Version of 09.11.2026, draft pending review by a lawyer.
Privacy Policy
Applies to the KAR SYSTEM websites (KAR CONSTRUCTION, KAR SUPPLY, KAR ENGINEER, KAR WORKVISION), the Telegram bot @kar_system_bot and our WhatsApp channel.
1. Who handles your data
Data controller: KAR SYSTEM, Phuket, Thailand.
Legal entity, address, registration number: [to be added].
Representative in Thailand / data protection contact: [to be added].
Contact for questions and requests: WhatsApp +66 98 372 9767, a message to the Telegram bot @kar_system_bot, or email construction@kar.systems.
2. What data we collect
- Contact details from the bot and WhatsApp: your name or nickname, phone number or messenger username, language, the text of your message and the date. We need these to reply to you.
- The content of your request: what you need to buy, the task, site and city, deadlines and budget, as you tell us.
- Files you send: drawings, bills of materials, material lists, photos. Send only what you are entitled to share. Please do not send ID documents or other people's data unless necessary.
- Photos and messages of workers and site participants (WorkVision) — only with the person's separate consent to photos (see section 5).
- Website forms do not send data to our servers: they turn your answers into a ready message that you send yourself via WhatsApp or email. From then on the message is also handled under the rules of WhatsApp (Meta) or your email provider.
- Technical website data: the website does not use cookies, visitor counters or third-party services. The website host may keep technical access logs (IP address, time and address of the request) [to be added: hosting terms].
We do not knowingly collect health, religion, political opinion, criminal record or other sensitive data (PDPA s. 26). Please do not send it to us. We do not use photos of faces to identify people.
3. Why we use data and on what basis
| Purpose | Basis (PDPA) |
|---|---|
| Reply to your enquiry, prepare an offer, find suppliers, agree a purchase | Necessary to act on your request before a contract and for a contract (s. 24(3)) |
| Run work on a site: daily plan, reports, photo-based acceptance, attendance | Contract and your consent where required (ss. 19, 24(3)) |
| Photos and video of workers in which a person is visible | Your free, separate consent (s. 19) |
| Defence against disputes and claims, record keeping | KAR's legitimate interest, where not overridden by your rights (s. 24(5)); compliance with law (s. 24(6)) |
| Improving the service using anonymised data | Legitimate interest (s. 24(5)); personal data is not published for this |
You can withdraw consent as easily as you gave it (s. 19): write to us. Withdrawal does not affect processing done before it. If you do not give the data needed for a request, we may not be able to carry it out (s. 23(2)).
4. What we do not do
- We do not sell your data or pass it on for third-party advertising.
- We do not run video surveillance and we do not film covertly. Work is monitored through photos and video that the crew sends itself, with its consent.
- We do not publish photos in which a person can be recognised without that person's consent; faces are blurred in public photos.
- We do not publish suppliers' purchase prices or supplier data.
5. Photos and data of workers (WorkVision)
- Photos and video from site are used to monitor progress, accept work, record attendance and hours, and resolve quality disputes.
- Each person decides whether to send photos of themselves. We ask for consent before the first photo, in a language the person understands (Russian, English, Thai, Burmese).
- Attendance may be recorded with a photo and a QR code. The entry stays "reported" until a foreman or the owner confirms it; confirmation does not replace employment documents.
- A worker may decline face photos and check in another way agreed with the foreman.
- Withdrawing consent: tell your foreman or write to us. We will stop taking new photos of you and will delete or anonymise earlier ones unless they are needed for legal claims (ss. 33, 37(3)).
6. How long we keep data
| Data | Retention |
|---|---|
| Enquiries and contacts with no order | up to 12 months after last contact |
| Requests, offers and correspondence about an order | for the duration of the work plus up to 24 months |
| Site photos and reports | for the project plus up to 12 months after handover |
| Accounting and tax documents | as long as the law requires |
After that, data is deleted or anonymised.
7. Who we may share data with
- Suppliers and contractors: only what is needed to carry out your request (for example a list of items), and only after your consent to share contact details.
- Licensed partners (engineer, lawyer, accountant): to prepare documents for your project.
- Communication and storage services: Telegram, WhatsApp, KAR's own servers, [to be added: website and email hosting].
- Public authorities where the law requires it.
We require recipients to protect the data (s. 37(2)).
8. Transfers abroad and AI services
Messages, files and translations may be processed on servers and services outside Thailand, including artificial-intelligence services (for translation and drafts). Server country: [to be added]. We transfer data abroad where the destination or service provides adequate protection, or with your consent or another ground under PDPA s. 28. Do not send us any data you do not want sent abroad.
9. Your rights
You may: access your data and get a copy (s. 30; reply within 30 days); receive your data in a usable format and have it sent to another controller (s. 31); object to processing (s. 32); ask for deletion or anonymisation (s. 33); ask us to restrict use (s. 34); have inaccurate data corrected (s. 36); withdraw consent (s. 19); and complain to the supervisory authority, the Personal Data Protection Committee (s. 73). Exercise these rights through the contact in section 1. For your safety we may ask you to confirm that the request is yours.
10. Security and breaches
Access is limited by role, closed accounts verify sign-in, and files are kept on KAR's own servers and protected backups (s. 37(1)). If a breach creates a risk to your rights, we will notify the supervisory authority within 72 hours of becoming aware of it, and you if the risk is high (s. 37(4)).
11. Cookies and counters
The website does not use cookies or visitor counters, so no consent banner is shown. If we add analytics, we will first update this policy and give you a way to decline.
12. Changes
We may update this policy. A new version takes effect when published on the website; we will tell you about material changes in the bot.
13. Contact us
WhatsApp +66 98 372 9767 · Telegram: @kar_system_bot · Email: construction@kar.systems