Privacy Policy | A.2 Dress Rental

1. Data controller

Controller: A.2 Dress Rental Corporation Contact address: Ari Soi, Phahonyothin 7, Phaya Thai, Bangkok Contact channel: LINE OA @a2dress (09:00–19:00 daily) We operate a single-tenant online dress rental business and determine the purposes and means of processing your personal data.

2. Personal data we collect

We may collect the following data as necessary to provide our services: • Identity: full name, display name, LINE profile photo • Contact: phone number, LINE ID, email (if provided) • Booking: selected dress, pickup/return dates, size, pickup location (Google Maps pin if you provide it), special notes • Payment: bank transfer proof (slip), amount, payment date — we do not store credit card numbers; we accept bank transfer only • Profile & loyalty: membership tier, reward points, booking history • Technical: cookies, IP address, browser type, site usage (via analytics configured to minimize identification where possible)

3. Sources of data

We receive data from: • You directly — when booking, uploading a slip, updating your profile, or messaging us on LINE OA • LINE Platform — when you sign in with LINE Login (LIFF), within the scope LINE and you authorize • Automated systems — site usage logs and essential cookies We do not purchase customer lists from third parties.

4. Purposes and legal bases

We use data to: • Process bookings, confirm slots, coordinate pickup/return, and provide after-sales service • Verify identity, prevent misuse, and manage member accounts • Verify payments (deposits and rental fees) • Send LINE OA notifications about booking status, changes, or important updates • Operate loyalty points and member benefits • Improve the website, analyze usage, and maintain system security • Comply with applicable laws Legal bases include contract performance, consent (where required), legitimate interests, and legal obligation.

5. Disclosure to third parties

We may disclose data only as necessary to: • Infrastructure providers: Supabase (database and auth), Vercel (hosting) — under data protection agreements • LINE Corporation — for LINE Login and Messaging API per LINE policies • Google — for Google Maps (when you pin a pickup location) and analytics/Search Console as configured • Sentry — for error logging (technical data; not direct slip content) We do not sell your personal data and disclose to authorities only when required by law.

6. Retention

We retain data only as long as needed: • Booking and payment records: at least 5 years from the transaction date (accounting and disputes) • Member accounts and points: while the account is active, deleted within 90 days after you request account deletion • Transfer slips: as long as needed for verification and business records • System logs and cookies: per cookie policy or until you delete them When no longer necessary, we delete or anonymize data.

7. Security measures

We apply reasonable safeguards including HTTPS encryption, database access controls (Row Level Security), restricted admin access, industry-standard token/password handling, and staff confidentiality training. No system is 100% secure. If a personal data breach occurs, we will notify as required by law.

8. Your rights under PDPA

Under PDPA you may: • Request access to and copies of your personal data • Request correction of inaccurate or incomplete data • Request deletion or destruction when no longer legally required • Request restriction of processing in certain cases • Object to processing based on legitimate interests • Withdraw consent (where processing relies on consent) without affecting prior lawful processing • Request data portability in a machine-readable format (where applicable) Submit requests via LINE OA @a2dress with your name and details. We respond within 30 days (or as required by law). You may complain to Thailand’s Personal Data Protection Committee (PDPC) if unsatisfied.

9. Cookies and tracking

We use essential cookies for sign-in, language, and session security. We may use analytics cookies (e.g. Google Analytics) to understand site usage. You can block non-essential cookies in your browser, but some features may not work. We do not use personal data for third-party targeted advertising without consent.

10. International transfers

Some providers (e.g. Supabase, Vercel, Google, LINE, Sentry) may process data on servers outside Thailand. We implement appropriate PDPA safeguards such as standard contractual clauses or adequate protection mechanisms.

11. Policy updates

We may update this policy from time to time. The “Last updated” date above reflects the latest revision. For material changes, we will notify via the website or LINE OA where appropriate. Continued use after publication means you acknowledge the updated policy.