Privacy policy

Who processes the data

The prostorage site is run by Synergy Nexus Co., Ltd. The facility is in Chalong, Phuket, Thailand.

Registration number 0835569004249. Registered address: 12/3 Moo 6, Chalong Subdistrict, Mueang Phuket District, Phuket, Thailand.

We process personal data under the Thai Personal Data Protection Act (PDPA, B.E. 2562).

What data we receive

Data reaches us two ways: you enter it yourself, in the request form or when you book (see the next section), or your browser sends it when you open a page. The request form asks for:

• name — how to address you; optional;
• WhatsApp number — we reply there; the only required field;
• description of your things — what you plan to store; optional;
• the size result, if you used the calculator: unit type, term, volume and amounts.

Technical details are saved with the request: page language, the homepage variant from a campaign tag, the address of the page the request was sent from, and the time in Bangkok.

We use your IP address to limit how often forms can be sent. The request form keeps it in server memory for about 10 minutes, and it never reaches the request itself. The booking forms keep only an irreversible hash of it in the database, and records older than a day are deleted. When you accept the rental terms while booking, the IP address is stored in the booking with the time and the version of the terms (see “Booking and rental”).

If you allowed statistics, Google Analytics receives anonymous details of the visit: pages, device, traffic source, approximate city. The full list of files is on the Cookies and statistics page.

Booking and rental

When you book a unit on the site or via a link from our manager, you give us:

• your name, email, phone and preferred way to contact you;
• if you rent as an individual, your passport details: surname and given names in Latin letters as in the passport, the issuing country and the number. A Thai citizen may give an ID card number instead [for the lawyer: PDPC guidance on ID cards];
• if a company rents, its name, tax ID, office and registered address;
• the unit, term, move-in date and payment method.

We need passport details to make the rental agreement and to check your identity at move-in. Without them we cannot rent a unit to an individual. We do not take a photo or copy of your passport.

When you accept the rental terms, we store the time, the version of the terms and your IP address.

You enter your card in the Stripe form, and the card number never reaches us. Stripe tells us the payment status and method.

The staff who handle rentals see passport details. They are not sent to Telegram, Stripe or Google Analytics.

Customer account

If you log in to your account, we store your login email, how you logged in, and when the account was created and last used. If you log in with Google, Google shares your name and email with us; your Google password never reaches us. The account shows your rental data: unit number and type, term, payments, deposit and the passport details from your booking (only the last digits of the number).

Your account connects to your rental through our invitation link, or on its own if your login email matches the email in your contract and was confirmed with an email code or through Google.

In the Profile section you can download your data as a file and send a deletion request. While a rental is active we need the data for the contract. After move-out and the deposit settlement we delete everything we do not have to keep for the periods listed in “How long we keep data”.

Why we need it

We use it for four things:

• answering your request and picking a unit;
• continuing the conversation in WhatsApp, processing your booking and rental agreement, taking payment and checking the tenant's identity at move-in;
• seeing which parts of the site are useful, and not showing the cookie bar twice;
• meeting Thai legal requirements, such as keeping contract records.

We run no mailing lists and sell request data to no one.

Legal basis

The PDPA requires a basis for every use. We have four:

• consent — statistics and cookies the site works fine without; you give it in the cookie bar and can withdraw it any time;
• preparing and performing a contract (section 24(3) of the PDPA) — the request, the conversation about a unit, the booking, passport details, payment and the rental agreement itself;
• legitimate interest (section 24(5) of the PDPA) — spam protection on the form, keeping pages working and, after the rental ends, protection against claims under the agreement;
• legal obligation — records we are required to keep.

Who receives your data

We rely on services without which the site and our reply would not work. Each gets only what its job needs:

• Telegram — requests and booking notices arrive in the company work group, where the staff handling rentals see them; for a request we send the name, number, description, size result, language, homepage variant, page address and time; for a booking, the booking code, unit, term, amount, name, phone, email, contact method, language and the company name if a company rents, without passport details;
• WhatsApp (Meta) — the conversation you start yourself; we receive your number and your message;
• Google Analytics — anonymous visit statistics, only after your consent;
• Vercel — site hosting; page requests and technical logs are processed on its servers;
• Supabase — the database where requests, bookings, passport details and rental records are stored; servers in Singapore; accessible only to prostorage staff who handle rentals;
• Stripe — card and PromptPay payments; it receives the name, email, phone and amount from the booking, plus the unit type, term and booking code, never passport details.

These services operate outside Thailand, so data crosses the border. [for the lawyer: wording on cross-border transfer under section 28 of the PDPA]

Data goes to public authorities only on a lawful request.

How long we keep data

• request and conversation — up to 12 months after our reply; if an agreement is signed, for the periods below;
• Google Analytics statistics — 14 months, the retention setting in GA4;
• cookies — each has its own lifetime;
• passport details from a booking that was not paid — 30 days. We delete the passport copy in a paid booking 90 days after payment. If the booking led to a rental, we move the passport details to the tenant record and keep them there (see the next item). If no rental started, for example there was no free unit or the booking was cancelled and refunded, we hold no passport details for it after that;
• passport details in the tenant record — for the whole rental. After it ends, we keep the passport number and issuing country until 31 December of the fifth year after the year the rental ended: this is the limitation period for rent debts (section 193/33 of the Thai Civil and Commercial Code) [for the lawyer: whether renting a unit counts as renting immovable property under section 193/33]. Then we delete them;
• the rental agreement, name, contacts, the record of accepting the terms and payments — 10 years after the rental ends, the general limitation period (section 193/30 of the same Code);
• invoices and payment documents — at least 5 years, as the Accounting Act B.E. 2543 requires (section 14).

Cookie lifetimes are listed on the Cookies and statistics page. Once a period ends, the data is deleted or anonymised.

If there is a debt, a dispute or a request from a public authority, we keep the data it needs until the matter is settled.

Your rights

Under the PDPA you can:

• find out what data of yours we hold and get a copy;
• correct anything inaccurate;
• ask us to delete the data or limit how we use it;
• withdraw consent; statistics stop at once, a request already sent is not affected;
• object to processing;
• complain to the Personal Data Protection Committee of Thailand (PDPC).

We answer requests within 30 days and delete data within 90 days. To answer we need to be sure the request is yours, so we will ask you to write from the number you left in the form.

Data we keep for the periods in “How long we keep data” is deleted when its period ends. Our reply will say what remains and until when.

How to reach us

Write to prostorage.th@gmail.com, or message us on WhatsApp from the number you left in the form.

Postal address for requests: Synergy Nexus Co., Ltd., 12/3 Moo 6, Chalong Subdistrict, Mueang Phuket District, Phuket, Thailand.

Children

The site is meant for adults and we do not collect data about children. If a child left data with us without a parent, write to us and we will delete it.

Changes to this policy

We update the policy when the data we collect or the services we use change. The date of the last edit is at the top of the page.

If anything you consented to changes, the cookie bar will ask again.