Privacy Policy & Account Deletion Guide

1. Introduction

ByteMatrix Co., Ltd. ("Company", "we", "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and protect your personal data in compliance with the Thailand Personal Data Protection Act B.E. 2562 (PDPA) and the General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Data You Provide

2.2 Automatically Collected Data

• Location Data (GPS) — For rider matching, real-time delivery tracking, and delivery fee calculation.
• Device Data — Device model, OS, FCM Token for Push Notifications.
• Usage Data — Order history, login records, IP Address.

3. How We Use Your Data

We use your data to:

• 🛒 Provide Services — Process orders, match riders, manage deliveries.
• 💳 Process Payments — Handle payments, digital wallets.
• 📍 Tracking — Real-time location tracking for deliveries.
• 🔔 Notifications — Push Notifications, SMS, email communications.
• 📊 Analytics — Generate reports, improve service quality.
• 🔒 Security — Fraud prevention, identity verification.
• 📋 Legal Compliance — Fulfil regulatory obligations.

4. Data Disclosure

We may share your data with:

• Tenants (Operators) — Data necessary for operations under your Tenant.
• Merchants / Riders — Data required for delivery (name, address, phone).
• Payment Gateways — Payment data via Omise, 2C2P, K-Bank.
• Cloud Providers — DigitalOcean (Database, Storage), Firebase (Notifications).
• Government Authorities — When required by court order or law.

We will never sell your personal data to third parties for marketing purposes.

5. Data Security

We employ industry-standard security measures:

• 🔐 AES-256 Encryption — For sensitive data (payment keys, rider documents).
• 🛡️ SSL/TLS — Encrypted data in transit.
• 🔑 JWT Authentication — Secure identity verification.
• 🏗️ Data Isolation — Strict tenant-level data separation.
• 📝 Audit Logging — All access to sensitive data is logged.
• 🔄 Data Backup — Automatic backups on DigitalOcean Managed Database.

6. Your Rights (PDPA & GDPR)

Under PDPA and GDPR, you have the following rights:

To exercise any of these rights, please contact us at contact@bytematrix.co.th. We will respond within 30 days.

7. Data Retention

• User Account Data: For the duration of the account + 30 days after deletion.
• Order Data: 3 years for accounting and tax purposes.
• GPS/Location Data: 90 days (auto-purged).
• Login/Audit Logs: 1 year.
• Tenant Data: 30 days after service cancellation.

8. Cookies & Tracking Technologies

We use cookies necessary for Platform operation:

• Essential Cookies: Session, Authentication Token — cannot be disabled.
• Preference Cookies: Language, Theme — can be disabled.

We do not use third-party tracking cookies for cross-site tracking.

9. International Data Transfers

Your data is stored on servers in Singapore (SGP1) via DigitalOcean, which complies with international security standards. Cross-border data transfers are subject to appropriate safeguards as required by PDPA.

10. Children's Data

The Platform is not designed for individuals under 18 years of age. We do not intentionally collect data from minors. If such data is discovered, it will be deleted immediately.

11. Policy Changes

We may update this Policy from time to time. Significant changes will be communicated in advance via email or Platform announcement. We recommend reviewing this Policy periodically.

12. Data Protection Officer (DPO)

13. Account and Personal Data Deletion Request

Policy for BeeGo Delivery Platform and associated tenant applications developed and operated by ByteMatrix Co., Ltd.

All users of the BeeGo platform (including BeeGo Customer, BeeGo Merchant, and BeeGo Rider apps) have the absolute right to request the deletion of their user accounts and associated personal data in full compliance with Google Play Data Safety policies and PDPA/GDPR regulations.

13.1 In-App Account Deletion Steps

1. Open the BeeGo mobile app on your device.
2. Log in to your account and navigate to Profile or Account Settings.
3. Tap on "Delete Account".
4. Select an optional reason and request an OTP verification code.
5. Enter the OTP code to confirm. Your account will be deactivated immediately and all associated personal data will be queued for permanent purging within 30 days.

13.2 Web / Email Deletion Request Instructions

If you no longer have access to the mobile app or have already uninstalled it, you may submit an account and data deletion request directly to our Data Protection Officer (DPO):

• DPO Contact Email: contact@bytematrix.co.th
• Email Subject: Account Deletion Request - BeeGo Delivery
• Required Information: Registered mobile phone number or registered email address.

Our DPO at ByteMatrix Co., Ltd. will verify your identity and process the full deletion request within 30 days.

13.3 Data Subject to Deletion

• Personal identity data: Full name, phone number, email address, profile picture.
• Saved delivery addresses and GPS coordinate histories.
• Stored payment credentials and digital wallet tokens.
• App preferences, favorite stores, and FCM push notification tokens.

13.4 Retained Data Regulatory Exceptions

In accordance with applicable accounting, tax, and statutory anti-fraud regulations, transaction order histories and tax invoices are retained for up to 3 years. Retained records are strictly anonymized, stored securely, and isolated from operational processing.