PDPA Notice (Thailand — Personal Data Protection Act B.E. 2562)

Effective date: [[EFFECTIVE_DATE]]

This notice supplements our Privacy Policy and sets out how we process personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). It applies to your use of the Octopus website (the "Service"), a search index for Thai real estate listings.

1. Data Controller and Data Protection Officer

Data Controller: [[LEGAL_ENTITY_NAME]], [[REGISTERED_ADDRESS]].

Data Protection Officer: [[DPO_CONTACT]].

You may contact the Data Controller or the Data Protection Officer regarding any matter covered by this notice, including to exercise the rights described in Section 4 below.

2. Lawful bases for processing

Under the PDPA, we may only process personal data where we have a valid legal basis. The table below maps each purpose for which we process personal data to the basis we rely on.

Purpose	Personal data involved	Lawful basis under PDPA
Creating and operating your account, passwordless sign-in via magic link or Google	Email address, Google profile (if used), session/token data	Contractual necessity — performance of the contract under which you use the Service
Handling a property inquiry you submit through a listing's Contact form	Chosen contact channel, contact value, message	Contractual necessity / legitimate interest in connecting you with the listing you inquired about
Remembering favorites and saved searches	Account identifier, saved listing/search selections	Contractual necessity — a feature you actively opted into
Transcribing voice search input (optional mic feature)	Audio recording, resulting transcript	Consent — obtained at the point you activate the microphone
Website usage analytics	Aggregate, cookieless usage data	Consent — obtained via the analytics/cookie banner before analytics loads
Security, fraud and abuse prevention, rate limiting	IP address, request metadata	Legitimate interest in protecting the Service and its users
Compiling and republishing publicly posted property listings (see Section 5)	Listing text, photographs, and poster contact details as posted publicly	Legitimate interest in operating a property search index

Where we rely on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

3. Data-subject rights under the PDPA

Subject to the exceptions and conditions set out in the PDPA, you have the right to:

• Access — request confirmation of, and a copy of, the personal data we hold about you;
• Rectification — request that we correct inaccurate or incomplete personal data;
• Erasure — request that we delete or anonymize your personal data, in circumstances permitted by law;
• Restriction of processing — request that we limit how we use your personal data in certain circumstances;
• Objection — object to processing carried out on the basis of legitimate interest;
• Data portability — request that we provide your personal data in a structured, commonly used, machine-readable format, or transmit it to another controller where technically feasible;
• Withdrawal of consent — withdraw consent at any time for any processing that relies on it, such as voice transcription or analytics; and
• Lodge a complaint — file a complaint with the Personal Data Protection Committee (PDPC) if you believe we have processed your personal data in violation of the PDPA.

4. How to submit a request

To exercise any of the rights above, contact us at [[CONTACT_EMAIL]] or the Data Protection Officer at [[DPO_CONTACT]]. Please describe your request and provide enough information for us to verify your identity and locate the relevant data.

We will respond to a verified request within 30 days, as required by the PDPA. If we need more time or cannot fulfil a request (for example, because an exception applies), we will explain why.

5. Publicly posted listing data

Octopus republishes property listings originally posted publicly by their owners in Facebook Groups. Where a listing includes personal data about its poster — such as a name or contact detail (phone number, LINE ID, or Messenger link) — we process that data under our legitimate interest in operating a searchable property index, having weighed that interest against the poster's rights and the fact that the information was already made public by the poster themselves as part of advertising the property.

We limit who can see this contact information: it is not shown to anonymous visitors or general account holders, only to agent and admin accounts who need it to follow up on genuine interest in the property (see our Terms of Service). We also deduplicate repeated postings of the same property rather than treating each repost as new data.

If you posted a listing that has been aggregated by Octopus and you would like your details removed or the listing taken down — for example, because the property is no longer available or you did not intend for it to be redistributed — contact us at [[CONTACT_EMAIL]] with a link to the listing or enough detail to identify it, and we will review and act on the request within a reasonable time.

6. Changes to this notice

We may update this PDPA Notice from time to time to reflect changes in our processing activities or in applicable law. We will post the updated notice with a revised effective date.

7. Contact

General privacy inquiries: [[CONTACT_EMAIL]]. Data Protection Officer: [[DPO_CONTACT]].