DRAFT FOR LEGAL REVIEW — to be reviewed by a licensed Thai lawyer before publication.
1. Introduction and Data Controller
This Privacy Policy explains how personal data is collected and used when you use the GetnDrive platform at getndrive.com ("the Platform"). It is issued in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand ("PDPA").
The data controller is Nikolay Egorov, the operator of the Platform ("we", "us", "our"). Contact details are provided in Section 12.
Independent rental companies listed on the Platform ("Partners") act as separate data controllers for the personal data they receive from us and for any data they collect from you directly when concluding and performing the rental agreement.
This Policy is made in English. Translations into other languages are provided for convenience only; in the event of any discrepancy, the English version shall prevail.
2. Personal Data We Collect
- Contact data — your name, phone number, email address, and messenger contact (e.g. WhatsApp or Telegram).
- Booking data — vehicle selected, rental dates, pick-up and return locations, number of drivers, and any comments you include in a booking request.
- Rental document data — where required by the Partner to prepare the rental agreement: driving licence details, passport or ID details, and nationality. We collect these only if you choose to submit them through the Platform; otherwise the Partner collects them from you directly.
- Communications — messages you exchange with us through the Platform, email, or messengers.
- Technical data — IP address, device and browser type, pages visited, referral source, and similar data collected automatically through cookies and analytics tools (see Section 9).
We do not knowingly collect sensitive personal data within the meaning of Section 26 PDPA (such as health, religious, or biometric data) and ask you not to include such data in booking requests or messages.
3. Purposes and Legal Bases
We process personal data for the following purposes and on the following legal bases under the PDPA:
- Arranging your booking — receiving your booking request, transmitting it to the relevant Partner, and facilitating communication between you and the Partner. Legal basis: performance of steps at your request prior to and in connection with entering into the rental agreement (Section 24(3) PDPA).
- Customer support — responding to your enquiries, notifying you of the status of a booking request. Legal basis: performance of steps at your request; legitimate interests (Section 24(5) PDPA).
- Platform operation and security — maintaining, securing, and improving the Platform, preventing fraud and abuse, producing aggregated statistics. Legal basis: legitimate interests (Section 24(5) PDPA).
- Marketing (optional) — sending you news, offers, and promotions from the Platform. Legal basis: your consent (Section 19 PDPA), given via a separate opt-in and withdrawable at any time.
- Legal compliance — complying with applicable laws and lawful requests of competent authorities. Legal basis: legal obligation (Section 24(6) PDPA).
4. Disclosure of Personal Data
We disclose personal data only as follows:
- To Partners — the Partner identified in your booking request receives your contact data, booking data, and, where submitted, rental document data, for the purpose of confirming and performing your rental. Partners use this data as independent controllers under their own privacy practices.
- To service providers — hosting, analytics, communication, and IT service providers that process data on our behalf under appropriate agreements.
- To authorities — courts, regulators, and law enforcement where disclosure is required by law.
- Business transfer — if the operation of the Platform is transferred to a legal entity or acquirer, personal data may be transferred as part of that transaction; this Policy will continue to apply until amended.
We do not sell personal data and do not share it with third parties for their own marketing.
5. International Transfers
The Platform’s hosting and service providers may be located outside Thailand. Where personal data is transferred outside Thailand, we take measures required by Sections 28–29 PDPA, such as transferring to jurisdictions with adequate protection or applying appropriate safeguards, or relying on statutory exemptions including performance of steps taken at your request.
6. Retention
We keep personal data only as long as necessary for the purposes above:
- Booking data and related communications — up to 24 months after the rental end date or the last activity on the request, unless a longer period is required to resolve a dispute or comply with law.
- Marketing contact data — until you withdraw consent or unsubscribe.
- Technical data — in accordance with the retention settings of our analytics tools, typically not exceeding 14 months.
After the retention period expires, data is deleted or irreversibly anonymised.
7. Your Rights
Under the PDPA you have the right to: access and obtain a copy of your personal data; request rectification of inaccurate data; request erasure or anonymisation; request restriction of processing; object to processing based on legitimate interests; request data portability where applicable; withdraw consent at any time (without affecting processing already carried out); and lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.
To exercise these rights, contact us using the details in Section 12. We will respond within the period prescribed by the PDPA (in general, within 30 days). Note that requests concerning data held by a Partner (for example, data in a rental agreement) should be addressed to that Partner as an independent controller; we will assist in directing your request where we can.
8. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encryption in transit, and limitation of access to data on a need-to-know basis. In the event of a personal data breach likely to result in risk to your rights, we will notify the PDPC and, where required, affected individuals in accordance with the PDPA.
9. Cookies and Analytics
The Platform uses cookies and similar technologies:
- Strictly necessary cookies — required for the operation of the website; used on the basis of legitimate interest.
- Analytics cookies — used to understand how visitors use the Platform (Google Analytics and Yandex Metrica); used with your consent where required.
You can manage cookies through your browser settings and, where available, through the cookie banner on the Platform. Disabling cookies may affect the functioning of some features.
10. Children
The Platform is intended for persons aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The current version with its effective date is published on this page. Material changes will be highlighted on the Platform. Where a change requires your consent under the PDPA, we will seek it.
12. Contact
Data controller: Nikolay Egorov
Email: info@getndrive.com
Website: getndrive.com
If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Committee (PDPC), Thailand.