Privacy Policy

1. What we collect

• When you book: your name, email address and phone number; the vehicle, dates, pick-up and return places you choose; and anything you write in the note, such as a flight number or hotel name.
• When you pay: payment is taken by Stripe on its own pages. We receive confirmation that you paid, the amount, and the last four digits of the card. We never receive or store your full card number.
• At pick-up: a copy of the passport, driving licence and International Driving Permit of every driver, the signed rental agreement, and photographs of the vehicle's condition, fuel and mileage. We do not keep your passport.
• During and after the rental: messages you send us by email, LINE, WhatsApp or phone; and, if something happens, accident reports, police reports, insurer correspondence, repair quotations and any traffic fine notices that reach us as the vehicle's registered keeper.
• From your browser: nothing that identifies you. This site has no analytics, no advertising trackers and sets no cookies of its own. See the Cookie Policy for the one setting it remembers on your device.

We do not collect sensitive personal data such as religion, health or biometric data, except where a passport copy incidentally shows religion or where an accident report describes an injury. We use such data only for the purpose it arose from.

2. Why we use it, and the legal basis

We do not use your data for marketing. We do not sell it, and we do not profile you or make automated decisions about you.

3. Who else receives it

We share personal data only with the service providers and authorities needed to run a rental:

• Stripe Payments processes your card payment on its own secure pages, under its own privacy policy. Stripe stores data outside Thailand.
• Google runs the small script that creates your Stripe checkout session. Your booking details pass through Google's servers for that purpose only, and are not used by Google for anything else.
• EmailJS carries the booking notification from the booking page to our inbox. The notification contains your booking details.
• Our insurer and its assessors, and repairers, when there is an accident, damage or a claim.
• The Royal Thai Police and the Department of Land Transport, when the law requires it, for example to identify the driver for a traffic offence.
• LINE and WhatsApp, if you choose to contact us there; those conversations are also governed by their own policies.

Stripe, Google and EmailJS store data outside Thailand. Those transfers are necessary to perform your contract with us, which the PDPA permits (section 28(4)), and each provider is bound by its own contractual and security commitments.

4. How long we keep it

• Booking and payment records, and the signed rental agreement: five years after the rental ends, which Thai tax and accounting law requires.
• Copies of passports, licences and permits: deleted within 30 days after the vehicle is returned, unless there is an open claim, fine or dispute, in which case they are kept until it is closed.
• Photographs of the vehicle's condition: 90 days after return, or until a claim is closed.
• Accident, claim and fine records: five years after the matter is closed, or longer if a legal claim requires.
• Messages: two years after the last exchange.

5. How we protect it

Booking data is held in access-controlled accounts with two-factor authentication. Paper agreements and document copies are kept locked at our office and shredded when their retention period ends. Payment card data never touches our systems. Only people who need a record to serve you, or to handle a claim, can see it.

6. Your rights

Under the PDPA you may, at any time and free of charge:

• ask what personal data we hold about you and receive a copy;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete, anonymise or stop using your data, where we no longer need it or hold it unlawfully;
• object to a use of your data, or ask us to restrict it, while a request is considered;
• receive the data you gave us in a machine-readable form;
• withdraw any consent you have given, without affecting what was done before; and
• complain to the Office of the Personal Data Protection Committee (PDPC), Ministry of Digital Economy and Society, Bangkok, if you believe we have breached the PDPA.

To exercise a right, email [email protected] from the address you booked with. We respond within 30 days. We may need to keep some data despite a deletion request, for example the records tax law requires, and we will tell you if so.

7. Children

We rent only to adults and do not knowingly collect data from anyone under 18, other than the names of child passengers where a child seat is booked.

8. Changes to this policy

We will update this page when our processors or practices change, and show the effective date at the top. The policy that applies to a rental is the one in force when you booked.

Contact

Goiing Car Rental, Nimmanhaemin, Chiang Mai 50200, Thailand. Email [email protected] or call 083 054 6787.