PDPA Notice

This document summarizes the roles and responsibilities of Quack Base Co., Ltd. ("Blebook") under Thailand's Personal Data Protection Act B.E. 2562 ("PDPA"). Read it together with our Privacy Policy and Terms of Service.

1. Blebook's Roles

1.1 As Data Controller

For data we collect directly in operating our business:

• Merchant sign-up and Dashboard user data (name, email, password)
• Blebook subscription payment data
• Blebook website visitor data (blebook.com)

1.2 As Data Processor

For end-customer data collected through the booking system:

• Customer name and phone number from booking forms
• LINE userId and profile picture (when LINE Login is used)
• Booking history and PromptPay payment slips uploaded by customers
• Any additional fields configured by the Merchant

In this role the Merchant is the Data Controller and is responsible for publishing its own privacy notice, obtaining lawful consent, and directly responding to data subject requests. Blebook only processes data on the Merchant's instructions.

2. Our Data Protection Principles

• Collect only what's necessary — we do not ask for more than is needed to provide the service
• Use as stated — data is used only for the purposes disclosed
• Secure — encrypted in transit and at rest; access restricted by role
• Transparent — processing is disclosed in the Privacy Policy
• No sale — we never sell personal data to third parties for marketing

3. Data Subject Rights

Under PDPA you have the following rights:

1. Right of access — request a copy of data we hold about you
2. Right to rectification — request correction of inaccurate data
3. Right to erasure — request deletion, subject to legal retention
4. Right to restrict processing — in certain cases
5. Right to object — object to processing of your data
6. Right to data portability — receive your data in a machine-readable format
7. Right to withdraw consent — for any consent previously given
8. Right to lodge a complaint — with the Personal Data Protection Committee (PDPC)

4. Exercising Your Rights

4.1 If you are a Merchant

Send your request to [email protected] with your shop name, registration number, and the right you wish to exercise. We will respond within 30 days of receipt; if more time is needed, we will inform you with reasons.

4.2 If you are an end customer of a Merchant

Because the Merchant is the Data Controller of your data, please contact the Merchant you booked with first. If the Merchant does not respond within a reasonable period, you may contact Blebook at [email protected] and we will help coordinate with the Merchant.

5. Data Breach

In the event of a personal data breach that may affect rights or freedoms, Blebook will notify the Personal Data Protection Committee and the affected Merchants/parties within 72 hours as required by law.

6. International Transfer

Your data is stored on Google Cloud Platform, region asia-southeast1 (Singapore). Under PDPA, Singapore is recognized as a country with an adequate level of data protection.

7. Sub-Processors

We use the following sub-processors under data protection agreements:

• Google Cloud — infrastructure and storage
• Google Analytics, Google Ads — site analytics and marketing (blebook.com only)
• PromptPay slip verification provider — for Plus and Pro plans
• Stripe — credit card processing for the Pro plan
• LINE Login — authentication when customers log in via LINE

8. Data Protection Contact

• Email: [email protected]
• Address: Quack Base Co., Ltd., 388/205 Pleno Suksawat 30 (2), Soi Suksawat 30, Bang Pakok, Rat Burana, Bangkok, Thailand

9. Complaints

If you believe our processing violates the law, you may lodge a complaint with the Personal Data Protection Committee (PDPC) at pdpc.or.th