Privacy notice
This notice explains how personal data is handled on the Smart Shuttle Queue website (smart-shuttle-queue.com) and in the Smart Shuttle Queue app (app.smart-shuttle-queue.com), in line with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
1. Who is responsible
Smart Shuttle Queue is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], Thailand ("we"). Contact for any privacy question: sylvain@sunshineconsultancy.tech.
Who decides what happens to your data depends on how you use the service:
- Website and pilot requests: we are the data controller.
- Residents, drivers and staff using the app: your condominium's juristic person (or the organisation that runs the shuttle) is the data controller. We process the data on its behalf, as a data processor, under a written agreement. Requests about your account can be sent to your management office or to us; we will forward them.
2. What we collect and why
| Data | Why | Legal basis (PDPA s. 24) |
|---|---|---|
| Pilot request form: name, organisation, role, e-mail, phone or LINE ID, number of shuttles | To reply to your request and prepare a pilot | Steps at your request before a contract; legitimate interest |
| Resident account: first name, e-mail or LINE account ID and display name, building and unit, preferred language | To create your account, confirm you live in the building and run the queue | Contract (providing the service) |
| Check-in location: your phone's position and its accuracy, only when you tap “I'm at the stop” | To check that you are inside the stop's check-in zone | Contract; your phone also asks for your permission |
| Trips: stop, time of check-in, number of guests, seat number, boarded / absent / cancelled | To run the queue, settle disputes and produce anonymous statistics for management | Contract; legitimate interest of the condominium in a fair service |
| Drivers: name, account, actions in the app, and the vehicle's position during trips | To show the shuttle and its arrival time, and to record departures | Contract; legitimate interest |
| Building access card (only if your building uses this option): a fingerprint of the card number, never the number itself, and its last 4 characters | To link your account to your unit without manual approval | Contract |
| Technical data: session cookie, IP address, device and browser type, error logs | To keep you logged in and keep the service secure | Legitimate interest |
We do not collect national ID numbers, passport numbers or any sensitive data (PDPA s. 26). We do not use facial recognition. We do not use advertising or tracking cookies.
About your location
The app reads your phone's position only when you tap “I'm at the stop”. It compares it with the stop's check-in zone and keeps the result (which stop, what time), not your coordinates. It does not read your position in the background, between trips or after you close the page. You can refuse location access; the concierge can then check you in.
3. Who sees your data
- Your management office sees the list of registered residents (name, unit) and trip statistics.
- Drivers see your first name, seat number and number of guests, never your unit number.
- Other residents see nothing about you.
- Our service providers, bound by confidentiality and only for running the service: hosting (Amazon Web Services, Singapore), FormSubmit (formsubmit.co, United States), which forwards the pilot request form to us by e-mail, and LINE Corporation when you choose to sign in with LINE or receive LINE messages.
- Authorities, only when the law requires it.
We never sell or rent personal data.
4. Transfers outside Thailand
Data is stored on Amazon Web Services servers in Singapore, and pilot requests pass through FormSubmit in the United States. We only use providers that apply protection standards consistent with PDPA s. 28–29, under contractual safeguards.
5. How long we keep it
- Trip records: 365 days by default, a period your condominium can shorten; after that they are deleted or made anonymous.
- Vehicle positions: 30 days.
- Resident account: until you delete it, move out, or your condominium stops using the service.
- Pilot requests: 24 months after our last exchange, unless we start working together.
- Security logs: [90] days.
6. Your rights
Under the PDPA you can ask to access your data and get a copy, to receive it in a readable format, to correct it, to have it deleted, to restrict or object to its use, and to withdraw any consent you gave. You can export or delete your account yourself from the app's settings, or write to sylvain@sunshineconsultancy.tech. We reply within 30 days. You can also complain to the Personal Data Protection Committee (PDPC), www.pdpc.or.th.
7. Security
Connections are encrypted (HTTPS). Each condominium's data is kept separate. Passwords are stored as one-way hashes, access is limited by role, and every change to a seat is logged. If a breach is likely to put your rights at risk, we will notify the PDPC within 72 hours and inform the people concerned.
8. Children
Accounts are for adults. Children travel as guests of a registered resident.
9. Changes
We will post any change on this page and, for an important change, inform users in the app.