Estate 818 Privacy Notice — Local Draft
Draft status: for Local review only. This is not an approved privacy notice and must not be published or indexed. The draft follows common transparency principles and the information categories typically addressed by Thailand’s PDPA and GDPR Article 13 as a drafting reference. This does not mean GDPR applies to every visitor or processing activity.
Before any public release, Estate 818 must confirm its real website settings and data practices, and have the final notice reviewed by its responsible privacy or legal contact.
1. Data controller and contact
The website identifies the controller as Estate 818 Co., Ltd. and lists this address: 818/1 Don Klang Village, Moo 18, Kham Yai, Mueang Ubon Ratchathani, Ubon Ratchathani 34000, Thailand. Listed contact details are 084-359-3888, thunya.all2023@gmail.com and LINE Official @estate818. The company must confirm the legal entity, these details and a dedicated channel and responsible person for privacy requests before approval.
2. Information that may be involved
Local site fields and integrations indicate that the following categories may be involved when a feature is used: contact details and message content such as name, email, phone number and enquiry; comment details such as name, email, comment, IP address and technical request data; technical or security logs such as time and referring page; and cookie or advertising/analytics identifiers if those tools operate and receive data.
This describes what was visible in the Local copy. It does not confirm that every field is collected, retained or sent to an outside provider on the Production site.
3. Purposes and legal grounds
Before approval, the company must match each data category to the purposes and legal grounds actually used. Topics to verify may include responding to enquiries, contacting a person who requested follow-up, taking steps before or performing a contract, protecting the site, complying with law, and measurement or advertising where enabled. These are review topics, not statements that Estate 818 currently processes data for each purpose or relies on a particular legal ground. Do not select consent, contract or legitimate interests without assessing the real activity and applicable law.
4. Sources and required information
Information may be provided directly through forms or contact channels, or generated through site use and connected services. The company must identify which fields are required or optional for each form and explain the consequence of not providing required information.
5. Recipients and international transfers
The Local copy contains code or integrations associated with Google Tag Manager, Google Analytics, Google Ads, reCAPTCHA, Hostinger Reach and form/chat plugins. This does not establish what data is transmitted, which legal entity receives it, its role, or where it is stored or accessed. Before approval, verify active services, data categories, purposes, recipient roles, processing terms, storage/access countries and any required transfer safeguards. The presence of a script alone is not proof that data was transmitted.
6. Retention and security
The company must set a retention period or deletion criterion for each data category and purpose. No verified retention schedule was available in the Local project, so this draft does not state a number of days or years. Information should be deleted, destroyed or de-identified when no longer needed, subject to applicable legal obligations and claims. The company should confirm its actual security and incident-response measures before describing them as implemented.
7. Cookies and similar technologies
The site may use essential cookies and may use analytics or advertising identifiers if enabled. Sample Local HTML requests did not show a consent interface or Set-Cookie header, but JavaScript behavior and Production settings were not verified. Confirm the actual identifiers, purposes, providers, lifetimes, consent controls and withdrawal method. Align tag behavior with the laws that apply before enabling technologies that require consent.
8. Privacy rights and requests
Depending on applicable law and the circumstances, a person may be able to request access or a copy, correction, deletion or de-identification, restriction, objection, portability, withdrawal of consent where consent is the basis, or make a complaint. The company must confirm the request channel, responsible contact, identity-check process, response procedure and applicable deadlines. Rights may have legal conditions and exceptions.
9. Updates and approval checklist
The final notice should state its effective and latest-updated dates and be revised when practices change. Before publication, confirm the controller and request contact; trace data flows from XPro, Chaty, Hostinger Reach, LINE, email and other forms; verify Google tools and cookies in a working browser; document data, purpose, legal ground, recipient, country and retention; confirm deletion procedures and consent controls; obtain privacy/legal review and language review; and publish only when every language matches confirmed practice.
Unapproved draft. Do not rely on this page as the company’s final privacy notice.