Privacy policy

CNXDrive, which operates the CNXDrive website, is the controller of personal data collected through this website. You can reach us about personal data through the channels on our contact page.

The rental shop that takes your booking is a separate controller for the data it uses to make and perform its rental contract.

• Booking contact details: full name, phone, email, nationality and language
• Trip details: dates and times, pick-up and return places, car model and, for private-driver trips, the route, stops and pick-up/drop-off photos taken by the driver
• Identity check after the deposit: photos of your ID card or passport and driving licence (watermarked on your device before upload), document number, date of birth, address and licence expiry date
• Payment data: transaction reference, amount and status from the payment provider. We do not store card numbers or banking passwords
• Scam-shop reports: the reporter's name and contact, the account of what happened, evidence (slips, chats, posts), details of the reported shop, and any response from the shop
• Technical data: IP address and browser details in the system's change log, and a one-way hash of your IP used to rate-limit reports and shop channel checks

The customer website uses only necessary cookies: one that remembers your language and session cookies for people who sign in (such as shops and staff). We do not use advertising cookies or third-party analytics.

• Contract: taking bookings and payments, passing details to the shop or driver handling your trip, sending status updates and finding a replacement car when a shop cancels
• Legal obligation: keeping rental contract and financial records as the law requires, and responding to lawful requests from authorities
• Legitimate interests: preventing fraud by renters and by shops, rental history checks, keeping the system secure, and publishing evidence-checked scam-shop listings to warn consumers
• Consent: where the law requires it, for example when you submit a report and agree to be contacted. You can withdraw consent at any time; this does not affect processing before withdrawal

A Thai ID card may show religion or blood type. We do not use this information, and you may cover it before taking the photo. When screening against renters reported by shops for fraud, the system compares a keyed one-way hash, not the full ID number.

• The rental shop taking your booking: contact and identity details needed for the rental contract. A shop sees only its own bookings. For quote requests, shops see your name and phone only after you choose them and pay the deposit
• Drivers (private-driver trips): name, phone, pick-up place and route, as needed for the trip
• Payment provider (Beam): what is needed to process payments and refunds
• Service providers processing data on our behalf: website hosting, database, file storage, and an AI document-reading service (used when you ask the system to read your ID to fill in the form)
• Government authorities or courts, when the law requires it or under a lawful order

We do not sell personal data. The scam-check page never shows reporters' or customers' details, and shows only the last 4 digits of a shop's bank account.

Some service providers may store or process data on servers outside Thailand. We choose providers with appropriate data protection safeguards as required by the PDPA.

We keep booking and contract data for as long as needed to provide the service and for the periods required by accounting, tax and consumer protection law. Scam-shop reports are kept while the listing is published or under dispute. The system change log is kept as a security record. When data is no longer needed we delete or anonymise it.

Under the PDPA you have the right to:

• access your data and get a copy
• have inaccurate data corrected
• have data deleted, destroyed or anonymised
• restrict or object to processing
• data portability
• withdraw consent
• complain to the Personal Data Protection Committee (PDPC)

Contact us through the channels on our contact page. We may ask you to verify your identity and will reply within the time the law requires. In some cases we may decline as the law allows, for example when we must keep data to meet a legal obligation.

Data is encrypted in transit. Document photos are kept in private storage that opens only through short-lived links, access is limited by role, and secrets in system logs are masked before they are recorded.

We may update this policy and will show the last-updated date at the top. If we make material changes, we will announce them on the website before they take effect.