Privacy policy

1. Who we are

บริษัท พิม โซลูชั่นส์ จำกัด (PHIM Solutions Co., Ltd.), company registration no. 0105569201121, head office at 17 Soi Pracha Uthit 19, Bang Mot, Thung Khru, Bangkok 10140, Thailand.

Under the PDPA we act in two roles:

• Data controller for data about visitors to our website, people who contact us, businesses that use our services and their staff, and people who connect a Facebook account to our services.
• Data processor for data about the customers of businesses that use our services, such as comments, chats and orders. The business is the data controller of that data, and we process it on its instructions and under our contract with it.

2. Data we collect

2.1 When you use our website or contact us

• What you send us, such as your name, email, phone number, business name and message.
• Technical data our servers record automatically, such as IP address, browser type, pages visited and time.

2.2 When a business uses our services

• Staff user accounts: display name, email, phone number and role in the business.
• Business details for invoices and receipts: business name, address, tax ID and contact person.

2.3 When a business connects a Facebook Page or Instagram account

Our services connect through Facebook Login only when a Page admin grants permission. What we receive depends on the permissions granted.

• About the person who connects: their name and app-scoped user ID from their public profile, so we know who connected a Page and can stop using it if that person removes our app or asks for deletion.
• About the Page and the business: the Pages and Business Portfolios the person manages, the Page’s name and ID, the Instagram account linked to the Page, and the Page access token, which we store encrypted.
• Comments on posts and live videos of the connected Page or Instagram account: text, time, and the commenter’s name and ID as Meta provides them.
• Messages sent to the Page on Messenger or to the account on Instagram Direct, and the business’s replies: text, attachments (pictures, video, audio, documents), time, and the sender’s name and ID.

2.4 When a business connects other channels

• The business’s LINE Official Account: messages, attachments, display names and user IDs as LINE provides them.
• The business’s TikTok Shop: customer chats and orders, once the business authorises the connection.

2.5 Order and delivery data the business records

• The buyer’s name, delivery address and phone number, items, amounts, payment status and proof of payment.
• Parcel tracking numbers and delivery status.

3. How we use data

• To provide our services under our contract with the business, such as showing comments and chats so the business can answer from one place, helping the business manage sales during live videos, recording orders, checking proof of payment and booking deliveries. Legal basis: performance of a contract.
• To reply to comments and send messages as the Page, only on Pages or accounts the business has connected and only as the business instructs or sets up, such as order status messages. We do not send advertising on a business’s behalf. Legal basis: performance of a contract, and the instructions of the business as data controller.
• To tell buyers about their own orders by SMS, when the business turns this on and chat cannot reach the buyer, for example to send a tracking number. Legal basis: the instructions of the business as data controller.
• To bill for our services with invoices and receipts. Legal basis: performance of a contract and our duties under accounting and tax law.
• To keep our services secure and prevent unauthorised access and misuse. Legal basis: legitimate interests.
• To answer your questions when you contact us. Legal basis: legitimate interests.
• To comply with the law, such as keeping computer traffic data and answering requests from authorities with legal power. Legal basis: legal obligation.

If a business does not provide data we need, for example by not granting a permission a feature requires, we cannot provide that part of the service.

4. Data from Facebook and Instagram

In addition to section 3, we use data we receive from Meta in line with Meta’s Platform Terms:

• Only to provide our services to the business that connected that Page or account.
• We do not sell or license it, or pass it to data brokers or ad networks.
• We do not use it for advertising or to build marketing profiles, and we never give one business’s data to another.
• Each business’s data is kept separate and is accessible only to that business’s users.

5. Who we share data with

We disclose data only as far as needed to provide our services, to:

• Service providers that work on our behalf under confidentiality obligations: cloud hosting and storage, email delivery, SMS delivery, payment slip verification, and carriers such as Thailand Post.
• Language processing providers, when a business turns on reading English names in Thai. They receive display names only, with no user IDs, messages or order data.
• The platforms the business has connected (Meta, LINE and TikTok), when we send messages or comments on the business’s instructions.
• Government authorities or others with legal power, when the law requires it.

6. Transfers outside Thailand

Some of our service providers may store or process data outside Thailand. We transfer data only where the destination or recipient has adequate data protection standards, or where a PDPA exception applies, such as to perform a contract with you.

7. How long we keep data

• Page access tokens: deleted immediately when the business disconnects the Page, or when the person who connected it removes our app on Facebook.
• Data we process for businesses (comments, chats, attachments, orders): kept while the business uses our services or until the business deletes it, and deleted within 90 days after the business stops using our services, unless the law requires us to keep it longer.
• Accounting and tax records: 5 years, as required by accounting and tax law.
• Computer traffic data: at least 90 days, as required by law.
• Messages you send us: 2 years from your last contact.

8. Security

We encrypt access tokens and businesses’ secrets, limit access by role, keep each business’s data separate, and transmit data over encrypted connections (HTTPS).

9. Your rights

Under the PDPA you have the right to access and get a copy of your data, to receive or transfer it, to object to processing, to have it deleted or anonymised, to restrict its use, to have it corrected, to withdraw consent, and to complain to the Personal Data Protection Committee.

Send requests to [email protected]. We reply within 30 days. If your data is controlled by a business that uses our services, for example because you commented on or chatted with a shop, we will pass your request to that business and help carry it out.

10. Removing access and deleting data received from Facebook

If you connected a Facebook Page or account to our services

• Disconnect the Page in our services at any time, or
• On Facebook, go to Settings & privacy › Settings › Apps and websites, select our app, remove it and choose to send a data deletion request.

When we receive the request, we stop using the Pages you connected and delete their access tokens immediately, and give you a confirmation code to check the request’s status. You can also email [email protected].

If you commented on or messaged a shop that uses our services

Ask the shop to delete your data, or email us at the address above and we will work with the shop.

11. Cookies

phim.co.th uses only cookies needed for the website to work. It does not use advertising cookies or third-party tracking cookies.

12. Changes to this policy

We may update this policy from time to time and will show the date of the latest update above. We will notify businesses that use our services in advance of material changes.

13. Contact us

บริษัท พิม โซลูชั่นส์ จำกัด (PHIM Solutions Co., Ltd.)
17 Soi Pracha Uthit 19, Bang Mot, Thung Khru, Bangkok 10140, Thailand
Email [email protected]