Who is responsible

The controller of your personal data (the party responsible for it) is KANANA ESTATE COMPANY LIMITED, 38/4 Onnuch Soi 30, Onnuch Road, Onnuch, Suanluang, Bangkok 10250, Thailand, registration number 0105543038487 (“BeastProp”, “we”). Representative of the company: name available on request. Contact for all privacy matters: privacy@beastprop.com.

We have not appointed a representative in the EU or the UK under Article 27 of the GDPR or the UK GDPR. Where our processing of personal data of people in the EU, the EEA or the UK is only occasional and unlikely to result in a risk to them, Article 27(2)(a) of both laws exempts us from this duty, and we rely on that exemption where it applies. If our services come to require a representative, we will appoint one and name them here. Until then, contact us directly about anything to do with your data: by email at privacy@beastprop.com or by post to the address above, in English or Thai. You can also complain to your data protection authority at any time (see “How to use your rights”).

We have not appointed a data protection officer because the law does not currently require one for what we do; the privacy contact above handles every request. We will appoint one if the law comes to require it.

In short

• We collect only what we need to run BeastProp, and you can use most of it without an account.
• Browsing history, journey analytics and marketing emails stay off unless you switch them on.
• Your household and expense settings are used to calculate costs for you. We never use them for advertising and never sell them or share them with partners.
• A provider or viewer receives your details only when you send them a request or book a visit. When you ask BeastProp about a home for sale, your enquiry comes to us, and the lister or seller receives your details only after you agree.
• We do not sell or rent your personal data.
• You can see, download and delete your data on the Account page.

What we collect

What we hold depends on how you use BeastProp:

• Without an account: your preferences (language, currency, units, theme and, if you set it, nationality for the ownership rules), filters, saved homes, recent places, saved searches and household settings are kept only in your browser's local storage on this device. They are not sent to us.
• Account data: your email address; your name if you give it (or the name and picture from your Google or LINE account if you sign in with Google or LINE, and with LINE also your LINE user ID); optionally your phone number and the languages you read; your nationality, display preferences and any interests or budget you choose to give; your saved homes, saved searches and alert settings; and your consent and marketing choices.
• Household and expense settings, if you save them to your account: the number of adults, children and pets, your lifestyle level, the expense types you tick and the homes you compare. See the next section.
• Browsing history, only if you switch it on: the homes and guides you open, the searches you run, and the official-source, provider and share links you use.
• Journey analytics, only if you accept analytics: which pages and features you use, how you move between them and when you leave for an external link, linked to a random identifier stored in your browser, or to your account if you are signed in.
• Requests and bookings: the provider or service, the property, your message, the package and time window, the contact details you give for that request, the booking status, the viewer's report and the payment status. Card details are handled by our payment provider; we receive only a reference, the amount and the last digits of the card.
• Contact reveals: which provider's phone number or email you revealed, and when.
• Messages: what you write to us and our replies, including privacy requests and complaints.
• Technical data: IP address, browser and device type, the pages requested and error logs, recorded by our hosting and database providers to deliver and protect the service.
• Enquiries about market listings (“Ask BeastProp about this home”): your name, email address or phone number, preferred contact method and language, your message and anything else you choose to tell us (for example your budget, timing, financing plans or whether you want a viewing), our notes of calls, messages and viewings, whether you agreed that we pass your enquiry to the lister, and the outcome.
• If you list a home for sale: your name, whether you are the owner or an agent, your agency name and licence or register number, your contact details, proof that you may market the home (for example the owner's written authorisation or a copy of the title deed), the listing content, our co-agency agreement, and commission, invoice and payment records.
• Feedback you send with “Suggest an improvement”: your message, the topic you chose, the page, the part of the page and the listing it was sent from, your interface language, your account if you are signed in, and a random key from your browser (not your IP address) that we use to stop abuse.

Household and expense settings

The cost-of-living tool lets you describe your household (adults, children, pets, lifestyle) and choose expense types such as schooling, childcare or health insurance. Together these can say something about your family and, indirectly, about your health or circumstances, so we handle them with extra care:

• They are optional. The tool works without them, and without an account they stay on your device.
• We use them only to calculate and show estimates for you, to remember them if you save them, and to let you compare homes.
• We use them for statistics about what households look for only if you switch on “Help improve BeastProp”, and then only in aggregated form that does not identify you.
• We never ask for or record health conditions. We never use these settings for advertising, never sell them, and never pass them to providers, partners or sponsors unless you include them in a request yourself.
• You can change or delete them at any time in your account. Deleting them removes them from our database.

When you ask BeastProp about a home for sale

Enquiries you send with “Ask BeastProp about this home” come to BeastProp, not to the lister. They are read and answered personally by our founder or a member of our team, not by an automated system.

• We use your enquiry to answer you, help arrange a viewing and follow up about that home and, if you ask us to, similar homes. We do not use it for marketing unless you opt in to marketing emails.
• We pass your name, contact details and enquiry to the lister (and through them to the seller) only after you agree, in a separate step for that home, which shows who the lister is and their country. If you do not agree, we keep answering you ourselves without revealing who you are.
• Once your details are passed on, the lister is responsible for them as an independent controller. Our Partner Terms allow listers to use them only for your enquiry about that home, not for unrelated marketing.
• If a purchase goes ahead in a sale we took part in, we may have to check your identity and keep records under anti-money-laundering and tax law.
• We never use your household or expense settings for an enquiry unless you include them yourself, and we never sell enquiry data.

If you list a home for sale

If you submit a market listing as an owner or agent, we use your data to check that you may market the home, publish the listing, contact you, pass on enquiries from interested buyers who agree to it, carry out our co-agency agreement and invoice or pay commission. The legal bases are explained under “Why we use your data”.

• Your contact details stay private. They are not shown on the listing; buyers contact BeastProp. We give them to a buyer only with your agreement, for example to arrange a viewing.
• We publish the listing content you give us (photos, description, price and location) and whether you are an owner or an agent. For agents we also publish the agency name and, where the law requires it, the licence or register number. We do not publish owners' names.
• If you are an agent, the owner's details you give us (for example in an authorisation) are used only to confirm that you may market the home. Please tell the owner that BeastProp presents the home and point them to this notice.
• You can correct your listing or withdraw it at any time; see “How long we keep it”.

People connected with listed properties, and listed providers

Official sale notices can relate to identifiable people, such as the owner or debtor of a property. We do not collect or show names, identity numbers or contact details of owners, debtors or occupants, and we remove them if a source includes them. A listing's address, case number and sale details can still relate to a person. We show them because the authority or seller has already published them to make the sale public, on the basis of our legitimate interest and the public's interest in finding public sales (GDPR Art. 6(1)(f); PDPA section 24(5)). We remove a listing and its share page within 30 days after its last sale date or when the source removes it. If a listing concerns you, you can object (see Your rights) and we will review it promptly.

Provider directory: we list professionals and businesses, such as lawyers, notaries and banks, from public registers, official directories and their own websites, with their business contact details and the source. We do this on the basis of our legitimate interest in helping buyers find professional help, which is also in the providers' interest. Listed providers can ask us at any time to correct, update or remove their entry, or claim it to manage it themselves.

Why we use your data (legal bases)

We use personal data only for the purposes below. Each purpose shows its legal basis under the EU and UK GDPR and the Thai PDPA. Under Japan's APPI, these are our purposes of use, and we do not use your data beyond them without your consent.

• Providing your account, saved homes, searches, alerts and household settings: performance of our contract with you (GDPR Art. 6(1)(b); PDPA section 24(3)).
• Sending your request to a provider, arranging viewer bookings, taking payment and sending booking messages: contract (GDPR Art. 6(1)(b); PDPA section 24(3)). The provider receives only the details you choose to send.
• Browsing history, journey analytics and the use of household settings for aggregated statistics: your consent (GDPR Art. 6(1)(a) and, for storage on your device, the ePrivacy rules; PDPA section 19). You can withdraw it at any time; this does not affect processing before the withdrawal.
• Marketing emails: your consent (GDPR Art. 6(1)(a); PDPA section 19; Japan's Act on Regulation of Transmission of Specified Electronic Mail). Every marketing email has an unsubscribe link.
• Keeping BeastProp secure and working, preventing fraud, scraping and abuse, and logging contact reveals to protect providers: our legitimate interests, limited to what is necessary (GDPR Art. 6(1)(f); PDPA section 24(5)).
• Improving the service with aggregated statistics from technical logs that do not identify you, such as error rates: legitimate interests (GDPR Art. 6(1)(f); PDPA section 24(5)).
• Answering questions, complaints and rights requests, and keeping records that show we comply with the law: legal obligation and legitimate interests (GDPR Art. 6(1)(c) and (f); PDPA section 24(6) and (5)).
• Keeping accounting and tax records for paid services: legal obligation (GDPR Art. 6(1)(c); PDPA section 24(6)).
• Publishing sale information and the provider directory: legitimate interests, as explained above.
• Showing YouTube preview images: in the EU, the EEA, the UK and Switzerland, your consent (GDPR Art. 6(1)(a) and the ePrivacy rules), which you can withdraw at any time; elsewhere, our legitimate interest in showing what each video is about, to which you can object by switching the previews off (GDPR Art. 6(1)(f); PDPA section 24(5)).
• Reading your feedback, screening it for spam and abuse, translating and summarising it, and grouping similar requests so that we can improve BeastProp: our legitimate interest in improving the service (GDPR Art. 6(1)(f); PDPA section 24(5)). You can object at any time (see Your rights).
• We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Personal suggestions such as “Recently viewed” use your history only if you switched it on.
• Answering and following up your enquiries about market listings and arranging viewings: steps you ask for before a possible contract (GDPR Art. 6(1)(b); PDPA section 24(3)). Passing your enquiry to the lister or seller: your consent, given separately for each home (GDPR Art. 6(1)(a); PDPA section 19; APPI Articles 27 and 28).
• Listers' data: performance of our listing and co-agency agreement (GDPR Art. 6(1)(b); PDPA section 24(3)); checking that a lister may market the home, and protecting buyers from false listings: legitimate interests (GDPR Art. 6(1)(f); PDPA section 24(5)); identity checks and records required by anti-money-laundering and tax law when a sale we took part in goes ahead: legal obligation (GDPR Art. 6(1)(c); PDPA section 24(6)).

Service providers that process data for us

These providers handle personal data only on our instructions and under data processing agreements:

• Supabase, Inc. (USA): accounts, sign-in and database. Data region: Singapore.
• Vercel Inc. (USA): website hosting and delivery through its worldwide network.
• Cloudflare, Inc. (USA): storage and delivery of photos and share images (Cloudflare R2).
• Email delivery of sign-in links, alerts and booking messages: Resend, Inc. (USA).
• Payments for viewer bookings: Stripe, Inc. (USA) or Opn Payments (Omise, Thailand). It also acts as an independent controller for payment security and fraud checks.
• Map tiles: the OpenStreetMap Foundation (United Kingdom) serves the map images on our maps and receives your IP address and the map area you view.
• Anthropic, PBC (USA): its AI model Claude screens, translates and summarises the feedback messages you send us. Under its commercial terms, Anthropic does not use this data to train its models and deletes it after a short period.

Other recipients

When you send a request to a provider or book a viewer, we pass on the details needed for it: to the provider, what you choose to send; to the viewer, only what the visit needs (your first name, the property, the time window, your instructions and language), never your email or phone number. From then on the provider is responsible for your data under its own privacy policy. When you agree that we pass a market-listing enquiry on, the lister (the owner, or the owner's agent, who may share it with the owner) receives your name, the contact details you gave and your enquiry, and is then responsible for it as well.

Partners and sponsors receive only aggregated statistics, such as how often their listing was seen or contacted, never your identity unless you contact them. We may also share data with our professional advisers, with authorities where the law requires it, and, if BeastProp is sold or merged, with the buyer, who must respect this notice. We never sell or rent your personal data.

Sign-in with Google is optional. If you use it, Google tells us your name, email address and profile picture, and Google's own privacy policy applies to your Google account. Google (as YouTube) also receives technical data from your browser when YouTube preview images or videos load; see “Services that load with our pages”.

Sign-in with Apple, Microsoft, Facebook, X, LinkedIn, LINE or Kakao is also optional, where we offer it. We ask these services only for your name and email address; some also send an account ID and a profile picture link, which our sign-in provider Supabase keeps with your sign-in record. We never post on your behalf or read your contacts. If the email matches an existing BeastProp account, the sign-in is added to that account. Each service's own privacy policy applies to your account with it.

Services that load with our pages

Some parts of our pages are loaded from other companies' servers. When that happens, your browser sends them your IP address and technical details such as the browser type and the page that made the request. These companies act under their own privacy policies and may process the data outside your country.

For users in Japan, this section is also our notice of information sent to third parties under the Telecommunications Business Act.

• Fonts: our typefaces are served from our own site, so loading a page sends nothing to a font provider. Chinese, Japanese and Korean text uses the fonts already on your device.
• Maps: map images come from the OpenStreetMap tile servers (tile.openstreetmap.org), run by the OpenStreetMap Foundation (United Kingdom), which also receive the map area you view.
• Video preview images: the home page, city listings and property pages show tiles for YouTube videos. Where YouTube previews are on, each tile's picture loads from YouTube's image server (i.ytimg.com), run by Google (Google Ireland Limited, Ireland, and Google LLC, USA), as soon as the page is shown, before you click anything. Your browser then sends Google your IP address, browser and device details and which pictures it asks for; no video loads, and we ask your browser not to send the address of our page. We and Google may be jointly responsible for this transmission; what Google does with the data afterwards is decided by Google alone, under its own privacy policy. In the EU, the EEA, the UK and Switzerland, and wherever we cannot tell your country, YouTube previews are off: you see our own title card, served from our site, until you choose “Show YouTube previews” (your consent, GDPR Art. 6(1)(a) and the ePrivacy rules). Elsewhere they are on, because they show you what each video is about (our legitimate interests, GDPR Art. 6(1)(f); PDPA section 24(5)). Wherever you are, you can switch “YouTube preview images” off or on with “Privacy choices” at the bottom of every page; when they are off, nothing is sent to YouTube until you press play. To tell which rule applies, our hosting provider reads the country from your IP address when the page is requested; we do not store it for this.
• Security check on the feedback form: Cloudflare Turnstile, provided by Cloudflare, Inc. (USA), loads only when you open the form and receives your IP address and browser details to tell people from automated programs. It sets no advertising or tracking cookies.
• Video playback: a video itself loads only when you press play. It then plays inside our page in YouTube's privacy-enhanced mode (youtube-nocookie.com), provided by Google Ireland Limited (Ireland) and Google LLC (USA). From that click, YouTube receives your IP address, device and browser details, the page and the video, can store information on your device (for example in local storage) to play the video and count views, and may link it to your Google account if you are signed in to Google. Google decides how it uses this data under its own privacy policy. We tell you this on the player before you click; pressing play is your choice to load YouTube (consent, GDPR Art. 6(1)(a) and the ePrivacy rules; PDPA section 19). If you prefer not to, do not press play, or use the link to watch on YouTube instead.
• Links you choose to open, such as official sources, Google Maps, Street View, Google Translate and YouTube, take you to those sites, and their own privacy policies apply there.

International transfers

We are based in Thailand, and our providers process data in other countries, including the USA and Singapore. When you give us data from the EU, the UK or elsewhere, we receive it in Thailand as the controller. When we pass personal data from the EU or UK to a provider in a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (with the UK Addendum) in our agreements, or the EU-US Data Privacy Framework and its UK Extension where the recipient is certified. Transfers out of Thailand follow PDPA sections 28 and 29, to countries with adequate protection or under the same kind of contractual safeguards.

For users in Japan: our providers abroad are bound by contracts that require measures equivalent to those of the APPI, and on request we will tell you the countries involved, their data-protection systems and the measures taken. Thailand, where we are based, has a comprehensive data-protection law, the Personal Data Protection Act B.E. 2562 (2019), supervised by the Personal Data Protection Committee. When you send a request to a provider in another country, the request form shows that country, and by sending it you agree that your request goes to that provider. In the same way, when you agree that we pass a market-listing enquiry to a lister, we show the lister's country first.

For users in mainland China: to provide the service you ask for, your data is transferred to and processed outside China, in Thailand and in the countries of the providers above.

How long we keep it

We keep personal data only as long as the purposes above need it:

• Account data, saved homes, searches and household settings: while your account exists. We may close an account that has not been used for 3 years, after warning you by email 30 days before.
• Browsing history and journey analytics: 12 months from each event, then deleted or made anonymous.
• Requests and viewer bookings, including reports: 3 years after the request or booking is completed, to deal with questions and legal claims. Accounting records of payments: as long as tax and accounting law requires (in Thailand generally 5 years, and up to 7 years if the authorities require).
• Contact-reveal logs: 12 months. Security logs: up to 90 days; our hosting and database providers keep their technical logs for shorter periods.
• Messages and complaints: 3 years after the matter is closed. Records of rights requests and consents: as long as needed to show we complied, and at most 3 years after the request is closed or the consent ends.
• Marketing: until you unsubscribe. We then keep your email address on a suppression list only so that we do not email you again.
• Listings and their share pages: removed within 30 days after the last sale date or when the source removes them. Backups are overwritten within 30 days.
• When you delete your account, we delete your profile, saved homes, searches, household settings and history within 30 days, except records the law requires us to keep, such as payment records, which we then use only for that purpose.
• Data in your browser stays until you clear it or use the reset options in the app.
• Market-listing enquiries and our notes: 2 years after our last contact with you, if no purchase follows. If you buy a home in a sale we took part in, 5 years after completion, or longer where tax, accounting or anti-money-laundering law requires, because our commission and the checks behind it must be documented.
• Listers: the listing page and its photos are removed within 30 days after the home is sold or the listing is withdrawn. Lister contact details and the co-agency agreement: 3 years after the listing ends, to deal with questions, claims and the agreed protection period for buyers we introduced. Copies of proof of authority (such as title deeds or owner authorisations): 12 months after the listing ends, unless needed for a claim. Commission and invoice records: as long as tax and accounting law requires.
• Feedback messages: the original text for 12 months (support questions and complaints: 3 years after the matter is closed), then only an anonymous English summary and counts; spam and abusive messages: 30 days; the browser key: 30 days.

Your rights

Depending on where you live, you have the rights below. Wherever we reasonably can, we give them to every user.

• EU, EEA and UK (GDPR): access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests (and at any time to direct marketing), withdrawal of consent, and not being subject to decisions based solely on automated processing with significant effects.
• Thailand (PDPA): access and a copy, data portability, objection, erasure or anonymisation, restriction, rectification and withdrawal of consent (sections 19 and 30 to 36).
• Japan (APPI): disclosure of the personal data we hold about you (including in electronic form) and of our records of transfers to third parties, correction, addition or deletion, stopping its use or erasing it, and stopping transfers to third parties.
• Elsewhere, for example in Korea or China: the rights your local law gives you. Contact us and we will help.
• You can withdraw consent as easily as you gave it, on the Account page or with “Privacy choices” at the bottom of every page.

How to use your rights

You can see, download, correct and delete most of your data yourself on the Account page. For anything else, email privacy@beastprop.com or write to the address above. We may ask you to confirm who you are, for example by replying from the email address of your account. We answer within one month, and within 30 days under the PDPA. If a request is complex we may extend this as the law allows and will tell you why. Requests are free unless they are clearly unfounded or excessive.

You also have the right to complain to a data protection authority: in the EU, the authority of the country where you live or work or where the issue happened; in the UK, the Information Commissioner's Office (ICO); in Thailand, the Office of the Personal Data Protection Committee (PDPC); in Japan, the Personal Information Protection Commission (PPC). We would welcome the chance to resolve your concern first.

How we protect your data

We keep personal data to a minimum, encrypt it in transit, store account data with providers that encrypt it at rest, and use row-level security so that each user can reach only their own records. Only the people who need it can access the database, with strong authentication. We store no passwords (sign-in uses email links or Google) and no card numbers. If a personal-data breach happens, we notify the competent authorities within 72 hours where the law requires, and the people affected without undue delay where the risk to them is high.

For users in Japan: these are our security control measures under the APPI. We handle personal data in Thailand and in the countries of the providers listed above, and we take the personal-data rules of those countries into account.

Children

BeastProp is for adults. It is not meant for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has given us personal data, contact us and we will delete it. The number of children you may enter in household settings is information about your own household, not data collected from the children.

Cookies, local storage and your privacy choices

We use no advertising cookies. We store a small amount of data in your browser, in these groups:

• Strictly necessary, always on: your sign-in session (set by Supabase when you sign in), your privacy choices and security measures. These do not need consent.
• Settings you choose, always on and kept only on your device: language, currency, units, theme, nationality, your choice about YouTube preview images, filters, saved homes, recent places, saved searches and, when you are not signed in, household settings. They make the features you ask for work and are not sent to us.
• Analytics and journey, only with your consent: a random identifier and the pages and features you use, so we can see how people move through BeastProp and where they leave it. Off until you choose “Accept” in the privacy banner.
• The privacy banner gives “Accept” and “Reject” equal weight. Rejecting has no downside for you. You can change your choice at any time with “Privacy choices” at the bottom of every page. We remember your choice for 6 months and then ask again.

Emails

We send the service emails you need: sign-in links, the alerts you set up and booking updates. We send marketing emails (news, tips and offers) only if you opt in, and you can unsubscribe in any of them or in your account. We never give your email address to partners or sponsors for their marketing.

If you are a partner, provider or viewer

If you list with BeastProp, claim a directory entry or apply as a viewer, we process your name, business details, contact details, licence or register numbers, the listings and profile you publish, your plan and billing details, and your messages with us, to perform our contract with you (GDPR Art. 6(1)(b); PDPA section 24(3)) and to meet legal and tax obligations. Your published profile is visible to all users. If you list a home for sale, the section “If you list a home for sale” also applies.

For viewers we also check identity once before activation, and process job, payout and tax data and, during a job only, location data to confirm arrival. We keep the ID check only as a passed or failed record with its date, and delete copies of identity documents within 30 days of the check. More detail is in the Partner Terms.

Changes

If we change this notice, we update the date at the top. For important changes, we tell signed-in users by email or on the site before they apply, and where a change needs your consent, we ask for it.