Privacy Notice and Personal Data Processing Policy

Last updated: 12 August 2026.

1. Controller and scope

Palmdrive LLC (“Palmdrive”, “we”, the “Controller”) determines how personal data is processed when you visit the website, create an account, publish a listing, send an enquiry, or prepare and accept a rental agreement through the Platform.

This notice is prepared with regard to the Personal Data Protection Act B.E. 2562 (2019) of Thailand (“Thai PDPA”) and, where Palmdrive processes personal data of individuals in the Russian Federation in circumstances governed by it, Federal Law No. 152-FZ “On Personal Data”. Mandatory rules of other applicable jurisdictions continue to apply.

A vehicle owner or Partner receiving data for its own rental activity normally acts as an independent controller. Its identity and role must be stated in the relevant listing, communication, or Rental Agreement.

2. Data, purposes, legal bases, and retention

We process only data reasonably necessary for the following purposes:

  • Accounts and access: name, email, phone number, one-time-code events, session and security data; to register and authenticate Users and protect accounts; based on performance of the Platform terms and legitimate interests; retained while the account is active and then for the period required to resolve claims and meet legal duties.
  • Enquiries and support: contact details, selected vehicle, dates, messages, and communication history; to respond, connect a Renter with a Partner, and take requested pre-contract steps; based on contract or pre-contract necessity and legitimate interests; retained until the enquiry is completed and then for the applicable claims period.
  • Rental agreements: full name, passport or identification details, address in Thailand, contact details, vehicle, dates, price, additional drivers, acceptance records, signatures or confirmations, and generated documents; to prepare, conclude, perform, store, and prove a Rental Agreement; based on contract or pre-contract necessity and legal obligations; retained for the agreement term and the statutory accounting, tax, and claims periods applicable to its parties.
  • Partners and listings: representative and company details, legal and payment details, listings, prices, photos, video, and related files; to publish and administer listings and Partner accounts; based on the Platform terms, legitimate interests, and legal obligations; retained while the Partner relationship or listing is active and then for applicable legal and claims periods.
  • Website operation and security: IP address, device and browser data, cookies, session identifiers, visited pages, timestamps, and diagnostic logs; to operate, secure, diagnose, and improve the Platform; based on legitimate interests and, for non-essential technologies where required, separate consent; retained for the shortest period reasonably required for security and analytics purposes.
  • Legal compliance and disputes: any data necessary to keep records, respond to authorities, prevent fraud, establish or defend legal claims; based on legal obligations and legitimate interests; retained for the period prescribed or permitted by applicable law.

Data is deleted, destroyed, or anonymised after the applicable purpose and retention basis cease. Backup copies are removed on their normal rotation cycle. Retention may be extended where a dispute, legal hold, authority request, or mandatory record-keeping period applies.

3. Required and optional data

Fields marked as required are necessary to provide the requested function, authenticate an account, answer an enquiry, or prepare a Rental Agreement. If required data is not provided, we may be unable to provide that function or conclude the relevant agreement. Optional information may be omitted.

4. Consent

We request consent only where processing cannot reasonably rely on another lawful basis. Any consent must be specific, informed, freely given, and presented separately from the Platform terms or other documents. Consent may be withdrawn through the contact details below, without affecting processing already carried out lawfully.

Reading or acknowledging this notice is not consent. We do not use account registration or acceptance of the Terms of Use as consent to unrelated advertising or optional processing.

5. Sources of data

We usually receive data directly from you. We may also receive it from a Partner, vehicle owner, authorised representative, another driver named in a rental request, public source, or technical service provider where a lawful basis exists. A User providing another person’s data must have authority or another lawful basis and must provide the required notice to that person.

6. Recipients and processors

Where necessary and lawful, data may be disclosed to:

  • the Partner, vehicle owner, Renter, or other party to the relevant enquiry or Rental Agreement;
  • hosting, storage, email, authentication, analytics, document-generation, technical support, and security providers acting under appropriate instructions and safeguards;
  • payment, insurance, delivery, professional advisory, or other providers involved in a rental where the relevant service is actually used;
  • courts, regulators, law-enforcement bodies, and other authorities where required or permitted by law;
  • a successor in a lawful reorganisation or transfer of the Platform, subject to appropriate protection of the data.

We do not sell personal data.

7. Cross-border processing

The Platform relates to rentals in Thailand and may involve processing or access from more than one country. A cross-border transfer is made only where a lawful transfer mechanism or statutory exception applies, such as contract necessity, adequate protection, appropriate safeguards, or separate informed consent where required.

For personal data of Russian citizens, Palmdrive must also comply with the localisation and cross-border transfer requirements of Russian law where they apply. The location and role of each production database and external provider must be assessed before that processing is enabled.

8. Cookies and similar technologies

Essential cookies and session identifiers are used for authentication, security, language selection, and operation of requested functions. Non-essential analytics, advertising, or similar technologies must not be activated where consent is legally required until separate consent has been obtained. Browser restrictions may prevent some Platform functions from working correctly.

9. Security

We apply proportionate organisational and technical measures, including access restrictions, authentication, logging, backups, service-provider controls, and incident procedures. Access is limited to persons who need the data for an authorised purpose. No internet service can guarantee absolute security.

10. Your rights

Subject to applicable law and permitted exceptions, you may request:

  • information about processing, access to data, and a copy of it;
  • correction or completion of inaccurate data;
  • deletion, destruction, anonymisation, or restriction of processing;
  • objection to processing, including direct marketing;
  • data portability where legally available;
  • withdrawal of consent and information about data sources and recipients;
  • a review of a decision and a complaint to the competent Thai or Russian data-protection authority.

We may verify your identity and request information necessary to locate the data. We respond within the period required by the applicable law and explain any lawful refusal.

11. Children

The Platform is intended for adults able to enter into rental arrangements. Where the law requires parental or guardian involvement for a minor, the relevant function must not be used without that involvement.

12. Changes and contact

We may update this notice when the Platform, processing, or legal requirements change. The current version is published at this address and states its update date.

Controller: Palmdrive LLC.
Address: Pattaya, Thailand.
Privacy requests: hello@palmdrive.rent.