Privacy Policy

1. Who is responsible

The data controller is Dieva Asia Co., Ltd., 55/2 Moo 5, Chiang Rak Noi, Bang Pa-in, Phra Nakhon Si Ayutthaya 13180, Thailand. For any question about your data, write to [email protected].

2. What data we collect

• Account data: name, e-mail address, phone number, company name, address, preferred language, and your password in a one-way encrypted form.
• If you sign in with Google: your name, e-mail address and profile picture as provided by Google. We do not receive your Google password.
• Payment data for payouts: bank name, account number, account holder and tax ID. These are stored encrypted and only staff who make payments can view them; every viewing is logged.
• Transaction data: the catalytic converters you sell to us, their photos, weights, measurements, prices, offers and payments.
• Messages you send us through the contact form, chat or price requests, including attached photos and files.
• Business documents: contracts, licences and certificates, and copies of identity documents of sellers and staff where we need them for our business relationship or by law. Copies of identity documents are stored encrypted and only the staff who need them can open them; every opening is logged.
• Technical data: IP address, browser type, and the times you sign in. We use only cookies that are necessary for signing in and for remembering your language. We do not use advertising or tracking cookies.

3. Why we use it

• To create and run your account and to let you sign in securely.
• To evaluate, buy and pay for the materials you sell to us (performance of a contract).
• To keep accounting and tax records as required by Thai law (legal obligation).
• To keep, find and share the business documents we need, for example contracts and their expiry dates (legitimate interest, legal obligation).
• To prevent fraud and misuse, and to keep the service secure (legitimate interest).
• To answer your questions and send you messages about your transactions. We send marketing messages only with your consent, and you can unsubscribe at any time.

4. Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our behalf and under our instructions:

• Hosting and network: Hetzner Online (servers) and Cloudflare (network security and delivery).
• E-mail delivery: Resend and Google Workspace.
• Sign-in: Google, if you choose to sign in with Google.
• Automated reading of receipts, invoices and business documents such as contracts (to fill in amounts, dates and search words), translation of messages between our languages, and, on our accountant's request, a suggestion of what a line of our company's bank statement is: OpenAI and Anthropic. Only the document or text in question is sent; from a bank statement line only its text, with account numbers masked, never a full account number. They process it as our processors under a data processing agreement, do not use it to train their models and delete it within 30 days at the latest. Copies of identity documents are never sent to them: their text is read on our own server.
• Voice messages between our staff, when switched on: ElevenLabs turns the recording into text, and Microsoft Azure and Google read the translated text aloud. Only the recording or text in question is sent, under the providers' data processing terms; they do not use it to train their models. We do not keep the recording; the audio read aloud is kept for 7 days.
• Authorities, when Thai law requires it.

5. Transfers outside Thailand

Some of the providers above process data outside Thailand: OpenAI, Anthropic and ElevenLabs in the United States, Microsoft Azure in Singapore, Cloudflare and Google worldwide, Resend in the United States or the European Union. Where the destination country does not have data protection standards recognised as adequate under the PDPA, we rely on the safeguards the PDPA allows, such as data processing agreements with standard contractual clauses. You can ask us for a copy of these safeguards.

6. How long we keep it

Accounting records and transaction data are kept for at least 5 years, as required by Thai accounting and tax law. Account data is kept while your account is active. Older photos may be moved to an encrypted archive. When data is no longer needed, it is deleted or anonymised.

7. Your rights

Under the PDPA you have the right to:

• get a copy of your personal data;
• have incorrect data corrected;
• have your data deleted or its use restricted, unless we must keep it by law;
• object to its use and withdraw your consent at any time;
• receive your data in a commonly used electronic format;
• complain to the Personal Data Protection Committee (PDPC) of Thailand.

8. Security

Connections to this website are encrypted. Bank details and copies of identity documents are encrypted, staff accounts use two-factor authentication, and access to personal data is restricted by role and logged.

9. Changes

If we change this policy, we will publish the new version on this page with a new date. If the changes are significant, we will also inform you by e-mail.

10. Contact

Dieva Asia Co., Ltd., 55/2 Moo 5, Chiang Rak Noi, Bang Pa-in, Phra Nakhon Si Ayutthaya 13180, Thailand. E-mail: [email protected].