Privacy Policy

GOSHIP CO., LTD. (the "Company", "we" or "us") is committed to respecting your privacy and the security of the personal data in our care. This Privacy Policy sets out how we collect, use and disclose personal data, and the rights of data subjects under the personal data protection law. It also explains to you, as a user or customer of our services, how we handle your personal data, so that you can make an informed decision before we collect it.

Scope of this policy

This Privacy Policy applies only to personal data under the control of the Company. It does not cover personal data that is collected, used or processed by services, in whole or in part, that are connected to or operated by third parties outside the Company's control. You may review the privacy notices or policies of those third parties directly.

1. Collection of personal data

Whose personal data we collect

Under this Privacy Policy, we collect and process the personal data of the following persons:

• Our users and customers, meaning persons who use our services or buy products from us, persons who express interest in our services or products, registered members, participants in activities we organize, and persons who visit, contact or use any of our channels, including but not limited to our website and applications, and any other persons of a similar nature.
• Where the user or customer is a legal entity: its directors, employees, contact persons, proxies (attorneys-in-fact) or authorized representatives, and any person whose personal data appears in documents provided to us, which we treat as having been obtained, processed and disclosed to us lawfully.
• Persons who are not our users or customers directly, but whose personal data we need to collect and process because they are involved in a transaction between you and us, such as parcel recipients and parcel senders.

Sources and types of personal data we collect

We collect your personal data directly and indirectly, whether you fill in, write, provide, disclose or submit documents, or through your use of our services in which that personal data appears, online or offline, in Thailand or abroad, including:

• When you work with us, make enquiries, create, apply for or register an account, or buy or use our products or services.
• When you visit, browse or sign in to our website or applications, including through cookies or other tracking technologies.
• When you apply for parcel insurance or contact us to make an insurance claim.
• When you take part in activities organized by the Company.
• When you give comments or feedback about the Company's products or services.
• When you consent to a third party transferring or disclosing your personal data to us, or a third party is legally entitled to do so, such as our partners, business partners, service providers, government agencies, and public sources that contain your data.

The types of personal data we collect from these sources are:

• Personal details: such as name, email address, phone number, gender, national ID card, passport, address, delivery address, company or shop name, taxpayer identification number (individual or legal entity), and trademark (if any).
• Account data: such as your order history, interests, date of birth, preferences, and other information you give us when completing a registration form in addition to your personal details.
• Payment data: bank account details, bank book page, credit card number, cash-on-delivery amounts and receipts.
• Shipping data: shipment creation details, courier, tracking number, shipping label, delivery note and parcel volume.
• Logged data: such as your computer's device identifier, usage data from other devices such as mobile phones or tablets, geographic location, pages visited, data entered together with date and time, the source of your visit to our website (such as the website or URL that referred you), browser type and operating system.
• Marketing data: such as your marketing preferences and your engagement with our emails, such as delivery, open and click-through rates.
• Communications you send us: such as survey responses, participation in activities, interactive communications and other information you provide to us.
• Images, audio and recordings: such as photos and videos that you send to us directly through social media platforms.

If you do not wish to, or cannot, provide certain data to us, we may be unable to enter into a contract with you or perform our obligations to you, you may be unable to use all or part of our services or platform, or you may not receive the full benefits we offer.

2. Use of personal data

We collect, use and disclose your personal data where appropriate for the following purposes:

• To contact you, and to handle sign-ups, registration and purchases of our products or services, including verifying your identity.
• To act on your requests, or to provide services under an agreement or contract with you, including services involving couriers and parcel delivery by our carrier partners and business partners, payment of service fees, parcel insurance and claims, and parcel tracking related to your use of our services.
• To manage your account and to support the general administration and operation of our business.
• To perform tasks carried out in the public interest or in the exercise of official authority vested in us, and to comply with contracts, legal obligations and law enforcement requests.
• For communication, enquiries, customer care, and usage or administrative support.
• For marketing, sales promotion and advertising, and for research, analysis, surveys, and statistical, marketing and behavioural segmentation and prediction (marketing and data analysis), so that we can understand you better and meet your needs accurately.
• To improve the management, quality control and development of our business, products, services and systems.
• For restructuring, mergers, sales of business, transfers of business or other assets, investment in our business, and similar transactions, where the disclosure and transfer of your personal data forms part of that transaction.

In some cases we may receive sensitive personal data that is not needed for our purposes, such as religion, beliefs, race or opinions. You have the right to ask us to restrict its use before it is disclosed. We have no intention of collecting or processing such sensitive personal data.

If we collect, store, update, share, process or use your personal data for purposes other than those above, we will make sure that you have consented to that purpose, update this Privacy Policy, and ask for your additional consent where required.

* Where the data subject is a minor or lacks legal capacity to enter into a transaction with us, consent to use the personal data must be given by their parent, guardian, curator, custodian or other lawful representative. *

3. Disclosure of personal data

We may disclose your personal data to third parties with your consent or where permitted by law, as follows:

• To persons within the Company, including executives, directors, employees and staff, to the extent necessary for the purposes set out above and for internal administration.
• To service providers, to the extent necessary for our business operations, such as telecommunications, data storage, technology services, payments and payment systems, logistics, parcel delivery, procurement, legal advisers, lawyers, finance and accounting, marketing, insurance, product or service development, auditors, or any other services that benefit you.
• To business partners, with whom we may share certain data, such as logistics or insurance providers we partner with, for coordination, providing services and giving you benefits, on a need-to-know basis.
• To third parties at your request or as permitted by law, or where necessary for a business transfer, restructuring, merger, sale of business or transfer of other assets, provided that the transferee handles your data in a manner consistent with this policy and with personal data protection law.
• To government organizations or authorities, to comply with the law, legal proceedings, court orders, subpoenas, orders of government authorities or other legal processes.

Where we disclose your personal data to others or engage others to provide services related to our business, we require them to keep the personal data confidential and put in place appropriate measures to protect it.

4. International transfers of personal data

Because our business operates internationally, we may sometimes need to send or transfer your personal data abroad, for example to companies in our group or to cloud processing systems or servers located outside Thailand. Some countries may have laws that require companies to share certain personal data, for example with tax authorities. We make reasonable efforts to ensure that the destination has an adequate level of personal data protection, or that the transfer is lawful under Thai law.

5. How we store personal data

We manage the storage of your personal data carefully, whether electronically on secured servers and/or as paper documents in closed cabinets, and restrict access to the persons concerned only.

6. How long we keep personal data

We keep your personal data only as long as necessary for the purposes for which it was collected. Retention periods differ by type of data:

(a) Customer records, transaction records and accounting documents are kept while you are a customer or otherwise have a relationship with us, and for 10 years afterwards, in order to comply with laws on the retention of accounting and tax records, to respond to inspections by government authorities, and to resolve disputes.

(b) Conversations, messages and data received from the channels a merchant connects through the GoChat service are kept for significantly shorter periods than (a), as set out in the retention table in section 12, which specifies a period for each type of data.

(c) Data for which an external platform sets its own retention requirement is kept in accordance with that platform requirement and permanently deleted when the period ends.

When a retention period ends, or when the purpose of collection has been fulfilled, we delete the personal data or render it no longer identifiable, unless a legal obligation or a dispute requires us to keep it. Data held in backups is removed in accordance with our ordinary backup retention cycles.

7. Accuracy of your personal data

You are responsible for making sure that the personal data you provide to the Company, or that is provided on your behalf, is accurate, complete and up to date, and for informing the Company as soon as possible of any changes, so that you can receive our services in full.

8. Your rights regarding your personal data

You have the right to withdraw consent; to access and obtain a copy of your personal data; to have it corrected; to have it deleted or destroyed; to restrict its use; to data portability; and to lodge a complaint. You may exercise these rights by submitting a request or contacting the Company through the channels below. The Company may decline a request in certain cases where the law permits it to do so.

We may need to ask you for information to verify your identity and confirm your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that your personal data is not disclosed to anyone who is not entitled to it. We may also contact you for more information about your request so that we can respond promptly.

9. Security of personal data

To keep your personal data confidential and secure, we have internal rules that define who may access or use your personal data, and we protect especially sensitive data such as credit card numbers and bank book pages. We provide secure communication channels for such data using encryption, such as the Secure Socket Layer (SSL) protocol. To prevent loss, unauthorized access, use, alteration, modification or disclosure, we apply security measures for personal data that are no less than those required by law.

10. Use of cookies

Cookies are files or data stored on your computer or internet-connected device when you visit our website. Cookies do not harm your computer or communication devices. We use cookies to track the use of our website and its features. We may also use cookies to measure visits, recognize your preferences and the products and services you are interested in, improve the website and make it easier and better suited to you, and for advertising and promotion.

We use both session cookies, which remain on your device until you leave our website, and persistent cookies, which remain on your device until you delete them (their lifetime depends on your browser settings), to improve your experience with the information we offer. In some cases we rely on third parties, such as advertising networks, video, map and social media features, and other external website providers, which may use your Internet Protocol (IP) address and cookies for statistical analysis, data linking and processing for marketing purposes. Such data does not identify who you are, even if it is linked to your personal information. You should read the cookie and privacy notices on third-party websites to understand how those third parties may use your data. The types of cookies used are:

Functionality cookies

We use these cookies to make it easier for you when you return to our website, by tailoring the website to how you use it.

Analytical/performance cookies

We use these cookies to process visits to our website and the characteristics of groups of users, in order to analyse user behaviour.

Advertising cookies

These cookies are stored on your device to record your visits and the links you have visited and followed. Third-party cookies may also use information shared through online media and content stored by the services to understand users' needs, in order to tailor the website and advertising campaigns to your interests.

Managing cookies: you can accept or refuse cookies. Most web browsers accept cookies automatically, but you can change your browser settings to refuse or block them. Refusing cookies may prevent you from accessing some information and features of the website. For more information about cookies and how to disable them, see the "Help" section of your browser.

11. Personal data breach notification

If a breach is likely to result in a high risk to your rights and freedoms, we will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of it. We will also notify you of the breach and the remedial measures as soon as possible.

12. Additional terms for the GoChat service

GoChat, both the web service and the mobile application, is operated by GOSHIP CO., LTD. This section applies in addition to the general terms above. Where this section differs from another section, this section governs the GoChat service.

12.1 Our role

Merchants who use GoChat decide which channels to connect and how they talk to their own customers. For the personal data of a merchant's customers, the merchant is the data controller and we process that data on the merchant's behalf. For the accounts of merchants and their staff, we are the data controller.

12.2 Data we process through GoChat

• Merchant and staff accounts: name, email address, phone number and role, received when signing in with a GoSaaS account; activity in GoChat, such as who replied to a chat or changed a setting; and technical data such as browser type and IP address.
• Customers of merchants, received from the channels the merchant connects, namely Facebook Messenger, Instagram, LINE, Shopee, Lazada and TikTok Shop: display name, platform user ID and profile picture as provided by the platform; messages and attachments in conversations with the merchant; order, shipping and return or refund information about that customer's orders with the merchant; and details the merchant's staff add, such as phone number, delivery address, notes and tags.
• Channel access tokens: the authorization the merchant gives us to send and receive messages on their behalf.
• Data from the mobile application: device model, operating system, app version, push notification token (Firebase Cloud Messaging) and crash reports; together with camera and photo library permissions used to take or choose images to send in a chat, and notification permission used to alert staff to new messages.

12.3 How we use data

• To show conversations to the merchant's staff and send their replies.
• To show the customer's orders, shipment tracking and return or refund status next to the conversation, and to create orders in the merchant's GoSaaS account when staff ask us to.
• To run the features the merchant turns on, such as automatic replies, assignment rules, broadcasts, and AI-assisted reply drafting described in section 12.5.
• To send new message notifications to the mobile application.
• If the merchant turns it on for a Facebook Page, to send purchase events to Meta so the merchant can measure their ads (Meta Conversions API).
• To keep the service secure and reliable, to diagnose and fix faults, to provide support, and to measure usage in aggregate.

We do not sell personal data and we do not use the data of merchants' customers for our own advertising.

12.4 Data from Shopee, Lazada and TikTok Shop

• We use marketplace data only to provide GoChat to the merchant who authorized us, and we follow the data policy of each marketplace.
• Order, shipping and return details are fetched from the marketplace when staff open them and are not stored in our database. We store only an index so that a buyer's orders can be found: shop, order ID, buyer ID and order time.
• Lazada data is permanently deleted 90 days after the message or order date, as required by Lazada. This covers every Lazada account of the merchant, including accounts that have already been disconnected.
• For Shopee and TikTok Shop we keep marketplace data only as long as needed to provide GoChat to the merchant. The merchant can delete a channel at any time, which permanently deletes that channel's conversations and messages.
• When a merchant disconnects a shop, or revokes our access in the seller center of the marketplace (for TikTok Shop, the seller deauthorization notice), we delete the access token for that channel immediately and stop all requests to that marketplace for that shop.

12.5 AI-assisted replies

If the merchant turns on AI features, the content of the relevant conversation and the merchant's knowledge base are sent to an AI provider to draft a reply. The AI providers we use are Google (Gemini), OpenAI and SCB 10X (Typhoon).

Before any text leaves our system, phone numbers, email addresses, postal addresses, identification and account numbers, and names known to the system are replaced with placeholders. The real values are restored only when the draft is shown to the merchant's staff. The table mapping placeholders back to real values exists only in memory for the duration of that request; it is never written to our database and never written to logs.

Staff review AI suggestions before they are sent, unless the merchant turns on automatic replies.

12.6 Who we share data with

• Hosting and processing: the GoChat service runs on Huawei Cloud, Bangkok region, Thailand. Our other services use cloud providers located in Thailand as well.
• Messaging platforms the merchant connects: Meta (Facebook and Instagram), LINE, Shopee, Lazada and TikTok Shop, to send and receive messages.
• Services in the same group: GoSaaS and GoShip, for orders and shipping status.
• AI providers as described in section 12.5, only when the merchant turns on AI features.
• Firebase (Google), for push notifications and crash reporting in the mobile application.
• Datadog, for system monitoring and error tracking on both the server side and the browser side. We do not collect browser monitoring data from the public storefront pages that a merchant's own customers visit.
• Authorities, when the law requires it.

Some of these providers may process data outside Thailand. We use providers that protect personal data with the safeguards required by Thai law.

12.7 How long we keep GoChat data

12.8 Security

• Data is encrypted in transit using HTTPS or TLS.
• Channel access tokens are encrypted with AES-256-GCM before they are stored and are never written to logs.
• Each merchant's data is separated at the database level, so one merchant cannot see the data of another merchant.
• Staff access follows the roles and permissions the merchant sets.
• In the mobile application, credentials are stored encrypted on the device (iOS Keychain or Android EncryptedSharedPreferences) and requests to our servers are verified with an HMAC-SHA256 signature.

12.9 Your rights and deletion

• Merchants and their staff may exercise their rights under personal data protection law by contacting us as set out in section 13, and may delete a channel or a customer themselves in the service, which permanently deletes that data.
• Customers of a merchant should contact the shop they chatted with, because the shop is the controller of their personal data. We will assist the shop in responding to the request.
• We will assist merchants and platforms in deleting, correcting or providing data upon the request of a data subject.

13. Contact us

Thank you for reading our Privacy Policy. We will update this policy from time to time to reflect changes in how we handle personal data, or changes in applicable laws or regulatory requirements. We may notify you of any material changes by email or through our other communication channels, but we recommend that you review this Privacy Policy periodically to stay informed of how we handle your personal data.

If you have any questions or wish to contact us about this Privacy Policy, please contact us at: