Privacy Notice

1. Who is responsible for your information

Key to Thailand is the seller and operator of this website and the data controller for the personal information we process to provide our property and relocation services. Contact us using the form at the end of this notice for privacy questions or requests. Paddle acts as a separate controller for the payment processing it performs as Merchant of Record.

2. Information we collect and why

• Account information: your email address, profile details you supply, account identifier and authentication information, including credentials managed by our sign-in service. We use these to create and secure your account and provide member features. When you choose a social sign-in option, the sign-in provider supplies the identity information needed to authenticate you.
• Enquiry and support information: your name, email, optional telephone number, country preference, message, relevant property and account identifier if signed in. We use these to respond, help with property enquiries, arrange requested assistance and resolve privacy or support requests.
• Member activity: saved property references, moving checklist progress and information you choose to share about your move. We use these to provide your shortlist and planning features. Do not enter sensitive personal details in planning tools or enquiry messages.
• Preferences: your selected country and currency. We use these to display relevant content and price conversions. Property-match answers are used in the page to generate recommendations; submitting an enquiry separately sends the information included in that enquiry.
• Purchase and access records: your account identifier, checkout email, transaction references, purchase status, refund or chargeback status and relevant timestamps. We use these to confirm the Move Pass purchase, grant or revoke access, provide support and maintain required transaction records. Card details are handled by Paddle rather than stored by Key to Thailand.
• Technical information: IP address, browser and device information, request and error logs and security-related activity processed by our hosting and connected services. We use these to deliver pages, troubleshoot failures, maintain reliability and prevent abuse or fraud.

We do not use enquiry information for unrelated marketing without an appropriate legal basis. Where optional marketing or tracking is introduced, we will provide any required consent choices and update this notice.

3. Legal grounds for processing

Where applicable law requires a legal basis, we rely on performance of a contract or steps you request before entering one for accounts, enquiries and purchased access; legitimate interests for appropriate service security, troubleshooting, fraud prevention and support; legal obligations for required accounting, tax and regulatory records; and consent where required for optional marketing or non-essential tracking. You can withdraw consent without affecting processing that was lawful before withdrawal.

4. Who receives information

• Service providers: Lovable Cloud and its underlying hosting and authentication infrastructure, including Supabase, process stored account, enquiry and purchase records. Other necessary hosting, security and support providers may process information solely to deliver their services.
• Payment provider: Paddle receives checkout information and account references for product sales, subscription management where applicable, payments, fraud prevention, tax compliance and invoicing. The Move Pass itself is a one-off purchase. See Paddle’s Privacy Notice.
• Maps and external services: Google receives standard browser and network information when its maps, embedded content or fonts load. Third-party sign-in providers process information when you use them. Opening an external video or messaging service subjects that interaction to the provider’s own privacy terms.
• Property representatives: information relevant to an enquiry may be shared with the representative who needs it to respond to your request.
• Professional advisers and authorities: legal and accounting advisers, regulators, law enforcement or courts may receive information where necessary for advice, compliance or lawful requests.

We do not sell your personal information.

5. Retention and deletion

We retain account data while your account remains active and as needed to provide the service. Enquiry and support records are retained for as long as needed to respond, manage follow-up and resolve disputes. Transaction records are retained for applicable accounting, tax, fraud-prevention and legal requirements. Technical logs are retained only for necessary operational and security purposes.

We review the need to retain information and delete or anonymise it when it is no longer required. Account deletion may not immediately remove necessary legal records or copies held in backups; those are restricted and removed through the applicable retention cycle. You may ask us about the retention applicable to your information.

6. Security

We use appropriate technical and organisational measures, including encrypted connections, access controls and restricted access to member and purchase records, to protect personal information. No online system is completely risk-free. Keep your login details private and do not send card numbers, passwords, passport copies or other sensitive documents through enquiry forms.

7. International transfers

Our service providers may process data in countries other than where you live, including outside Australia, the United States, the UK or the EEA. Where required, we use applicable safeguards such as adequacy decisions, standard contractual clauses or other lawful transfer mechanisms, and require suitable protection from providers. Contact us to ask about safeguards relevant to your information.

8. Your privacy rights

Depending on your location and applicable law, you may request access, correction, deletion, restriction or portability of your data, object to certain processing, or withdraw consent. We may need to verify your identity before acting on a request, and lawful exceptions may apply. You may complain to your relevant privacy regulator, including the Office of the Australian Information Commissioner where applicable.

For people covered by UK or EEA data-protection law, these include GDPR rights of access, rectification, erasure, restriction, portability, objection and consent withdrawal, and the right to complain to your local supervisory authority. We respond to requests within one month unless a lawful extension applies, in which case we explain the reason. We do not discriminate against you for exercising applicable privacy rights.

9. Cookies and browser storage

The website uses essential browser storage to maintain your sign-in session and remember your country and currency preferences. These functions use local storage; connected sign-in, map and checkout services may use their own cookies or storage to operate securely. We have not added our own analytics or advertising tracking cookies to this website.

You can manage cookies and clear site storage in your browser’s settings. Clearing or blocking essential storage can sign you out or reset your preferences. You can avoid loading optional external services by not opening them, and manage third-party preferences with those providers. If we add non-essential analytics or marketing cookies, we will offer any legally required consent controls before using them.

10. Updates

We may update this notice as our service or legal obligations change. The date at the top indicates the latest version. We will provide additional notice of material changes where required.