Privacy policy
Last updated · version 1
This English text is provided for your convenience. The Thai version is the operative one under Thai law.
Data controller
NET CAR RENTAL, Chiang Mai, Thailand.
Registered business name, e-commerce registration number and tax identification number are shown in the footer of every page. Some of those values are still marked as pending while registration is completed; that is deliberate and visible rather than hidden.
For any question about your personal data, contact us on 091 072 3336 or by email at the address in the footer.
What we collect, and why
We collect only what is needed to rent you a car.
When you use the website
| Data | Why | Lawful basis |
|---|---|---|
| Your cookie choice | To honour it and not ask again | Legitimate interest |
| Pages visited, in aggregate | To see which pages are useful | Consent — analytics cookies only |
We do not use analytics unless you have accepted analytics cookies. Nothing loads before you choose. See the cookie policy.
When you build a booking on the website
Your name, phone number, email and any note you type on the booking form are stored only in your own browser (in sessionStorage) until you choose to send them to us. They are not transmitted to any server at that stage, and they are cleared when you close the tab.
Your car, dates, pickup point, cover and extras are held in the page URL, so that refreshing or sharing the link keeps your selections. Personal details are deliberately never placed in the URL, because URLs leak through browser history, referrer headers and server logs.
When you send us a booking on LINE
| Data | Why | Lawful basis |
|---|---|---|
| Name, phone, email | To contact you and prepare the agreement | Contract |
| Flight or hotel | To meet you at the right time and place | Contract |
| Licence-issuing country | To confirm whether an IDP is required | Contract |
| Your note to us | To act on what you asked for | Contract |
At handover
| Data | Why | Lawful basis |
|---|---|---|
| Driving licence details | Legal requirement, and insurance validity | Legal obligation |
| Passport or ID details | Legal requirement for the rental agreement | Legal obligation |
| IDP details, where applicable | Insurance validity | Legal obligation |
| Joint condition photographs | Evidence for both parties at return | Legitimate interest |
How long we keep it
- Rental agreements and associated documents: as required by Thai accounting and tax law, currently five years.
- Condition photographs: one year from the end of the rental, then deleted.
- LINE conversations: retained while the conversation is active and for one year afterwards.
- Enquiries that did not become bookings: one year.
- Your cookie choice: six months, after which we ask again.
Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing.
We disclose it only:
- To the insurer, when a claim is made — the minimum needed to process it.
- To the police or a government authority, where legally required.
- To our accountant, for tax and bookkeeping.
Transfers outside Thailand
Your data is held in Thailand.
Two exceptions worth naming plainly. LINE is operated by LINE Corporation and messages pass through its infrastructure, which may be located outside Thailand — that is inherent in using LINE as a contact channel and applies whoever you message. Google Analytics, if and only if you accept analytics cookies, processes data on Google's infrastructure outside Thailand.
If you would rather avoid both, contact us by phone and decline analytics cookies. That is a legitimate choice and it changes nothing about the service you receive.
Your rights under the PDPA
Under the Personal Data Protection Act B.E. 2562 (2019) you have the right to:
- Access the personal data we hold about you, and obtain a copy
- Rectify data that is inaccurate or incomplete
- Erase data, where we have no continuing legal basis to hold it
- Restrict processing while a dispute about accuracy is resolved
- Object to processing carried out on the basis of legitimate interest
- Data portability — receive your data in a machine-readable form
- Withdraw consent at any time, where processing relies on consent
- Complain to the Personal Data Protection Committee
Withdrawing consent does not affect processing already carried out lawfully, and does not remove data we are legally required to keep — the rental agreement itself, for example, must be retained for tax purposes.
Exercising your rights
Contact us on 091 072 3336 or by email. We will respond within 30 days.
We may need to verify your identity before acting on a request, which is a protection for you rather than an obstacle. There is no charge, unless a request is manifestly excessive or repetitive.
To withdraw analytics or advertising consent, use Cookie settings in the footer of any page. That takes effect immediately and requires no contact with us at all.
Security
Rental agreements and identity documents are held in a locked cabinet at our office, and digital copies on password-protected devices. Access is limited to the people who need it to do their job.
The website is served over HTTPS. It has no user accounts, no login, and no server-side database of customers — which is the simplest form of data security there is: data that is never collected cannot be breached.
Changes to this policy
Material changes will be reflected in the version number and the date at the top of this page, and the cookie banner will ask for consent again where the change affects it.
Current version: 1 — 1 August 2026.