Privacy Policy

1. Introduction

This Privacy Policy explains how Jolie Boy Company Limited ("PetConnext", "we", "us", or "our") collects, uses, discloses, and protects personal data in connection with the PetConnext platform (the "Service"). We are committed to handling personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the "PDPA") and other applicable laws.

This Policy applies to: hotel owners, administrators, and staff who use the Service ("Operators" and "Staff"); visitors to our website; and the customers of Operators (pet owners) to the extent they interact with the Service. It forms part of, and should be read together with, our Terms of Service.

2. Our roles: controller and processor

The PDPA distinguishes between a "data controller" (who decides how and why personal data is processed) and a "data processor" (who processes data on a controller's behalf).

Where PetConnext is a data controller. We act as a data controller for personal data we collect about Operators and Staff to provide and administer the Service — for example, account registration details, billing information, and usage data.

Where PetConnext is a data processor. When an Operator enters personal data about its own customers (pet owners) and their contacts into the Service — such as customer names, phone numbers, addresses, emails, LINE identifiers, and emergency contacts — the Operator is the data controller of that personal data and PetConnext acts as a data processor, processing it only on the Operator's documented instructions to provide the Service. In that role, the Operator is responsible for having a lawful basis to collect and use that data and for providing required privacy notices to its customers.

Note: Information about animals (such as a pet's breed, health, vaccinations, medications, microchip number, or photos) is generally not "personal data" of a human under the PDPA. However, it is often linked to an identifiable owner, and we treat it with the same care as personal data.

3. Personal data we collect

Account and profile data (Operators and Staff): full name, email address, phone number, profile photo/avatar, role and permissions, hotel/business name and details, and login credentials managed through our authentication provider.

Business and billing data: subscription plan and status, company name, 13-digit tax identification number, billing address, tax-invoice details, payment records, receipts, and invoices. Card payment details are collected and processed directly by our payment processor (Stripe) and are not stored on our servers.

Operational data entered by Operators (processed on their behalf): customer records (name, phone, email, LINE ID, address, postal code, emergency contact name and phone, notes); pet profiles (name, breed, age/birth date, gender, microchip ID, photos, allergies, health notes, food instructions, temperament and special-handling notes); vaccinations and medications; bookings, check-in/out records, care logs, daily updates, stay photos and media, incident records, documents and contracts; and tags.

Pet owner / end-customer data (via LINE): where an Operator enables LINE features, we process the pet owner's LINE user identifier and the information they submit through LINE (such as booking requests, service requests, uploaded pet photos, and messages) in order to deliver those features and send related notifications.

Usage and technical data: IP address, device and browser type, log data, and information about how the Service is used. This may be collected through standard server logs and analytics.

4. How we use personal data

We use personal data to:

• create and administer accounts and authenticate users;
• provide, operate, maintain, and improve the Service and its features;
• process subscriptions, payments, and issue receipts and tax invoices;
• send transactional and service communications (e.g. booking updates, check-in reminders, technical notices, and support messages), including via email and LINE;
• provide customer support and respond to enquiries;
• monitor, secure, and troubleshoot the Service, and detect and prevent fraud or abuse;
• produce aggregated reports and analytics to understand and improve usage; and
• comply with legal obligations and enforce our Terms.

5. Legal bases for processing (PDPA)

Where we act as a data controller, we rely on one or more of the following legal bases under the PDPA:

• Performance of a contract — to provide the Service to Operators and Staff under our Terms.
• Legitimate interest — to secure, maintain, and improve the Service and to communicate with users, where this does not override their fundamental rights.
• Legal obligation — to comply with tax, accounting, and other legal requirements.
• Consent — where required, for example for certain communications; consent may be withdrawn at any time.

Where we act as a data processor, the Operator (as controller) is responsible for establishing the appropriate legal basis for processing its customers' personal data.

6. Sharing and disclosure of personal data

We do not sell, rent, or trade personal data. We disclose personal data only as follows:

• Service providers / sub-processors who help us run the Service under appropriate confidentiality and data-protection obligations (see Section 7).
• Between Operator and its authorized Staff, as configured within the Operator's account.
• As required by law — to comply with a legal obligation, court order, or lawful request by a competent authority, or to protect our rights, safety, or property and those of our users.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

7. Sub-processors and third-party services

We rely on the following categories of sub-processors and third-party services to provide the Service. They process personal data only as needed to provide their services to us:

• Supabase — cloud hosting, database, authentication, and file storage.
• Stripe — payment processing and subscription billing.
• LINE (LY Corporation) — messaging, login, and the LINE Front-end Framework (LIFF) used for pet-owner interactions and notifications.
• Email delivery provider(s) — to send transactional and notification emails.

8. International data transfers

Some of our sub-processors may store or process personal data on servers located outside Thailand. Where personal data is transferred abroad, we take steps to ensure an adequate level of protection in accordance with the PDPA, for example by relying on the recipient being in a jurisdiction with adequate protection, on appropriate safeguards, or on another lawful basis for cross-border transfer. Please contact us for more information about the safeguards we use.

9. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service. After an account is closed or terminated, you may request export of your data within 30 days, after which we will delete or anonymize personal data within a reasonable period, except where we are required or permitted to retain it longer for legal, tax, accounting, dispute-resolution, or legitimate business purposes.

Where we act as a data processor, we retain and delete customer personal data in accordance with the Operator's instructions and applicable law.

10. Data security

We implement reasonable technical and organizational measures to protect personal data, including encrypted connections (HTTPS), access controls and role-based permissions, row-level security in our database, restricted access on a need-to-know basis, and audit logging of certain activities. Payment card data is handled by Stripe and is not stored on our servers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a personal data breach occurs that is likely to result in a risk to the rights and freedoms of data subjects, we will notify the Office of the Personal Data Protection Committee, and affected individuals or controllers, as required by the PDPA.

11. Your rights as a data subject

Subject to the conditions and exceptions in the PDPA, you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate or incomplete data;
• erase or de-identify your personal data;
• restrict or object to certain processing;
• data portability — receive your data in a machine-readable format, where applicable;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand.

To exercise these rights, contact us at privacy@petconnext.app. We will respond within the timeframe required by law (and in any event within 30 days where practicable). If your request concerns personal data that an Operator controls (e.g. you are a pet owner), we may refer your request to the relevant Operator, who is the data controller for that data.

12. Cookies and similar technologies

The Service uses session storage to keep you signed in during your session. We do not use persistent tracking cookies for advertising. We may use analytics to understand, in aggregate, how the Service is used. You can control storage through your browser settings, though some features may not function properly if disabled.

13. Children's privacy

The Service is intended for use by businesses and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

14. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service and update the "Last updated" date above. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

15. Contact us and Data Protection contact

For questions, concerns, or to exercise your rights, contact:

Jolie Boy Company Limited Data Protection contact: privacy@petconnext.app Website: petconnext.app Address: 9/196 Panya In Thra Road, Khan Na Yao Sub-district, Khan Na Yao District, Bangkok 10230