OSTRO← Back to home
Legal information

Privacy Policy

Last updated: June 2026

OSTRO CO., LTD (the “Operator”, “we”) respects the privacy and personal data of users of the website ostro.one (including its subdomains), as well as of all forms, messengers and other communication channels. This Policy describes what data we collect and how we use and protect it in accordance with Thailand's Personal Data Protection Act (PDPA, B.E. 2562 / 2019) and the general principles of the GDPR. By using the Website and submitting forms, you confirm your acceptance of this Policy.

Operator

OSTRO CO., LTD

Registration number: 0835569005563
Address: 63/202 Marina Condominium, Moo 2, Koh Kaew, Mueang Phuket 83000, Thailand
Website: ostro.one
01

Key Terms

  • Personal data — any information relating to a directly or indirectly identifiable user.
  • Processing — any operation performed on data (collection, storage, use, transfer, deletion).
  • Operator — the entity that determines the purposes and means of personal data processing.
  • Cookies — small files stored in the user's browser.
  • Cross-border transfer — the transfer of data outside the user's country.
02

What Data We Collect

Data you provide:

  • name;
  • phone number;
  • email address;
  • messenger accounts (WhatsApp, Telegram);
  • property preferences and budget;
  • information provided in enquiries and correspondence.

Data collected automatically:

  • IP address;
  • device and browser data;
  • approximate geolocation;
  • cookies and analytics data;
  • actions on the website.
03

Purposes of Processing

  • handling enquiries and responding to you;
  • consultations and property selection;
  • concluding and performing contracts;
  • sending property information and marketing communications (email, WhatsApp, Telegram, SMS);
  • analytics and service quality improvement;
  • protection against fraud and abuse.
04

Legal Grounds for Processing

Processing is carried out on the basis of:

  • your consent (given when submitting forms on the website);
  • performance of a contract or pre-contractual relations;
  • the Operator's legitimate interests;
  • requirements of applicable Thai law (PDPA).
05

Consent to Data Processing

By submitting a form on the website, you confirm your consent to:

  • the processing of personal data;
  • the processing of cookies;
  • receiving marketing materials;
  • the transfer of data to third parties as part of service provision;
  • the cross-border transfer of data.

Consent takes effect upon submission of the form and is specific, informed, freely given and unambiguous. You may withdraw it at any time.

06

Disclosure to Third Parties

We do not sell personal data. Data may be shared with:

  • developers — as part of completing a transaction, with your consent;
  • legal and financial advisers — for transaction support;
  • CRM systems, hosting and IT providers, marketing and analytics services — to operate the website and deliver our services;
  • government authorities — upon lawful request.
07

Cross-Border Data Transfers

Given the international nature of our business, your data may be transferred to and processed in the Kingdom of Thailand and other countries where the Operator's servers and partners are located. For any international transfer, we ensure an adequate level of data protection in accordance with the PDPA (Thailand) and international standards.

08

Cookies

The website uses cookies and similar technologies. Categories: strictly necessary (website operation), analytics (Google Analytics and similar tools), marketing (Meta Pixel and advertising systems).

Analytics and marketing cookies are used only with your consent (opt-in). You may accept or decline cookies, and adjust your browser settings at any time.

09

Data Retention

We retain data for as long as necessary for the purposes of processing, or until consent is withdrawn. Enquiry data is retained for 3 years from the date of last contact. Data on completed transactions is retained in accordance with Thai tax and civil law. You may request deletion of your data at any time.

10

Your Rights

Under the PDPA and GDPR, you have the right to:

  • access your data;
  • rectify inaccurate data;
  • erase your data;
  • restrict processing;
  • withdraw consent;
  • request information about data transfers;
  • lodge a complaint with a supervisory authority.

To exercise your rights, contact us using the details below.

11

Data Security

We apply technical and organisational measures to protect data: encryption in transit (SSL/TLS), access restricted on a need-to-know basis, and regular security audits of our systems. However, no transmission of data over the internet can be entirely secure, and the user accepts this risk.

12

Changes to This Policy

We may update this Policy from time to time. We give notice of material changes by publishing the updated version on the website with the date of the latest revision.

13

Contacts

For questions about personal data processing or to exercise your rights, contact us: