Privacy Policy

01What we collect

• What you type in: full name, phone number, email address, and the message you send through the contact form.
• Booking details: car model, pick-up and return times, branch, add-ons, and the amount paid.
• Identity documents checked at handover — ID card or passport, and driving licence. We record the document number and expiry date on the rental agreement.
• If you sign in with LINE, Google, Apple or Facebook, that provider shares your name, email address and profile picture with us. We never see or store your password for that account.
• Website usage data — collected only if you allow analytics cookies. No analytics tool is installed today, so none of it is being collected at all. Server logs (IP address and request time) are kept only as far as security requires.

02Why we use it

• To verify the renter, draw up the rental agreement, and hand over the car.
• To reach you about your booking, remind you of pick-up and return times, and answer messages sent through the form.
• To issue receipts and comply with tax law.
• To handle insurance claims, traffic fines, and vehicle recovery when something goes wrong.
• To email you promotions — only if you opted in, and you can opt out at any time.

03The cookies this site actually sets

This site sets three cookies. All three are our own first-party cookies; none of them tracks you across other websites.

• evcnx_session — your sign-in state. HttpOnly (JavaScript cannot read it), expires in 30 days.
• evcnx_locale — the language you picked in the language switcher. Expires in 1 year.
• evcnx_consent — your cookie choices (consent version, allowed categories, and the time you chose). Expires in 1 year.
• theme — light/dark mode, kept in your browser’s localStorage rather than a cookie, and never sent to our server.

Analytics and marketing cookies are not set at all until you allow them in the cookie banner. No analytics tool is installed today, so even allowing them adds no cookie right now. You can change your mind any time via the “Cookie settings” link in the footer or the button in the last section of this page.

04How long we keep it

• Booking records and rental agreements — renter name, phone, email, car, dates, amounts — 5 years from the return date · Civil limitation periods, accounting and tax rules, and retrospective insurance claims
• Uploaded identity documents — ID card, passport, driving licence — For the life of the related agreement, deleted after 5 years · Driver verification required by the insurance policy, and evidence in a dispute
• Contact form messages — name, phone, email, and the enquiry itself — 1 year from the date the enquiry is closed · Following up open cases, answering later, and service quality review
• Member account and points — name, email, phone, avatar, linked social accounts, point ledger — As long as the account is active · identifying fields erased as soon as you request deletion · So you can see your rental history and spend points · withdraw consent any time on this page
• Log of emails we sent you — recipient address, subject, and delivery status — 1 year from the date it was sent · To prove a booking confirmation actually reached you if delivery is disputed
• Browser cookies — evcnx_session (login) · evcnx_locale (language) · evcnx_consent (your cookie choice) — evcnx_session 30 days · evcnx_locale 1 year · evcnx_consent 1 year · Needed for the site to work, and to record what you chose in the cookie banner

This table is read live from /api/privacy/retention every time the page is opened, so it shows the same periods the code uses — not numbers typed into a document.

05Who we share it with

We never sell personal data. We disclose it only as far as necessary, and only to the following recipients.

• The insurer covering that particular car, when there is a claim or an accident.
• Payment providers and banks, to process payments and return deposits.
• IT providers hosting our systems, under a data processing agreement that forbids any other use.
• Police, courts, or government agencies when served with a lawful order.

06Your rights under the PDPA

• Access the personal data we hold about you and request a copy.
• Have inaccurate or out-of-date data corrected.
• Have data erased, or its use suspended, once it is no longer needed for the stated purpose.
• Object to processing, and withdraw a consent you previously gave, at any time.
• Have your data transferred to another provider in a machine-readable format.
• Complain to the Personal Data Protection Committee if you believe we have handled your data wrongly.

We verify who is making the request, then act within 30 days. If we refuse a request, we tell you why in writing.

The right of access and the right to erasure are self-service: use the buttons at the end of this page once signed in. Erasure removes the data that identifies you (name, email, phone, avatar, linked social accounts, and the contact details on your bookings). The rental rows themselves stay for 5 years from the return date, because Thai tax law and our insurance policy require a rental operator to retain that proof. If you still have a booking whose return date has not passed, the request is refused until then, because we must be able to reach you about returning the car.

07Contact us about your data

• Email hello@evcnx.web-u.co with the subject “PDPA rights request”.
• Call 095-995-3000, every day 08:00–21:00.
• Write to 888 Ratchadaphisek Road, Huai Khwang, Bangkok 10310, Thailand.