Privacy Notice

1. Introduction and scope

Perke Innovation and Technology Co., Ltd. (“the Company,” “we,” or “us”) operates the PEXTH platform, which connects energy buyers and customers (“customers”) with the energy service providers registered with us (“partners”). We value your privacy and provide this notice to explain how we collect, use, and disclose your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

This notice applies to your use of the PEXTH websites and systems — namely pexth.com, account.pexth.com (accounts and sign-in), partner.pexth.com (partner portal), business.pexth.com (staff console), and api.pexth.com — as well as to contacting us by email, telephone, or LINE.

2. Data controller

The data controller under this notice is:

Once a partner receives your project details and contact information through the platform, each partner becomes an independent data controller of that information for the purpose of contacting you and providing a quotation, and must comply with the PDPA as well as the PEXTH terms of use.

3. Personal data we collect

3.1 Account data

• Your name, email, phone number (if provided), profile picture, and preferred language
• Your password, which we store only as an irreversible hash that cannot be converted back to the original password
• Two-factor authentication (2FA) data, such as the secret for one-time passwords and recovery codes stored as hashes
• Email verification status, your role in the system, and account settings

3.2 Signing in with Google, Facebook, or LINE

If you choose to sign in through an external provider, we receive the information you authorize from that provider — namely the provider's user ID, name, email, and profile picture — in order to create or link your PEXTH account. We do not receive the passwords of those accounts, and you can unlink them at any time on the account and security page.

3.3 Partner and company data

• Company name, legal entity name, tax identification number, business type, province, address, coordinates, and website
• The company's contact details, such as name, email, phone number, and LINE ID
• Logo, banner, images, videos, project portfolio, and information the partner publishes on its profile
• The company's team members and their roles (owner, manager, member)
• Documents and records relating to company verification

3.4 Project (RFQ) and contact information

When you submit project details, we collect the requester type (home/individual or business/organization), service type, province, system size, budget, project details, and your contact information (name, phone number, and email). This information is sent to the partners matched to your project (up to 5, or the company you choose to request a quotation from directly) so that the partners can contact you and prepare quotations.

3.5 Quotations, reviews, and saved companies

• The quotations you receive, and your acceptance or rejection of them
• The reviews and ratings you write, which are displayed publicly together with your display name
• The list of companies you have saved, and in-app notifications

3.6 Payment information

For purchases of partner packages, we collect the payment record, amount, reference number, any coupon used, and the image of the transfer slip you upload, which may include the payer's name and part of an account number. We do not store your credit card number or your bank login credentials.

3.7 Technical and usage data

IP address, browser and device type (User-Agent), sign-in date and time, active sessions, sign-in records, and records of significant actions in the system (audit log), for security and traceability.

3.8 Sensitive personal data

We do not intend to collect sensitive personal data under Section 26 of the PDPA (such as religion, health data, or biometric data). Please do not include such data in project details, reviews, or other content on the platform.

4. Sources of data

• Directly from you, when you register, complete a form, submit a project, upload files, or contact us
• From sign-in providers (Google, Facebook, LINE) as you authorize
• From partners, for example when a company owner adds you as a team member or sends you a quotation
• From reliable public sources, such as legal-entity data from government agencies, used to verify companies
• Automatically from the system, such as the technical and usage data described in 3.7

5. Cookies and storage on your device

PEXTH uses only the cookies necessary to provide the service and maintain security. We do not use advertising cookies or third-party tracking cookies.

Some pages display content from external providers, namely fonts from Google Fonts and Google Maps on the contact page. These providers may receive your IP address and use cookies under their own policies.

You can configure your browser to refuse or delete cookies, but if you block necessary cookies you will not be able to sign in or carry out certain actions on the platform.

6. Purposes and lawful bases

If you do not provide the information necessary to deliver a service — such as an email to register, or a phone number to submit a project — we may be unable to provide that service to you.

7. Disclosure of personal data

We do not sell your personal data, and we disclose it only as necessary to the following:

• Partners matched to your project — they receive your project details, name, phone number, and email, to be used only to contact you and provide a quotation for that project.
• General users on the platform — the company profile information a partner chooses to publish, and your reviews together with your display name. A company's contact details are shown only to signed-in members.
• Service providers that process data on our behalf — such as server and cloud providers, email delivery systems, and backups, under contracts that require them to keep the data confidential and secure.
• Sign-in providers — Google, Facebook, and LINE, during the authentication process you choose to use.
• Government agencies and lawful authorities — when required by law or under a lawful order.
• Professional advisers — such as auditors and legal counsel, under a duty of confidentiality.
• A successor in a business transfer — in the event of a merger, sale, or transfer of the business, where the transferee must protect the data in accordance with this notice, and we will notify you in advance.

8. Data retention periods

• Account data — for as long as the account is active, and no more than 1 year after the account is closed, to handle inquiries or disputes, unless the law requires a longer period.
• Project, lead, and quotation data — 2 years from the date the project is submitted, or until you request deletion, whichever comes first, unless a related action or dispute is still ongoing.
• Payment information and accounting documents — for the period required by accounting law and the Revenue Code (generally 5 to 10 years).
• Sign-in and security logs — no less than 90 days as required by the Computer-Related Crime Act, and no more than 1 year, unless needed to investigate a security incident.
• Sign-in sessions — expire within about 30 days, or immediately when you sign out or revoke the session.

After these periods, we will delete, destroy, or de-identify the data.

9. Transfer of data abroad

Some data may be transferred to or stored on servers outside Thailand — for example, when you sign in through Google, Facebook, or LINE, when your browser loads Google fonts or maps, or when we use cloud and email providers with data centers abroad. In such cases, we will ensure that the destination country provides an adequate standard of data protection, or put in place appropriate safeguards under Sections 28 and 29 of the PDPA, or rely on an exception permitted by law — such as performance of a contract to which you are a party, or your consent.

10. Rights of the data subject

Subject to the conditions set out by law, you have the following rights:

• Right to withdraw consent — withdraw consent you have given at any time, without affecting processing already carried out before the withdrawal (Section 19).
• Right of access and to obtain a copy of your personal data (Section 30).
• Right to data portability in a machine-readable format (Section 31).
• Right to object to processing based on legitimate interest or for direct marketing (Section 32).
• Right to erasure or destruction, or to de-identify the data (Section 33).
• Right to restrict the use of your personal data (Section 34).
• Right to rectification to keep data accurate, current, and complete (Sections 35 and 36).
• Right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) if you believe we are not complying with the law.

You can update your account details, revoke sessions, and unlink external accounts yourself on the account and security page. For other requests, please email [email protected] with the subject “Data subject rights request.” We may ask for information to verify your identity before acting, and will respond within 30 days of receiving the request. In some cases we may refuse a request as permitted by law, in which case we will inform you of the reason.

11. Security measures

We use appropriate organizational and technical measures to prevent unauthorized access to, use, alteration, or disclosure of data, such as:

• Encryption of data in transit with HTTPS/TLS
• Storing passwords with secure hashing, and support for two-factor authentication
• Short-lived, digitally signed sign-in tokens, and CSRF protection
• Role-based, need-to-know access controls, and logging of significant actions
• Storing payment slips and quotation files in non-public areas
• Rate-limiting of requests to prevent attacks and spam

In the event of a personal data breach, we will notify the PDPC within 72 hours of becoming aware of it as far as practicable, and will notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms.

12. Minors

PEXTH's services are intended for adults and for those transacting on behalf of a business. If you are not yet of legal age, please use the service with the consent of the holder of parental authority. If we learn that we have collected a minor's data without the consent required by law, we will delete it promptly.

13. Changes to this notice

We may update this notice from time to time to keep it aligned with our services and with changes in the law, showing the latest effective date at the top of this page. If we make significant changes, we will notify you by email or in-app notification, and will request fresh consent where the law requires.

Partner websites and external services linked from the platform have their own privacy policies. Please review the policies of those providers as well.

14. How to contact us

If you have questions about this notice or wish to exercise your data subject rights, please contact the Company's personal data protection coordinator:

• Email [email protected]
• Telephone 064-963-9291
• LINE @perkeinnovation
• Post: Perke Innovation and Technology Co., Ltd., 51 Major Tower Rama 9, 11th Floor, Unit 1104.1, Rama 9 Road, Huamak, Bangkapi, Bangkok 10240, Thailand

See also: Terms of Use