Privacy Policy

This Privacy Policy (“Policy”) is issued by BEST SOLUTION (THAILAND) CO., LTD., a company registered in Thailand, tax identification / juristic person number 0105552117459, of 599/30 Ratchadaphisek Road, Chatuchak, Bangkok 10900, Thailand (“the Company”, “we”, “us”).

It applies to the personal data we process when you use any of the following (together, the “Services”):

• bestsogroup.com and its pages, including the platform directory and the investor and partner sections;
• the central identity services — sso.bestsogroup.com (sign-in), account.bestsogroup.com (your BestSo account and Privacy Centre), merchant and partner consoles;
• the BestSo Bar (the bar that appears across the group’s websites and apps) and the BestSo Assist AI chat inside it;
• the 53 platforms in the BestsoGroup ecosystem listed in Annex A, including PAYDY (payments), BestaCoin (BESTA loyalty points), LIVEDY (live commerce), ShipX (logistics) and GiftCenter, and their mobile apps;
• customer support, events, surveys and marketing communications from the group.

Unless a platform clearly states that it is operated by a different legal entity, the Company is the data controller for that platform. Ska fyllas i eller bekräftas av företaget före publicering: [List of platforms in Annex A that are operated by another legal entity (name and address of each), if any]

Some platforms publish a short supplementary privacy notice for features specific to them. A supplementary notice adds to this Policy; where they conflict on that feature, the supplementary notice prevails.

This Policy does not cover websites and services of third parties that we link to, or merchants who sell to you on our platforms when they use your data for their own purposes (see section 7).

Personal data

Any information that identifies you directly or indirectly, as defined in the PDPA. It does not include data of deceased persons or data that has been anonymised so that you can no longer be identified.

Sensitive data

Data listed in section 26 of the PDPA, such as biometric data, health data, religion and criminal records.

BestSo account

Your single account in the group’s central identity system. It has a permanent identifier (UUID) that platforms use to recognise you.

Platform / child platform

A website or app in the group (Annex A) that you can sign in to with your BestSo account.

Merchant

A seller, service provider, creator or business that offers goods or services to you through one of our platforms.

Processor

A company that processes personal data on our instructions, for example hosting, email or SMS providers.

We collect only what we need for the purposes in section 5. Depending on which Services you use, this can include:

• From you — when you create an account, fill in a form, place an order, upload content, chat or contact us.
• Automatically — from your device when you use the Services (see section 14 on cookies).
• From platforms in the group — when you use your BestSo account on a platform, that platform and the central account exchange the data described in section 6.
• From third parties — sign-in providers you choose (Google, Facebook, LINE), payment partners (payment status, never your full card number), carriers (delivery status), merchants (order fulfilment updates), identity-verification and fraud-prevention services, and public sources where lawful.

Each use of personal data must rest on a legal basis under sections 24 and 26 of the PDPA:

Where we rely on a contract and you do not give the data, we may not be able to provide that Service. Where we rely on consent, saying no never stops you from using the core Services.

How consent works in the group. Data that is necessary to provide a Service needs no consent and is processed on the contract basis. Optional uses (marketing, cross-platform personalisation, AI profiling and sensitive data) are explained in full on your first central sign-in, where you can accept them with one click or adjust each one. Platforms operated by the Company do not ask again — your central choice applies to them. Every choice is recorded with the time and the policy version, and you can change or withdraw it at any time at account.bestsogroup.com/privacy.

Your BestSo account is held centrally at sso.bestsogroup.com and account.bestsogroup.com using the OAuth 2.0 / OpenID Connect standards. When you sign in to a platform with it:

• the platform receives your account identifier (UUID) and only the profile data its service needs — usually your name, email, profile picture and language; your addresses and phone number only when the platform delivers to you or needs to contact you;
• the platform keeps its own records of what you do there (for example your orders, bookings, listings or streams) and reports order status to the group’s central order register so that your order history, support and BESTA points work across platforms;
• BESTA points are earned and spent through BestaCoin; platforms see the points relevant to your order, not your activity on other platforms;
• with your personalisation consent, platforms may use your activity elsewhere in the group to recommend relevant products and services; without it they use only their own data;
• when you update your profile or addresses in your BestSo account, linked platforms are notified so their copies stay correct; when your account is deleted they are notified to delete or anonymise their copy unless the law requires them to keep it.

Signing out. “Sign out of ‹platform name›” ends your session on that platform only. “Sign out of all platforms” ends your central session and tells every linked platform to end its sessions, including through a server-to-server signal.

You can see which platforms are connected to your account and remove them at account.bestsogroup.com/connected-apps.

This Policy is the single privacy policy for all platforms listed in Annex A, including platforms marked “coming soon” once they open. The list is drawn from the group’s platform registry and may change as platforms are added or closed.

• Platforms we operate — the Company is the controller. Platform staff can access your data only as needed for their role, and access to sensitive operations is logged.
• Merchants on our platforms — when you buy from a merchant, the merchant receives the data needed to fulfil your order (for example your name, delivery address, phone number and order details) and becomes an independent controller of that data for its own legal obligations. Merchants must not use it for anything else without your consent.
• Platforms operated by other entities or partners — if a platform is operated by another legal entity, its operator and its own notice are shown on that platform, and only the data covered by your BestSo sign-in is shared with it.
• Supplementary notices — a platform may publish additional details for its specific features (section 1).

• Payments in the group are handled through PAYDY, the group’s payment hub, together with payment service providers licensed by the Bank of Thailand (for example card, PromptPay QR and e-wallet providers). The provider used for a payment is shown at checkout.
• Your money goes from you to the licensed provider and on to the merchant or the Company. We do not hold customer funds and we do not operate a stored-value wallet.
• Card numbers are entered on the provider’s secure page or form and stored by the provider, not by us. We receive a token, the last digits, the payment status and the transaction reference.
• We keep payment records to provide receipts and refunds, reconcile with providers, prevent fraud and meet tax and accounting law.
• Refunds go back through the same provider to the original payment method.

BESTA points are loyalty points issued by the BestaCoin programme. They are not money or electronic money, cannot be withdrawn as cash, transferred to bank accounts or to other users, and can be used for at most 20% of an order. We process your point ledger (earn, spend, expiry and reversal entries) to run the programme, prevent abuse and answer your questions. Programme rules, including expiry, are shown in the Reward Center and in our Terms of Service.

• Live streams are public by default. Anything you show or say in a stream, and your display name and comments in the chat, can be seen by viewers and may be recorded by them.
• Streams may be recorded and kept as replays for the period shown in the creator’s settings; creators can delete their replays.
• Creators and sellers who receive payouts must complete identity and bank verification (section 3).
• We moderate streams and chat to remove illegal or harmful content and may keep evidence of violations for investigations.
• Do not share other people’s personal data in a stream or in chat without their permission.

• To deliver a parcel or ride, we share the sender’s and recipient’s names, addresses, phone numbers and parcel details with the rider, driver or carrier performing the job.
• Tracking events and proof of delivery (photo, signature or name of the person who received it) are kept so that the sender, recipient and support can confirm delivery and resolve disputes. Proof-of-delivery files are stored privately and shown only to the parties to the job and authorised staff.
• Riders’ and drivers’ locations are processed only while they are on an active job or on shift, to dispatch work and show progress to the customer.
• Cash-on-delivery amounts are recorded to settle them with the merchant.

• BestSo Assist answers first from our own knowledge base and, when you are signed in, from your own account data (for example the status of your orders or your BESTA balance). It never uses another user’s data to answer you.
• Some answers are generated by our own AI model or by external AI providers that process the text of your question on our behalf. We send only the minimum needed to answer — your question, the relevant knowledge-base text and, if needed, the specific account data in the answer — and never passwords or payment card data.
• Conversations are kept for 30 days and then deleted automatically, unless you asked to talk to a person: handed-over conversations become support tickets and are kept as support records (section 17).
• When you ask for a person, the support staff of the Company or of the platform you are using can read that conversation.
• Your thumbs-up/down feedback and resolved questions may be used to improve answers. Answers added to our FAQ are rewritten so they do not identify you.
• AI answers can be wrong. Please do not enter sensitive personal data, such as health information or ID numbers, in the chat.

We send marketing by email, SMS, push notification, the LINE Official Account or the BestSo Bar only if you have consented. Every message explains how to stop it, and you can switch each channel off at account.bestsogroup.com/privacy. Service messages that are part of your contract — such as security alerts, order and delivery updates and billing reminders — are not marketing and continue while you use the Services.

You can also block or delete cookies in your browser settings; blocking strictly necessary cookies will sign you out.

We do not sell personal data. We disclose it only to:

• Platforms in the group — as described in sections 6 and 7.
• Merchants you buy from or book with — the data needed to fulfil your order.
• Payment partners — licensed payment service providers that process your payments (section 8).
• Carriers, riders and drivers — the data needed for delivery (section 11).
• Processors working for us — for example cloud hosting and content delivery (such as Railway and Cloudflare, including Cloudflare R2 storage), email (such as Resend), SMS, push notifications, the LINE Messaging API, AI providers (section 12), identity verification and customer support tools. They may use the data only on our instructions and must protect it.
• Professional advisers — auditors, lawyers and insurers, under confidentiality.
• Authorities — courts, police, the Revenue Department, the Anti-Money Laundering Office, the Personal Data Protection Committee and other authorities when the law requires it.
• A buyer or successor — if all or part of the business is sold, merged or reorganised, under this Policy, with notice to you.
• Anyone else with your consent.

Some of our processors store or process data outside Thailand, for example in Singapore, the United States or the European Union. Ska fyllas i eller bekräftas av företaget före publicering: [Location (country/region) of the primary database and backups] We transfer data abroad only as permitted by sections 28 and 29 of the PDPA — to countries with adequate protection standards, under appropriate safeguards such as data protection agreements and standard contractual clauses, under binding rules within a group, where necessary to perform your contract, or with your consent. You can ask us for information about the safeguards used.

We keep personal data only as long as needed for the purpose it was collected for, then delete or anonymise it. The main periods are:

• Encryption in transit (HTTPS/TLS) on all Services, and encryption at rest for selected sensitive fields.
• Passwords stored only as one-way hashes; two-factor authentication available to every account and used to protect administrator accounts.
• Role-based access for staff, least-privilege permissions and audit logs for sensitive actions such as payouts, refunds and data exports.
• Secrets and keys kept in secret managers, never in source code; separate sandbox and live environments for payment integrations.
• Monitoring for fraud and suspicious sign-ins, regular reviews and staff training.

If a personal data breach is likely to put your rights at risk, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and notify you without delay if the risk is high, together with the steps you can take.

Under the PDPA you have the right to:

• Withdraw consent at any time, without affecting processing done before (section 19);
• Access your data and get a copy, and ask how we obtained data you did not give us (section 30);
• Data portability — receive your data in a machine-readable format or have it sent to another controller where technically possible (section 31);
• Object to processing based on legitimate interest, to direct marketing and to profiling (section 32);
• Erasure — ask us to delete or anonymise your data (section 33);
• Restriction — ask us to suspend use of your data (section 34);
• Rectification — ask us to correct inaccurate or incomplete data (sections 35–36);
• Complain to the Personal Data Protection Committee (pdpc.or.th) (section 73).

How to exercise your rights

• Privacy Centre — account.bestsogroup.com/privacy: change consents, download a copy of your data (the download link is valid for 7 days) and request account deletion.
• Data deletion page — bestsogroup.com/data-deletion.
• Email privacy@bestsogroup.com or contact@BestSolution.co.th, or call 02-192-1740.

We may ask you to confirm your identity before acting on a request. We respond within 30 days and free of charge, unless a request is manifestly unfounded or excessive. We may refuse or limit a request where the law allows — for example, we must keep tax records even if you ask us to delete them — and we will tell you why.

The Services are intended for people with full legal capacity (20 years of age or married under Thai law). Minors may use them only with the consent of a parent or legal guardian, who is responsible for their use. Where consent is our legal basis, we obtain it from the parent or guardian for minors as required by section 20 of the PDPA, and we do not knowingly collect data from children under 10 without it. If you believe a child has given us data without the required consent, contact us and we will delete it.

We may update this Policy when our Services or the law change. Every published version has a version number and effective date; we keep earlier versions and provide them on request. For material changes we notify you in advance by email, in the BestSo Bar or in your account, and where a change affects something you consented to, we ask for your consent again.

Data controller

BEST SOLUTION (THAILAND) CO., LTD. · Tax ID 0105552117459

Address

599/30 Ratchadaphisek Road, Chatuchak, Bangkok 10900, Thailand

Data Protection Officer

Ska fyllas i eller bekräftas av företaget före publicering: [Name of the Data Protection Officer or DPO team] · privacy@bestsogroup.com

General contact

contact@BestSolution.co.th · 02-192-1740

Please read this Policy together with our Terms of Service.