", "we"), is the personal data controller for the activities described here. Our registered address is 93 Soi Therdthai 19, Bang Yi Ruea, Thon Buri, Bangkok 10600, Thailand (93 ซอยเทอดไทย 19 ตรอกข้างโรงเรียนวัดโพธินิมิตร แขวงบางยี่เรือ เขตธนบุรี กรุงเทพมหานคร 10600). 1.2 This policy covers hhec-th.com and other deployment domains operated by HHEC where this policy is displayed, enquiries through our contact channels, and documents collected later for requested property and home-loan coordination services. It does not designate HHEC as controller for every independently operated website using the same platform. 1.3 Contact us through the contact form on this website or in writing to the registered address above. Other contact channels are LINE Official Account @happyhometh; Facebook/Messenger happyhometha; Instagram happyhometha; and TikTok happyhomesth. Contact hours are Monday–Saturday, 08:00–20:00 Thailand time; visits are by appointment. Rights requests can be sent through the contact form or by post. 1.4 This policy explains our handling of personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). The Thai version governs if the versions differ; this English version is a translation. Mandatory statutory rights remain unaffected. ### 2. Data categories and sources 2.1 You provide lead-form data directly: name, phone number or LINE ID, email, preferred contact channel, preferred viewing date and time, message, and the listing concerned. We record the consent wording accepted, or its reference, and the acceptance time. Contact, viewing, home-loan consultation and newsletter submissions are stored in HHEC's CRM. 2.2 The website also receives campaign and referral information, including UTM parameters and referrer. After analytics consent, it records page views and actions, such as listing views, LINE/call/email clicks, and form starts and submissions, linked to a random session identifier and aggregated into daily statistics. A random identifier does not necessarily make data anonymous. 2.3 Your browser stores the consent choice, language, theme, saved/favourite listings and whether you dismissed the contact widget. Visitors have no website account or login. Security processing includes IP addresses for request rate limiting and server logs. 2.4 If you later request loan assistance, we collect necessary identity-card, house-registration and income documents offline, separately from website forms. We do not request sensitive personal data in website forms. Do not put sensitive information or loan documents in a free-text message. Religion and blood-group information on identity documents must be masked before delivery or omitted from collection. If sensitive data is genuinely necessary later, we will explain why and obtain separate explicit consent under PDPA section 26 unless a specific statutory exception applies. Ordinary identity and financial information is not automatically section 26 sensitive data. 2.5 Sources include you, your authorised representative, your browser and device, and, when coordinating your requested service, relevant owners, co-agents and banks. Where data comes from someone else, we will provide the information required by PDPA section 25 within the applicable time, unless a lawful exception applies. Please share another person's data only with authority and let them know about this policy; HHEC remains responsible for its own notice obligations. ### 3. Purposes and lawful bases 3.1 We use only data necessary for each purpose (PDPA sections 21–24 and 27). The following bases apply to the specified activities, rather than to every use of your data indiscriminately. | Purpose and relevant data | Lawful basis | | --- | --- | | Answer your property enquiry, arrange a viewing, contact an owner or co-agent, handle a request to list a property for sale/rent, and deliver requested brokerage or property-management services: contact, enquiry, appointment and relevant property/transaction data | Necessary steps at your request before a contract, or performance of a contract with you: section 24(3). | | Prepare documents and coordinate a home-loan application with the bank you ask us to contact: contact, identity, house-registration and income documents | Requested pre-contract steps or performance of our coordination service: section 24(3). Any necessary sensitive data requires separate explicit consent under section 26 unless an identified exception applies. The bank uses its own lawful bases and privacy notice. | | Send the newsletter or other promotional communications you specifically choose: contact details and subscription preferences | Separate, voluntary consent: section 19. A property enquiry is not a subscription. | | Measure website usage and campaign effectiveness through session-linked analytics and daily reports: events, random session ID and associated attribution | Prior consent: section 19. Analytics is optional. | | Understand the origin of a submitted enquiry and route/follow up that enquiry: listing, UTM and referrer recorded with the lead | Legitimate interests in administering and evaluating enquiries: section 24(5), balanced against your rights. This does not authorise analytics before consent. | | Operate requested browser functions and remember privacy choices: language, theme, favourites, widget and consent settings | Legitimate interests in operating the website and honouring your choices: section 24(5), subject to your rights. | | Prevent spam and abuse, rate-limit requests, investigate incidents, and establish, exercise or defend legal claims: necessary IP, log and service records | Legitimate interests in security and protection of rights: section 24(5), balanced against your rights; section 24(6) where a particular law or lawful order requires processing. | | Keep evidence of consent and rights requests and comply with PDPA duties: consent wording/reference, time, correspondence and outcome | Legal obligation: section 24(6), read with sections 19, 30, 37 and 39 as applicable. | | Maintain necessary accounting, tax and anti-money-laundering records and make legally required disclosures for applicable property transactions | Legal obligation: section 24(6), including applicable accounting/tax law and the Anti-Money Laundering Act B.E. 2542, sections 16(4), 20, 20/1, 22 and 22/1, as applicable. This does not make every website visitor subject to customer due diligence. | 3.2 Forms require a checkbox before submission. Its wording and time are recorded, but it does not combine consent for unrelated purposes. Processing necessary to answer or perform your requested service relies on the applicable basis above; optional newsletters, analytics and any necessary sensitive-data consent must be separately distinguishable. Reading this policy or using the website is not consent to every processing activity (PDPA section 19 and the PDPC consent guidelines). 3.3 Without necessary contact or appointment details we may be unable to reply or arrange a viewing. Without documents necessary for requested loan coordination, or legally required identification, we may be unable to proceed with that service or transaction. Refusing or withdrawing optional marketing or analytics consent does not prevent ordinary browsing or property enquiries. ### 4. Recipients 4.1 Access within HHEC is limited to people who need the data for the stated purpose. We disclose relevant data only as necessary to: hosting/cloud and technical providers acting on our instructions; property owners and co-agents arranging a viewing or transaction; banks you ask us to coordinate with; and competent authorities where required by law. Banks, owners and co-agents may be independent controllers for their own activities. We will not send your loan documents indiscriminately to banks or property owners. 4.2 Providers processing on HHEC's behalf must be subject to appropriate instructions, confidentiality, security and a processing agreement under PDPA section 40. We do not authorise them to use the data for unrelated purposes. 4.3 Property-page maps embed OpenStreetMap tiles. Loading them connects your browser to the tile provider, which can receive your IP address and technical request information even if you have not consented to HHEC analytics. Our basis for necessary map display is section 24(5), subject to balancing your rights; it does not cover optional third-party tracking. See the [OpenStreetMap Foundation privacy policy](https://osmfoundation.org/wiki/Privacy_Policy). 4.4 Following links to LINE, Facebook/Messenger, Instagram, TikTok or YouTube takes you to services with their own data practices and policies. Their independent processing is governed by those policies. Data you then send to HHEC through those channels is handled by HHEC under this policy for the relevant purpose. ### 5. Transfers outside Thailand 5.1 Hosting/cloud processing and third-party services may involve storage or access outside Thailand. Before a transfer, we must establish an appropriate route under PDPA sections 28–29 and the PDPC's B.E. 2566 notifications on transfers under those sections: adequate destination protection, appropriate safeguards with enforceable rights and effective remedies, or a specific statutory exception. A processing agreement alone does not necessarily satisfy the transfer requirements. 5.2 Where relying on consent because destination protection is inadequate, we will first explain that inadequacy and seek specific informed consent under section 28(2). Accepting this policy is not blanket consent to overseas transfers. Use the contact form on this website for information about applicable destinations and safeguards, subject to lawful redactions. ### 6. Cookies and browser storage 6.1 The cookie-consent notice records your choice. Optional analytics starts only after acceptance; rejecting it leaves ordinary website access available. Language, theme, favourites, widget-dismissal state and the consent choice serve the functions described in clause 3. 6.2 You may withdraw analytics consent through the contact form on this website and change or remove stored choices through your browser's cookie/site-data controls. Deleting site data removes saved preferences and may display the notice again; select rejection to keep analytics off. Clearing a browser does not itself delete lead records already held in the CRM. Withdrawal does not affect processing lawfully carried out before withdrawal (section 19). 6.3 Embedded map requests are separate from HHEC analytics consent, as explained in clause 4.3. Browser controls can block third-party requests, although maps may then not display. You can remove stored site preferences using your browser controls. ### 7. Retention and deletion 7.1 Retention depends on the purpose of the record and any applicable legal duty: we delete data when the purpose ends and no other lawful need remains. Longer legal retention applies only to the affected records, including a documented dispute or lawful preservation order. We then delete, securely destroy or irreversibly anonymise the data under PDPA sections 33 and 37(3) and the PDPC's B.E. 2567 deletion notification. Merely replacing a name with an ID is not irreversible anonymisation. 7.2 Statutory retention is limited to the records covered by the relevant duty. A bank's retention of its own application file is governed by its notice and legal duties, not HHEC's working-copy period. We will not retain all loan documents merely because some transaction records must be kept longer. Where the deletion notification requires deletion or destruction of unlawfully processed data, we will not substitute anonymisation. ### 8. Your rights and requests 8.1 Subject to the conditions and exceptions in the PDPA, you have these rights: | Right | PDPA provision and scope | | --- | --- | | Access and copy | Section 30: obtain access and copies, and information about the source of data obtained without consent. | | Portability | Section 31: receive data in a commonly usable, machine-readable form and request transfer where technically possible, for qualifying automated processing based on consent or section 24(3), and other cases prescribed by law. | | Objection | Section 32: object to legitimate-interest processing, subject to statutory grounds to continue; object to direct marketing at any time; and object to qualifying research/statistical processing subject to the statutory exception. | | Erasure | Section 33: request deletion, destruction or anonymisation when a statutory ground applies, subject to necessary legal retention and other statutory exceptions. | | Restriction | Section 34: request restricted use in the circumstances set out in that section. | | Correction | Sections 35–36: ask us to correct inaccurate, outdated, incomplete or misleading data. | | Withdrawal of consent | Section 19: withdraw consent at any time as easily as giving it, without affecting the lawfulness of earlier processing. Other valid legal duties may still require limited retention. | | Complaint | Section 73: complain to the competent expert committee through the Office of the Personal Data Protection Committee if you believe processing breaches the law. | 8.2 Send a request through the contact form on this website with the right you wish to exercise and enough information to locate your data, or write to our registered address. We may verify your identity and an authorised representative's authority using proportionate information; do not send an unmasked identity document unless we explain a necessary secure verification method. 8.3 We will respond without undue delay and within 30 days of receiving your request. Section 30 specifically requires fulfilment of a valid access/copy request within 30 days; the 30-day response commitment here also covers other requests, without delaying any earlier statutory action. We will explain any lawful refusal, partial fulfilment or applicable legal time rule and your complaint route. Direct-marketing objections and consent withdrawals will be acted on promptly, not held until day 30. 8.4 A valid erasure request will be completed without delay and within 90 days of receipt under clause 3 of the B.E. 2567 deletion notification, including copies and backups. Any technical remnant that cannot be overwritten within that time must be restricted and protected under clause 4 until deletion is complete. The 30-day response commitment is not an extension of a statutory completion deadline. 8.5 You may complain directly without first contacting HHEC: Office of the Personal Data Protection Committee, 120 Moo 3, 7th Floor, Ratthaprasasanabhakti Building (Building B), Government Complex, Chaeng Watthana Road, Thung Song Hong, Lak Si, Bangkok 10210, Thailand; [PDPC website](https://www.pdpc.or.th/). Use its current complaint instructions. The address is also published on the [PDPC's official GPPC contact page](https://gppc.pdpc.or.th/contact-us/). ### 9. Children and representatives 9.1 Our property and loan services are intended for adults. A minor under 20 who has not otherwise attained legal majority must have the consent of a parent exercising parental power or another lawful guardian before submitting personal data or requesting these services. PDPA section 20 requires parental consent in addition to a minor's consent where the minor cannot act alone under civil law; for a child aged 10 or below, obtain consent from the person exercising parental power. We will not treat a child's ticked checkbox as sufficient guardian consent. 9.2 Please tell us through the contact form on this website if a child has supplied data without the necessary consent. We will restrict handling while checking lawful authority and delete data that has no lawful basis. For an incompetent or quasi-incompetent person, the authorised custodian or curator must act as required by section 20. ### 10. Security and incidents 10.1 We must maintain organisational, technical and, where appropriate, physical safeguards proportionate to risk under PDPA section 37 and the PDPC's B.E. 2565 security notification, covering electronic and paper records. These include limiting authorised access and requiring appropriate handling by providers. IP rate limits help reduce abuse; no internet service can promise absolute security. 10.2 For a personal-data breach, we will assess risk, contain and remedy the incident, and notify the PDPC without delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to pose a risk to rights and freedoms. Where high risk exists, we will also notify affected individuals without delay with remedial information, as required by section 37(4) and the B.E. 2565 breach-notification rules. ### 11. Data protection officer 11.1 Privacy questions can be sent through the contact form on this website. A data protection officer (DPO) is required when the statutory criteria apply. HHEC must appoint a DPO if its activities meet PDPA section 41. The B.E. 2566 notification for designated public bodies under section 41(1) does not apply to HHEC as a private company. The relevant B.E. 2566 notification under section 41(2) concerns core activities requiring regular monitoring on a large scale; section 41(3) separately covers core activities involving section 26 data. Ordinary brokerage and incidental website analytics do not alone establish those triggers. We will reassess as activities and scale change and publish DPO contact details if appointment becomes mandatory. ### 12. Changes 12.1 We will publish revisions here with their effective date and give appropriate notice of material changes. A revision does not retrospectively authorise a new purpose: we will give any further notice and obtain fresh consent where required by PDPA sections 19 and 21. Use the contact form on this website for questions or an earlier version.