🛡️ Privacy Policy

Last updated: 02.09.2026
Privacy Policy

This Privacy Policy explains how we process personal data when you use Thaifriendly24 and its features (e.g., registration, login, profiles, image uploads, messages, contact forms).

1. Controller

Thaifriendly24
Controller: ไมเคิล โรเบิร์ต
E-mail: privacy [at] thaifriendly24 . com

Note: You can also reach us via the website contact form. Please include the keyword “Privacy”.

2. Scope and Legal Bases

We process personal data in accordance with the GDPR legal bases:

  • Art. 6(1)(a) GDPR (consent),
  • Art. 6(1)(b) GDPR (contract / steps prior to entering into a contract),
  • Art. 6(1)(c) GDPR (legal obligation),
  • Art. 6(1)(f) GDPR (legitimate interests, e.g., IT security, abuse and fraud prevention).

For users with a connection to Thailand, we also observe the PDPA (Personal Data Protection Act B.E. 2562). Where data is transferred to third countries, we implement appropriate safeguards (e.g., EU Standard Contractual Clauses).

3. Categories of Data

  • Access / server logs: IP address, date/time, URL, referrer, user agent, status codes.
    Purpose: operation, security, error analysis. Legal basis: Art. 6(1)(f) GDPR.
  • Account & profile data: email address, password hash, display/username, profile information, status/roles.
    Purpose: registration/login, account management. Legal basis: Art. 6(1)(b) GDPR.
  • Content / usage data: profile texts, images/uploads (incl. metadata), likes, internal messages (visibility may depend on block status), form contents (e.g., contact/support tickets).
    Purpose: providing community features. Legal basis: Art. 6(1)(b) GDPR; partly Art. 6(1)(f).
  • Communication data: email confirmations (double opt-in), system notifications (e.g., new likes/messages), support correspondence.
    Purpose: contract/support, security (email verification). Legal basis: Art. 6(1)(b)/(c)/(f) GDPR.
  • Security / abuse prevention: CSRF tokens, rate limiting, challenge/bot checks (e.g., Turnstile), blocked disposable domains, block/unblock logic.
    Purpose: system security, spam/abuse prevention. Legal basis: Art. 6(1)(f) GDPR.

4. Registration, Login, OAuth

For registration/login we process required details (e.g., email, password hash). Optionally, you may sign in via third parties (e.g., Google OAuth). The provider shares identity data (e.g., verified email). Legal basis: Art. 6(1)(b) GDPR.

5. Images and Content

Uploaded profile/gallery images and texts are stored and may be moderated. Mandatory images cannot be deleted while under review. When accounts are deleted/deactivated, content may be technically moved to protected areas to fulfill legal duties or enable reactivation. Legal basis: Art. 6(1)(b)/(c)/(f) GDPR.

6. Internal Messages & Likes

Internal messages are stored; messages from blocked members are hidden but retained for potential unblocking. For likes, email notifications may be sent (if offered and configurable). Legal basis: Art. 6(1)(b) GDPR; partly Art. 6(1)(f).

7. Contact, Support & Tickets

Requests via contact/support are stored with metadata (timestamp, ticket token); replies are typically sent via no-reply email and associated with the ticket. Legal basis: Art. 6(1)(b) GDPR; for statutory duties Art. 6(1)(c).

8. Cookies, Local Storage & Consent

We use technically necessary cookies/storage (e.g., session ID, language, security tokens). For optional cookies/analytics we use a consent mechanism (CMP), where available.

  • Necessary: without consent, Art. 6(1)(f)/(b) GDPR.
  • Optional (statistics/comfort): only with consent, Art. 6(1)(a) GDPR (revocable at any time).

9. Security and Abuse Prevention

We employ CSRF protection, rate limiting, challenge/bot checks (e.g., Turnstile), domain blocklists and further measures. Access is logged and analyzed regularly to detect attacks. Legal basis: Art. 6(1)(f) GDPR.

10. Recipients and International Transfers

  • Technical service providers (processors): hosting, email delivery, security/anti-spam services, image/file storage where applicable.
  • Legal recipients: authorities/courts where legally required.

Transfers outside the EU/EEA occur only with appropriate safeguards (e.g., EU Standard Contractual Clauses) or based on your consent.

11. Storage Period

  • Account data: until account deletion; thereafter retained in a restricted manner per legal retention duties or legitimate interests (evidence, abuse prevention).
  • Log data: generally short-term (security/error analysis), then anonymized or deleted.
  • Tickets/support: until request completion; then per statutory retention.
  • Consents: records of consent/withdrawal retained in line with limitation periods.

12. Your Rights (GDPR / PDPA)

Subject to legal requirements, you have the following rights:

  • Access (Art. 15 GDPR),
  • Rectification (Art. 16 GDPR),
  • Erasure (Art. 17 GDPR),
  • Restriction (Art. 18 GDPR),
  • Data portability (Art. 20 GDPR),
  • Object to processing based on Art. 6(1)(f) (Art. 21 GDPR),
  • Withdraw consent with future effect (Art. 7(3) GDPR).

To exercise your rights, contact: privacy [at] thaifriendly24 [DOT] com. You may also lodge a complaint with a data protection authority (EU) or the competent PDPA authority (Thailand).

13. Obligation to Provide Data

Some information is required for registration, login, and core features (e.g., email, password hash). Without this information, certain functions cannot be used.

14. No Disclosure for Marketing Without Consent

We do not share your data with third parties for marketing/advertising purposes without your prior explicit consent.

15. Minors

Our service is not intended for children under 16. We do not knowingly process data of children below the applicable age thresholds.

16. Changes to this Policy

We may adapt this policy when legal requirements, features or service providers change. The current version will be published on the website.

Privacy Contact

Thaifriendly24 – Privacy
E-mail: privacy [at] thaifriendly24 . com
Controller: ไมเคิล โรเบิร์ต