GIZTIX COMPANY LIMITED, a company incorporated in Thailand (company registration no. / tax ID 0105558124767), address 55/50 Moo 9, Bang Pla, Bang Phli, Samut Prakan 10540, Thailand, telephone +66 2 026 6895 ("Giztix", "we"), is the data controller for personal data collected on the Turboo website. Contact for data protection and privacy matters: sittisak@giztix.com.

Personal data that you or your company enter inside the Turboo product — the workspace you sign in to at the Turboo product — is processed under your company's agreement with Giztix for the product. This policy covers the website only.

• Lead forms (talk to an expert, request a trial, e-mail me this plan, newsletter, the demo's forms): name, work e-mail, phone, company, role, fleet size, your message, your language, the page you sent the form from with any campaign parameters, and — from the demo — which tour you ran, how far you got, and whether you had named a brand or added a logo (not the name or the logo itself). Purpose: answer your enquiry, send what you asked for, and contact you about Turboo. Basis: your consent on the form (the checkbox, or the act of asking for the plan or the newsletter) and the steps you ask us to take before a contract.
• Quotations: company, tax ID, branch, registered address, contact name, e-mail, phone, and the modules and quantities you priced. Purpose: issue the quotation and follow up on it. Basis: steps before a contract; tax law for the tax details.
• Order requests and payments: your signed-in profile (name, e-mail, phone, company), the payment method, tax-invoice details (company, tax ID, branch, registered address), for invoice orders the accounts-payable e-mail and purchase-order number, and the order with its totals and order number. For card payments your card details are tokenised in your browser by the payment provider; only the provider's token and charge reference reach us, never the card number. Purpose: confirm and fulfil the order, issue invoices and receipts. Basis: contract; tax and accounting law.
• Account sign-up and sign-in: when you create an account, your name, company, e-mail, phone and password are passed through our server to the Turboo product's identity service, which creates the workspace; the website records your acceptance of the Terms of Service (version, time, user and organisation identifiers, e-mail, language and a hashed network address). When you sign in, the product's identity service checks your password; the website keeps a sealed session cookie with your name, e-mail, phone, organisation and role — never your password or the product's token. Basis: contract; our obligation to evidence consent.
• Website chat (when switched on): the messages you type, with the earlier messages of the same conversation, are sent to our AI provider to generate the reply. The conversation exists only in your browser while the chat is open; we keep a daily count of messages, not the conversation. Please do not put other people's personal data in the chat. Basis: our legitimate interest in answering your questions.
• Demo analytics: counts of demo events (event name, tour, language, step, day). No personal data, no network address, no browser identifier. The demo also pushes events to a dataLayer object in your browser, which is inert unless a tag manager is installed — none is today.
• Security and abuse prevention: your network address is used in memory to rate-limit the forms, the chat and sign-in, and is not stored; the records we keep carry a salted one-way hash of the address and the browser's user-agent string. Basis: our legitimate interest in protecting the website.
• Server logs: our hosting provider keeps request logs (address, URL, time, user-agent) for operations and security, for no longer than 90 days.

• locale — your language choice (EN / TH), kept for 1 year.
• tw_session — your website sign-in, sealed (encrypted and authenticated) and httpOnly, for up to 8 hours after sign-in or until you sign out.
• tw_pending — only during sign-in, when your e-mail belongs to more than one company: a sealed 10-minute cookie that carries, encrypted, the product's sign-in token and the list of your companies so that you can choose one. Used once, then deleted.

We set no advertising, analytics or third-party cookies. The demo stores the brand name and logo you add in your browser's local storage (turboo-demo-brand), and the pricing page stores your cart there, so they are back when you return; neither is sent to us. During a card payment the order number is kept in session storage until you return from the payment provider.

• Our hosting provider (Vercel) runs the website from its Singapore region and keeps the server logs.
• Our database provider (MongoDB Atlas) stores leads, quotations, orders, consent records and counters in an Asia-Pacific region.
• Our e-mail provider (SendGrid) delivers the notification of your lead to our sales inbox, and the order confirmation and payment e-mails to you.
• Our payment provider (Omise), when card or QR payment is switched on, processes your payment under its own privacy policy.
• Our AI provider (Anthropic), when the chat is switched on, processes the chat messages to generate the reply.
• The Turboo product, operated by Giztix, creates your workspace and checks your sign-in.

We do not sell personal data and we do not share it for advertising. Our providers process personal data on our instructions and under their data-processing terms, except the payment provider, which is a controller for the payment itself. We may also disclose data where the law requires it.

• Enquiries and leads (the forms in section 2): 24 months after our last contact with you.
• Quotations and order requests, with the invoices, receipts and payment records that belong to them: 5 years after the end of the calendar year in which they were issued, as required for accounting and tax records.
• Consent records of an account: for as long as the account exists, and 5 years after it is closed.
• Server logs, and the salted address hashes in our records: no longer than 90 days.
• Demo analytics and chat counters: aggregate counts only, no personal data; kept as statistics.
• Cookies and browser storage: as in section 3.

When a period ends we delete the data or anonymise it, unless a legal obligation or a pending claim requires us to keep it longer.

You can ask to access or receive a copy of your data, have it corrected or deleted, restrict or object to its use, receive it in a portable format, and withdraw consent you gave (withdrawal does not affect what was done before it). To exercise a right, e-mail sittisak@giztix.com from the address you gave us; we may ask you to confirm your identity and will answer within 30 days. You can also lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.

To stop marketing contact, reply to any of our e-mails or write to sittisak@giztix.com.

The website runs on Vercel in Singapore and its database on MongoDB Atlas in an Asia-Pacific region; our e-mail, payment and AI providers (section 4) also operate outside Thailand. Personal data collected on the website may therefore be stored or processed outside Thailand. For these transfers we rely on section 28 of the PDPA: the providers' data-protection safeguards and contractual commitments and, where applicable, your consent.

All traffic to the website is encrypted (HTTPS). Session cookies are sealed with AES-256-GCM and are httpOnly, so scripts cannot read them. Network addresses in our records are stored as a salted one-way hash. Passwords and product tokens are never stored by the website. Card details never reach our server. Forms are rate-limited and protected against bots, and the pricing checkout runs under a Content-Security-Policy. Access to the database and the sales inbox is limited to the staff who need it.

The website is a business service and is not directed at minors. We do not knowingly collect personal data from anyone under 20, the age of majority in Thailand; if you believe we have, write to sittisak@giztix.com and we will delete it.

We may update this policy. The version line at the top of the page shows the version and the date from which it applies. A change that affects how we use data you already gave us is notified by e-mail where we have your address.

This policy is published in Thai and in English. Both versions have equal standing; in case of conflict between them, the Thai version prevails.

GIZTIX COMPANY LIMITED · Company registration no. / Tax ID 0105558124767 · 55/50 Moo 9, Bang Pla, Bang Phli, Samut Prakan 10540, Thailand · Tel. +66 2 026 6895 — sittisak@giztix.com (also the contact for data protection matters).