Privacy Policy

1. Introduction

Villa Management System ("we", "our", or "us"), registered under company number 0822809917, operates a multi-property villa and facility management platform. We are committed to protecting the privacy and security of personal data collected through our services. This Privacy Policy describes how we collect, use, share, and protect your information when you access or use our platform, whether as a company administrator, operations manager, field staff, villa owner, external contractor, or any other authorized user role.

By accessing or using our platform, you confirm that you have read and understood this Privacy Policy. If you do not agree to its terms, please discontinue use of the platform immediately and contact us at villasystemphuket@gmail.com.

2. Company Information

• Company Name: Villa Management System
• Company Number: 0822809917
• Contact Email: villasystemphuket@gmail.com
• Location: Phuket, Thailand

3. Information We Collect

We collect the following categories of personal data:

4. How We Use Your Information

We use collected data for the following purposes:

• To authenticate users and provide access to the platform based on assigned roles and company membership.
• To create, assign, and manage maintenance task tickets and recurring service schedules.
• To generate monthly property reports visible to authorized villa owners.
• To facilitate owner approval workflows for maintenance decisions and cost approvals.
• To send in-app notifications and status updates relevant to your role.
• To maintain audit logs for compliance, accountability, and dispute resolution purposes.
• To improve platform performance, reliability, and feature development based on usage patterns.
• To comply with applicable legal obligations under Thai law and international data protection frameworks.

5. Legal Basis for Processing

We process personal data on the following legal grounds under applicable data protection law:

• Contractual necessity: Processing required to provide the platform services to your company or organization.
• Legitimate interests: Operational management, fraud prevention, audit trail maintenance, and system security.
• Consent: Where consent is specifically obtained for optional data processing activities such as marketing communications.
• Legal obligation: Compliance with applicable laws, regulations, and lawful government requests.

6. Data Access and Role-Based Visibility

Access to data within the platform is strictly governed by user roles assigned at onboarding. The following principles apply:

• Company Admins have access to all data within their registered company scope.
• Operations Managers have access to all operational data (tasks, staff, villas) within their company.
• Field Staff and External Contractors can only access task tickets and properties assigned to them.
• Villa Owners can only access data related to their registered properties, including owner-approved reports and cost summaries.
• Accountant Administrators have access to financial records (cost reports, monthly summaries) within their company scope.
• Sensitive internal data (such as gate codes and internal access notes) is never exposed to villa owners through any report or portal.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy, or as required by applicable law. Specifically:

• Active user profiles are retained for the duration of the service agreement.
• Archived or inactive profiles are retained for a minimum of 12 months for audit purposes.
• Task tickets, photos, and audit logs are retained for a minimum of 24 months.
• Financial records and cost reports are retained for a minimum of 5 years in accordance with Thai accounting regulations.
• Upon written request, personal data may be deleted after the applicable retention period has expired.

8. Data Sharing and Third Parties

We do not sell your personal data. We may share data with trusted third parties only in the following circumstances:

• Platform Infrastructure Providers: Cloud hosting, database, and authentication services used to operate the platform (e.g., Base44 SaaS platform).
• Email Service Providers: For transactional notifications and system emails.
• Legal or Regulatory Authorities: When required by applicable law or lawful court order.
• Business Transfers: In the event of a merger, acquisition, or asset sale, data may be transferred as part of the business.

All third-party service providers are contractually bound to process data only on our behalf and in accordance with applicable data protection laws.

9. Data Security

We implement technical and organizational security measures to protect personal data from unauthorized access, disclosure, alteration, or destruction. These include:

• Role-based access control (RBAC) enforced at both frontend and backend layers.
• Encrypted data transmission using industry-standard TLS/HTTPS protocols.
• Audit logging of all critical actions including logins, data modifications, and status changes.
• Company-scoped data isolation ensuring users from one company cannot access data from another.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right of Rectification: Request correction of inaccurate or incomplete personal data.
• Right of Erasure: Request deletion of personal data under certain conditions.
• Right to Object: Object to processing based on legitimate interests.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at villasystemphuket@gmail.com. We will respond within 30 days.

11. Cookies and Tracking

Our platform uses essential session cookies to maintain authenticated user sessions. We do not use tracking cookies or third-party advertising cookies. Analytics data, if collected, is anonymized and used solely for platform improvement purposes.

12. Children's Privacy

Our platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.

13. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. We will notify users of material changes via in-app notification or email. Continued use of the platform after changes are posted constitutes acceptance of the revised policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact: