Privacy policy

The controller under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (Thai PDPA) is PHUKET 24 ONLINE CO., LTD., operating as TVR Border Run (“we”, “the Company”).

Tax ID: 0835561011742. Address: 96/7 Moo 7, Soi Saiyuan, Rawai, Phuket 83130, Thailand.

For data matters and rights requests: info@tvr.asia. This is our data contact address; it does not mean that a separate Data Protection Officer has been appointed.

This policy covers the website, border-run requests, Telegram bot, Telegram Mini App, sign-in and account area, communications and trip notifications. It concerns personal data about individuals.

Booking and trip arrangements

Your name and supplied contacts: phone, WhatsApp, Telegram, email, Line or another selected channel; language; route, travel format and date, stamp type, adult count and children’s ages, selected seats and meals, comments, and a location or pickup link. We store the price calculation, booking status and related handling information, including manager notes.

Your name, at least one contact and the main trip details are needed to process a request. Please do not put health information, beliefs or other sensitive data unnecessary for the trip in comments. The form does not provide dedicated collection of such information.

Telegram, sign-in and your account

When you use the bot, Telegram sign-in or Mini App, we process your Telegram ID, username if available, profile first and last names, language and Telegram authentication data. The bot uses temporary conversation state to guide you through booking steps.

Email sign-in involves your address, address verification and a single-use link. Session records hold a technical identifier, browser information (User-Agent), creation, last-use and expiry times. Link requests also store IP and User-Agent.

The account area brings together sign-in methods, bookings, name, contacts and notification settings. Contacts are populated from sign-in and bookings and can be edited in your profile. Saved places are pickup links from previous bookings. Explicitly attaching a sign-in method already associated with another account merges the accounts and their history.

Email, messages and technical information

We process the recipient address, service email content and delivery state: sign-in or verification links, booking receipt, trip and stamp-expiry reminders, and booking notifications. Settings also include news; notifications for selected categories and channels depend on account settings. Emails provide an unsubscribe option. Manager communications use the channel you choose.

IP addresses are used to limit excessive requests; we store hashes rather than the addresses themselves. We also process request times, technical events and errors in logs to operate and protect the service.

• Handling bookings, calculating trip costs, contacting you, arranging pickup and travel, and service notifications: steps at your request before a contract and contract performance (Section 24(3) Thai PDPA).
• Operating accounts and sign-in methods, preserving preferences, preventing spam and unauthorised access, and diagnosing faults: the Company’s legitimate interest in a functional and secure service (Section 24(5)).
• Optional visit analytics: prior consent (Section 19). Refusal does not restrict booking, sign-in or contacting a manager.
• Applicable legal requirements and legal claims: legal obligations (Section 24(6)) and legitimate interests (Section 24(5)).

Manage notifications in the account area or bot and email unsubscribe through the link in an email. Unsubscribing from notifications does not cancel processing of your sign-in request or booking.

Necessary cookies and preferences

• tvr_session: account session, 90 days, renewed when an active session is refreshed. It uses HttpOnly and SameSite=Lax, with Secure in production. Signing out removes the cookie and server session.
• tvr_locale and tvr_theme: selected language and theme, up to one year. The theme may also be saved in Telegram CloudStorage.
• tvr_cookie_consent, when the cookie-consent mechanism is enabled, saves analytics permission or refusal for one year. It stores your choice rather than tracking behaviour.

Booking draft

To restore a booking, the browser uses localStorage (tvr:draft:v1) and, in Telegram where available, CloudStorage (tvr_draft_v1). Drafts can include contacts, trip details and pickup locations. No automatic draft expiry is set. You can remove local data through your browser; CloudStorage is separate Telegram storage and is not necessarily cleared by clearing the browser.

Optional analytics

When analytics modules are enabled, their scripts and cookies load only after permission, including in the Mini App. You can change your choice through “Cookie settings” in the footer when that mechanism is available. Withdrawing permission reloads the page and stops further analytics processing. Withdrawal does not affect earlier lawful processing or automatically guarantee deletion of previously collected data.

Google Analytics 4 and Yandex Metrica

When enabled and with your consent, these services may receive visit and page-view information, URLs, traffic sources, event times, cookie identifiers, IP addresses, approximate location, browser and device information. These are pseudonymous rather than guaranteed anonymous data. Booking details and contacts are not intended for transmission to analytics.

The Metrica integration is specified without Webvisor or click maps. A disabled service must not load. Analytics retention depends on the relevant account settings and provider rules.

Google reCAPTCHA v3

When enabled, reCAPTCHA v3 protects booking submission and email sign-in link requests. This is strictly necessary protection against automated requests and does not depend on analytics consent. Google may process IP addresses, browser and device parameters, interaction signals and the _GRECAPTCHA cookie; a token is used to verify the request.

The check protects form submission and sign-in; it does not decide trip eligibility or entry into a country. If protection prevents a request, use our contacts to reach a manager.

Access as needed is available to TVR staff and managers handling requests; technical providers including AWS hosting; the SMTP email delivery provider; Telegram for the bot, sign-in, Mini App and CloudStorage; Google for enabled reCAPTCHA; and Google and Yandex for enabled analytics with consent. Messengers and other communication channels you choose process messages under their own rules.

Disclosure to authorities or other recipients may be required by applicable law. Providers acting on our instructions must use data for agreed purposes and apply appropriate safeguards. We do not sell personal data.

Google, Yandex, Telegram, email and infrastructure providers may process data outside Thailand. An appropriate transfer mechanism must be identified under Sections 28 and 29 Thai PDPA: adequate protection, contractual or other appropriate safeguards, or an applicable lawful exception.

If a particular transfer requires consent because protection in the destination country is insufficient, we will request separate informed consent after explaining the risks. This policy does not itself constitute that consent.

Automatic periods in the service

• Sign-in or email-linking links are valid for 15 minutes; links in booking receipt emails for 72 hours. These are validity periods, not a promise of immediate record deletion.
• Account sessions last 90 days, renewed on use. Expired links and sessions are deleted automatically about one day after they expire.
• Email and IP counters for link requests expire after one hour; Telegram sign-in exchange counters after 60 seconds. Telegram Login replay-protection records last 10 minutes and expired records are cleared during subsequent checks.
• The temporary state of a bot conversation is kept for 24 hours. This is not the retention period for accounts or bookings.
• Booking submission replay records last 24 hours; expired records are cleared when bookings are created.
• An email waits to be sent for no longer than 15 minutes (sign-in and email linking), 72 hours (booking confirmation) or 7 days (other emails). Sent and expired emails are removed from the queue; emails that fail after five attempts are deleted after 30 days. These are our sending-queue periods, not those of your mailbox or the email provider.
• Cancelled bookings are removed by a daily task together with related reminders and tokens. Completed trips are not automatically deleted by that task.
• Application log files rotate with a five-day retention setting. This does not determine retention for all infrastructure logs or backups.

Other data

No single automatic deletion period is defined in code for accounts, profiles, completed bookings, related correspondence, backups or infrastructure logs. Data is retained while needed for the stated purposes, obligations or legal claims; when no longer needed, it is subject to deletion, destruction or irreversible anonymisation unless further retention is required by law. Mandatory accounting records are retained for the applicable statutory periods. Cookies and drafts are covered in section 5; analytics in section 6.

Subject to Thai PDPA conditions, you may withdraw consent, request access and copies, information about data sources, portability, correction, deletion or anonymisation, restriction, object to processing, and complain to Thailand’s Office of the Personal Data Protection Commission (PDPC).

Write to info@tvr.asia with your request and information allowing us to find your account or booking. Reasonable identity or authority verification may be needed to protect data. Access or copy requests are handled without undue delay and, unless there is a lawful ground for refusal, within 30 days of receiving a complete request. Rights may be limited by law or the rights of others.

We use Telegram authentication checks, single-use links, session validation and booking access controls. These measures reduce the risk of unauthorised access; absolute security is not guaranteed. Thai PDPA notification obligations apply to incidents.

An adult supplies children’s ages to calculate costs and arrange travel, seats and meals. Please provide no more child data than necessary. We do not rely on a child’s independent consent where parental or legal representative involvement is required. Contact info@tvr.asia about children’s data.

External maps, websites and messengers follow their owners’ rules. This policy is updated when the service or processing changes; the current dated revision is published here. Any required new consent is requested separately.

Questions and requests: info@tvr.asia. You may also contact PDPC through its official services.