Effective Date: 09.13.26
Last Updated: 10.26.26

This Privacy Policy explains how ISTRAC CO., LTD (“we,” “us,” or “our”) collects, uses, discloses, and safeguards personal data in connection with your access to and use of isttrac.com (the “Website”) and any related services (collectively, the “Services”). We are committed to protecting your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) of Thailand and its subordinate regulations. If you are located in other jurisdictions with applicable data protection laws (such as the GDPR), we process your data in a manner consistent with those laws as described below. By using the Website, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are (Data Controller)
ISTRAC CO., LTD a company registered in Phuket, Thailand , with registered address at ISTRAC CO., LTD. 143/1 Ban Don - Cherngthalay Road Cherngthaly Sub District, Thalang District, Phuket Province, is the data controller responsible for the processing of your personal data as described in this Policy. For any questions or requests regarding your personal data, you may contact us at:

• Email: nataly@isttrac.com
• Postal Address: 143/1 Ban Don - Cherngthalay Road Cherngthaly Sub District, Thalang District, Phuket Province
• Data Protection Officer: Nataly Zolotova

2. Personal Data We Collect
We collect only the personal data necessary for the purposes described in Section 3. Depending on how you interact with the Website, the categories of data we may collect include:
A. Information you provide directly:

• Account and contact data: name, email address, company name, job title, and any other information you submit through registration forms, enquiry forms, or correspondence.
• Billing and payment data: if you subscribe to a paid Service, billing address and payment-related details (processed via a third-party payment processor).
• User content: any information you choose to enter into the Services, such as notes, saved searches, or tracked items.

B. Information collected automatically:

• Technical and usage data: IP address, device and browser type, operating system, referring URL, pages visited, time spent on pages, and interaction data (e.g., clicks, features used).
• Cookie and tracking data: information collected through cookies and similar technologies as described in Section 9.

C. Information from third-party sources:

• If you interact with us through a third-party platform (e.g., social media, authentication provider), we may receive limited profile information from that platform in accordance with its policies.

We do not routinely collect sensitive personal data (e.g., racial or ethnic origin, religious beliefs, health data, biometric data) as defined under Section 26 of the PDPA. If we ever need to process such data, we will obtain your explicit consent or rely on another lawful basis permitted by the PDPA.


3. How We Use Your Personal Data
We process your personal data for the following purposes:

1. To provide and operate the Services: creating and managing your account, delivering the features and content you request, and facilitating your use of the Website.
2. To communicate with you: responding to enquiries, providing customer support, and sending administrative messages (e.g., service updates, security alerts).
3. To improve and secure the Services: analysing usage patterns to enhance functionality, troubleshooting, and protecting against fraud, abuse, or security incidents.
4. To send marketing communications (with consent): where permitted by law, we may send you promotional emails or updates about our Services. You may withdraw your consent at any time.
5. To comply with legal obligations: meeting tax, accounting, and other regulatory requirements.

We will not use your personal data for any purpose incompatible with those described above without providing you with prior notice or obtaining your consent where required.

4. Lawful Bases for Processing
Under the PDPA, we rely on one or more of the following lawful bases:

• Performance of a contract: processing necessary to provide the Services you have requested or to take steps at your request before entering into a contract (Section 24(3)).
• Legitimate interests: processing necessary for our legitimate interests, such as operating, securing, and improving the Website, preventing fraud, and communicating with business contacts, provided that your fundamental rights are not overridden (Section 24(5)).
• Compliance with legal obligations: processing necessary to comply with applicable laws, such as tax and accounting requirements (Section 24(6)).
• Consent: where we rely on consent (e.g., for certain marketing communications or non-essential cookies), you have the right to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

If you are located in the European Economic Area (EEA) or the UK, we similarly rely on the corresponding lawful bases under the GDPR.

5. Sharing and Disclosure of Personal Data
We do not sell, rent, or trade your personal data. We may share your data only in the following limited circumstances:

• Service providers (data processors): We engage trusted third-party companies to perform functions on our behalf, such as hosting, analytics, email delivery, and payment processing. These processors are contractually obligated to process data only according to our instructions and to implement appropriate security measures.
• Professional advisers: We may disclose data to lawyers, auditors, and insurers where necessary for the operation of our business.
• Legal and regulatory authorities: We may disclose data if required by law, regulation, court order, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction, subject to the acquirer’s continued compliance with this Policy.

A list of our current key sub-processors (if any) is available upon request.

6. International Transfers
We may store or process your personal data outside of Thailand. Where we transfer personal data to a country that does not provide an adequate level of data protection under PDPA standards, we will implement appropriate safeguards, such as binding contractual clauses or reliance on an adequacy decision, as required by the PDPA. For transfers from the EEA/UK, we rely on the European Commission’s Standard Contractual Clauses or other approved transfer mechanisms.

7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Retention periods may vary depending on the type of data and the context:

• Account data: retained for the duration of your account and a reasonable period thereafter to comply with legal and operational requirements.
• Usage and analytics data: typically retained in aggregated or anonymised form for up to [e.g., 26 months] , depending on the analytics provider.
• Marketing data: retained until you unsubscribe or withdraw consent, after which we will promptly remove you from our marketing lists.

When data is no longer needed, we will securely delete or anonymise it.

8. Your Rights as a Data Subject
Subject to applicable law, you have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data where there is no lawful reason for us to continue processing it.
• Right to restrict processing: request that we limit the processing of your data in certain circumstances.
• Right to data portability: request transfer of your data to another controller in a structured, commonly used format (where applicable).
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time.
• Right to lodge a complaint: file a complaint with the Personal Data Protection Committee (PDPC) of Thailand or your local supervisory authority.

To exercise any of these rights, please contact us using the details in Section 1. We will respond within the timeframe required by law (generally within 30 days for PDPA requests). We may need to verify your identity before fulfilling your request.

9. Cookies and Similar Technologies
We use cookies and similar tracking technologies to operate the Website, analyse usage, and (where consented) support marketing. Cookies fall into the following categories:

• Strictly necessary cookies: required for the basic functioning of the Website (e.g., authentication, security). These do not require consent.
• Analytics/performance cookies: help us understand how visitors use the Website. Where required by law, we obtain your prior consent before setting these cookies.
• Functionality cookies: remember your preferences (e.g., language, region).
• Marketing cookies (if applicable): used to deliver relevant advertisements. We will only set these with your explicit consent.

You can manage your cookie preferences through the cookie banner or settings available on the Website, and you may also adjust your browser settings to block or delete cookies. Please note that disabling certain cookies may affect the functionality of the Services.

10. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include [e.g., encryption, access controls, regular security assessments] . However, no method of transmission over the internet or electronic storage is completely secure; we cannot guarantee absolute security.

11. Children’s Privacy
The Services are not directed to individuals under the age of [e.g., 20] (or the age of majority in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last Updated” date at the top indicates when the latest revision took effect. We encourage you to review this page periodically. If we make material changes, we will provide notice through the Website or by other appropriate means.

13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us:
ISTRAC CO., LTD. 143/1 Ban Don - Cherngthalay Road Cherngthaly Sub District, Thalang District, Phuket Province Tax ID : 0835569005938 +66649368333
nataly@isttrac.com
www.isttrac.com