Hiwmate Privacy Policy

This policy explains how Hiwmate, operated by [legal entity name · address — registration pending] ("we"), acting as data controller, collects, uses, discloses and protects your personal data under Thailand's Personal Data Protection Act B.E. 2562 ("PDPA") when you use the Hiwmate app, the hiwmate.com website and related services. The Thai version prevails if the two versions conflict.

1. Data we collect

Category	Examples	Source
Account data	Mobile number or email, display name, username, profile photo, chosen language	You
Identity verification (carriers only)	ID card or passport images, face images and facial biometric data, name on the document, date of birth, verification result	You, via our identity verification provider
Financial data	Bank account name, bank code, last 4 digits of the account, payment and payout history	You · payment provider
Order data	Items, address or meeting point, bills, statuses, purchase proof, item photos, receive code (stored encrypted)	You and the other party to your order
Communication	Order chat messages and photos, reviews, complaints, support requests	You
Technical data	Device model, operating system, app version, IP address, usage and error logs, push notification tokens	Automatic
Cookies (website)	Essential cookies for login and settings, analytics cookies only with your consent	Website · see the Cookie Policy

We do not store credit or debit card details or full bank account numbers. These stay with our licensed payment provider.

2. Purposes and legal bases

Purpose	Legal basis
Create your account, provide ordering and carrying, match customers with carriers, show order details to the other party	Performance of contract
Take payments, hold funds, release funds, refund, pay out to carriers, issue receipts	Performance of contract · legal obligation
Verify carriers with documents and facial biometric data	Explicit consent (you can withdraw it, but you will no longer be able to carry)
Prevent fraud, detect duplicate accounts, assess trust tiers, suspend accounts	Our legitimate interests and those of other users
Handle complaints and disputes, keep evidence for legal proceedings	Performance of contract · legitimate interests · establishment of legal claims
Send notifications about orders, security and service changes	Performance of contract
Send marketing messages	Consent (you can opt out at any time)
Improve the Service, analyse aggregated usage, fix errors	Legitimate interests · consent for analytics cookies
Comply with tax, accounting, anti-money-laundering laws and government orders	Legal obligation

3. Disclosure

• The other party to your order: the customer and carrier in the same order see each other's display name, username, verification status, trust tier, order details and the chat for that order. We never share your ID number, date of birth or bank details with them.
• Processors working for us under data protection agreements: database and file storage (Supabase), payments (Opn Payments), identity verification (Didit), email delivery (Resend) and SMS, website hosting and network (Cloudflare).
• Government authorities or courts when required by law or a lawful order, and victims or investigating officers in fraud cases to the extent necessary for legal proceedings.
• We do not sell your personal data.

4. International transfers

Some providers store or process data outside Thailand (for example Singapore, the United States or the European Union). We choose providers with appropriate security standards and put data protection agreements in place as required by the PDPA.

5. Retention

Data	Retention period
Account and profile	For the life of the account, then deleted or anonymised within 30 days of closure unless there is a reason to keep it
Verification result, name on document and a hash of the ID number	Life of the account + 1 year, to stop suspended users from signing up again. Document and face images are kept by the verification provider under its policy and our deletion instructions
Orders, bills, payments, payouts	At least 5 years from the end of the transaction year, as required by accounting and tax law
Order chats, evidence and photos	180 days after the order closes · if there is a dispute or case, until it ends + 365 days · chats that never become an order are deleted within 14 days
Access logs and SMS delivery logs (OTP codes are never stored)	90 days

6. Security

We use encryption in transit, row-level access control in the database, encrypted storage of receive codes, signature checks on every webhook from external providers, and an audit trail of every order status change. Staff access data only as their role requires. If a data breach is likely to pose a high risk to you, we will notify the Personal Data Protection Committee within 72 hours and inform you without undue delay.

7. Your rights

Under the PDPA you have the right to access and obtain a copy of your data, correct it, delete or anonymise it, restrict its use, object to processing based on legitimate interests, receive or transfer it in electronic form, withdraw consent at any time without affecting earlier processing, and complain to the Personal Data Protection Committee.

Exercise your rights in the app (the "Me" tab) or by emailing hello@hiwmate.com. We respond within 30 days. Some requests may be partly refused where the law requires us to keep data, such as payment records still within the tax retention period.

8. Minors

The Service is for people aged 18 and over. We do not knowingly collect data from minors and will delete it promptly if we find we have.

9. Notifications and marketing

We send notifications needed for your orders and account security through the app, SMS or email. Marketing messages are only sent with your consent, and you can unsubscribe from the email link or in the app settings.

10. Changes to this policy

We may update this policy from time to time. The latest version is always at hiwmate.com/privacy. We will notify you in the app or by email of material changes.

11. Contact

Data controller: Hiwmate [legal entity name · address — registration pending] Email: hello@hiwmate.com (use the subject "PDPA" for personal data requests)

Pilot note: this is a draft that has not yet been reviewed by legal counsel and will be updated to match the actual providers at full launch.