Privacy Policy

1. Scope

This policy covers visitors, buyers, partners in the Affiliate Program, sellers and anyone who contacts us. It does not cover third-party websites or services linked from the Platform, such as a supplier’s own website, which have their own policies.

2. Personal data we collect

Data you give us

• Account: email address, and the name, birthday, gender and photo you add to your profile. Sign-in is handled by our authentication provider; we never see a password.
• Bookings and orders: products, packages, dates, quantities, prices, order status and any Affiliate Code used.
• Visitors: first and last name and anything the supplier requires for the package, such as date of birth, age, nationality or passport number.
• Delivery and invoices: for store products, the recipient’s name, phone number and address; for tax invoices, the taxpayer name, tax ID and address you give.
• Payment: amount, time, method and status from our payment provider and, for a card, its brand and last four digits. You type card details into our payment provider’s secure form; we never receive or store full card numbers or security codes. Orders paid earlier by slip keep the slip’s QR data and verification result, which may include the sender’s name and a partial account number.
• Partners and sellers: taxpayer name, tax ID, address, VAT status, identity and company documents, and bank account details for payouts.
• Content and support: reviews, photos, chat messages and what you send our support team.

Data collected automatically

• Device and security: IP address, approximate country, device and browser type, app version, crash reports and security logs.
• Usage: products and pages viewed, app screens opened, app opens, sign-ins and sign-outs, payments and orders made, and searches (the words searched, the filters and the number of results), each with the time, your approximate country, your app version and, if you are signed in, your account ID. A random ID for your app install or browser lets us count a visit once; it is not linked to your name or email.
• Notifications: a device token so the app can send you notifications you allow.

Data from others: booking and ticket status from suppliers and ticketing partners, payment and refund results from our payment provider, and delivery status from couriers.

3. How we use it and our legal bases

• Create and run your account, bookings, orders, deliveries and refunds — contract
• Run the Affiliate Program: credit Friend Discounts and Commissions, show partners their earnings and pay them — contract
• Verify identity and tax details, issue tax invoices and keep accounting and tax records — legal obligation
• Prevent fraud, abuse and duplicate accounts, and keep the Platform secure — legitimate interests
• Improve search, suggestions, recommendations and the Platform, mostly with aggregated data — legitimate interests
• Send service messages about your orders and account — contract and legitimate interests
• Send news and offers — consent, which you can withdraw at any time

4. Who we share it with

• Suppliers and ticketing partners, such as GlobalTix, only what a booking and entry require.
• Sellers and couriers, only what is needed to deliver a store order.
• Partners: the partner whose code you used sees only the product, ticket or item count, order status and their Commission, never your name or contact details.
• Service providers who work for us under contract: cloud hosting and security (Google Cloud and Firebase, Cloudflare, DigitalOcean), payment processing (Beam Checkout, with card networks and banks for card verification), e-tax invoicing, email delivery, crash reporting (Firebase) and Google reCAPTCHA. Usage records are kept in our own database on Cloudflare; no analytics company receives them.
• Authorities, when the law requires it, or to protect the rights and safety of users and MassOrder.
• A buyer of our business, if MassOrder is merged or sold, under this policy.

We do not sell your personal data.

5. International transfers

Ticketing partners, overseas suppliers and some service providers are outside Thailand. We transfer only what is needed and rely on the safeguards the PDPA allows, such as contracts with suitable protection or transfers needed to perform your booking.

6. How long we keep it

• Account data: while your account is open, and normally up to 5 years after you stop using the Platform.
• Orders, payments, payouts, tax and accounting records: at least 5 years, or longer when tax or accounting law requires it.
• Partner and seller tax and identity documents: while the membership is active and 5 years afterwards.
• Usage records: 13 months, then deleted. For the audience totals we keep only your gender, age range, language and whether you are a partner, never your birthday, and clear them when you delete your account.
• Search records: kept to improve search; you can ask us to remove the account ID from yours.

When data is no longer needed we delete it or make it anonymous. We may keep data longer while a legal claim or investigation is open.

7. Cookies, browser storage and app tracking

The website uses browser storage to remember your selection, language and sign-in, and Google reCAPTCHA may set cookies for security. The website uses no advertising cookies. The app and the website count what is viewed, with the random ID above kept on your device, only in our own records; neither tracks you across other companies’ apps or websites.

8. Your rights

Under the PDPA you can ask to access and get a copy of your data, correct it, delete it, restrict or object to its use, receive it in a machine-readable format, and withdraw consent. You can also complain to Thailand’s Personal Data Protection Committee. Email us to use these rights; we may verify your identity first and reply within 30 days. Some requests are limited where the law requires us to keep data, such as tax records.

9. Security

We use encryption in transit, access controls, verified app requests and monitoring to protect your data. If a breach is likely to put your rights at risk, we notify the authority and, where required, you. Please keep your email and devices secure.

10. Children

People under 20 need a parent or guardian’s consent to open an account, pay or join the Affiliate Program. Children’s visitor details should be given by the parent or adult making the booking.

11. Contact our data protection officer

MassOrder Co., Ltd.
998/3 Moo 5, Sukhumvit Road, Thai Ban Mai, Mueang Samut Prakan, Samut Prakan 10280, Thailand
Phone 061-662-2639 · Email [email protected]

12. Changes to this policy

We may update this policy. We show the date of the latest version on this page and give notice of material changes on the Platform or by email.