Privacy notice

What we know about you and your customers.

PDPA (Thailand) · GDPR alignment · v9 May 2026

1. Partner data

• Collected: name, email, phone, WhatsApp/Telegram, socials links, partner type, payout method and account info, tax residency.
• Used for: partner verification, WHT calculation, payouts, programme communication.
• Retention: while the partner is active + 7 years (Thai tax-law record-keeping).

2. Data on referred customers

• In the cabinet the partner sees conversions in masked form: first-letter-of-first-name + first-letter-of-last-name (e.g. "M.K."), booking number, status and commission amount. Email, phone, and the customer's full name are not shown.
• No customer data can be exported from the partner cabinet.

3. Cookie attribution

• hrp_ref — first-party cookie carrying the partner code. SameSite=Lax. TTL 30 days default or 90 days for long-term partners.
• hrp_consent — user's choice from the banner: all / essential / rejected. TTL 12 months.
• PDPA compliance: when hrp_consent=rejected the attribution cookie is not set; on first visit without consent we currently do set the cookie and flag the click as consented=false for audit. This will be tightened before prod release.
• Click IP and User-Agent are hashed (SHA-256 + salt) before storage — we do not retain raw IPs.

4. Sharing with third parties

• Revenue Department of Thailand: name, tax ID, payout amount, withheld WHT (PND.3) — required by law.
• Payment providers (PromptPay / Wise / bank): only the data needed for the specific transaction.
• We never share partner data with marketing/ad-retargeting providers.

5. Your rights (PDPA / GDPR)

• Access, correction, deletion, restriction of processing, portability, consent withdrawal — email privacy@helprentphangan.com.
• Response within 30 days. Complaint to the supervisory authority (PDPC Thailand, or your country's DPA) — without contacting us first.