Privacy policy

We collect only what each purpose requires: • Property listings — contact name, phone, email, LINE ID, property address, coordinates, price, rental terms To publish and manage the listing · Basis: performance of a contract • Listing requests — name, email, phone, LINE ID, property details To assess and act on the request · Basis: steps taken at your request before entering a contract • User accounts — email, full name, phone, LINE ID, role, hashed password To authenticate you and control permissions · Basis: performance of a contract • Payments — Stripe customer and subscription identifiers, package, dates To charge for the service, and for accounting and tax · Basis: contract + legal obligation • Analytics and advertising cookies — online identifiers, IP address, page and device data To measure usage and advertising · Basis: consent (withdrawable at any time) • LINE conversations — display name, LINE user ID, messages To answer questions and provide the service · Basis: steps before entering a contract, or legitimate interest We do not store card details. Card data stays with Stripe and never passes through SpacesMate's systems. Cookies strictly necessary for login and security are not subject to consent, because the site cannot work without them — and offering something as a choice when it cannot genuinely be refused is not a choice.

The site loads no analytics or advertising tooling until you consent. Once you consent, the following load: • Google Tag Manager — recipient: Google • Google Analytics 4 — recipient: Google (G-QBQV320QXT) • Meta Pixel — recipient: Meta Platforms, Inc. (26085822227748725) You can withdraw consent at any time, and as easily as you gave it, through the "cookie settings" link in the footer of every page. Withdrawal takes effect immediately and does not affect the lawfulness of processing carried out beforehand. We record your decision so it can be demonstrated under section 19. That record contains no IP address and no user agent — only what was consented to, against which version of this policy, and when.

We do not sell or rent your personal data. We use the following external providers, which process data on our instructions and under their own terms of service: • Supabase — primary database (accounts, listings, requests) · Singapore • Vercel — website hosting (request data, logs) · United States / global edge • Google — Tag Manager, Analytics (online identifiers, usage data) · United States • Meta Platforms — Pixel for advertising (online identifiers, browsing behaviour) · United States • Stripe — payment processing (card data and customer identifiers) · United States / Ireland • n8n Cloud — automation · European Union • LINE — contact channel (messages and LINE profile) · Japan / regional We may also disclose data where the law requires it — a court or government order, for example — or in the event of a merger or acquisition, of which we would give advance notice.

All of the providers above are located outside Thailand, so your personal data is transferred to and stored abroad. We choose providers whose security and data protection standards are internationally recognised, and whose terms of service impose data protection obligations on them. If you want detail on any particular provider or on the safeguards applied, contact us as set out in section 8.

• Property listings — 24 months after the listing becomes inactive with no subscription still in force • Approved listing requests — 12 months after the listing is created • Rejected or abandoned listing requests — 6 months • User accounts — kept for as long as the account is in use. If you ask us to delete it, we will do so within 30 days (see the right to erasure, section 7) • Payment and accounting records — 7 years from the end of the accounting period (Accounting Act, section 14) • LINE conversations — 12 months • Google Analytics — 14 months • Consent records — 3 years Once a period expires, the data is deleted or de-identified by an automated process that runs nightly.

• Data in transit is encrypted with HTTPS/TLS • Role-based access control (RBAC), with permissions checked server-side on every request • Passwords are stored hashed, never as plain text • Access to sensitive data is logged for audit • Risks and access rights are reviewed periodically No system is perfectly secure. If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify the Personal Data Protection Committee within 72 hours under section 37(4), and notify you without delay where the law requires it.

Under the PDPA you have the right to: • Access — request a copy of the personal data we hold about you (section 30) • Rectification — ask us to correct data that is inaccurate or out of date (section 35) • Erasure — ask us to delete data where the law permits (section 33) • Restriction — ask us to suspend processing temporarily (section 34) • Object — object to processing based on legitimate interest, or to direct marketing (section 32) • Portability — receive your data in a machine-readable format (section 31) • Withdraw consent — at any time, and as easily as it was given (section 19, paragraph five) • Complain — to the Personal Data Protection Committee (PDPC) if you believe we are not complying with the law We will respond to a request within 30 days of receiving it.

Space Works Co., Ltd. (บริษัท เสปซเวิร์คส จำกัด) Registration no. 0105569001611 Registered address: Summer Hill (unit 3026), 1106 Sukhumvit Road, Phra Khanong, Khlong Toei, Bangkok 10110 Email (including for data protection matters and exercising your rights): support@spacesmate.com Website: www.spacesmate.com

If you are a SpacesMate employee, a separate employee privacy notice is published on the intranet, covering attendance, location, leave and supporting documents. Emergency contacts: employees give us the name and phone number of an emergency contact. That information is used only to make contact in an emergency, and is deleted when employment ends. Employees should tell the person concerned that they have provided it.

If we make a material change, we will tell you by email to your registered address or by notice on the website. If a change affects a purpose you previously consented to, we will ask for consent again. Consent given for one purpose is not consent for another.

This document is published in Thai and in English. If the two versions are inconsistent in any respect, the Thai version governs. The English version is provided for ease of understanding only.