Effective date: 26 September 2026
Version: 1.0
1. Who processes your data
The controller of personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) is:
PHUKET 24 ONLINE CO., LTD.
Tax ID: 0835561011742
96/7 Moo 7, Soi Saiyuan, Rawai, Phuket 83130, Thailand
Privacy email: privacy@rentcar24.online
In this Privacy Policy, PHUKET 24 ONLINE CO., LTD. is also referred to as “RC24”, “we”, “us” or “the Company”.
The email above is our contact channel for personal data matters. It does not mean that the Company has appointed a separate Data Protection Officer where such an appointment is not required by Thai law.
2. Scope of this Policy
This Policy applies when you visit the RentCar24 website, browse the vehicle catalogue or other pages, submit or review a rental request, contact us by phone, email, WhatsApp, Telegram, Facebook Messenger or another listed channel, use cookies or analytics, or interact with tools that protect the website from spam, fraud and automated requests.
This Policy applies to information about natural persons. It does not apply to information about a legal entity unless that information can identify a particular individual.
3. Personal data we process
3.1 Data you provide in a rental request
We may process your name, phone number, email address, WhatsApp number, Telegram username or phone number, preferred contact method, selected vehicle, requested rental dates and duration, pickup or delivery location, selected promotion, request message, notes and additional requirements, changes made while reviewing the request, communication language, and the history of the request and related communications.
We do not rely on consent where this processing is necessary to answer your request, prepare a rental, agree its terms or perform a contract.
Required fields are marked in the form. If you do not provide your name, a contact method or the essential rental details, we will not be able to accept and process the request.
3.2 Data generated when you use the website
Our servers and website software may automatically receive your IP address, request date and time, requested URL, server response status, referring page or traffic source, browser type and version, device type, operating system, language settings, technical identifiers, and information about errors and security events.
We use this data to provide the website, diagnose errors, prevent abuse and maintain security.
3.3 Data received through communication services
If you contact us through WhatsApp, Telegram, Facebook Messenger, email or by phone, we may receive the contact details, profile name, message content and other information that you voluntarily provide.
The communication service you choose processes data under its own privacy policy. Please do not send information through such services unless it is necessary to discuss your rental.
3.4 Sensitive personal data
The website request form is not intended to collect health, biometric or genetic data, religious or political beliefs, criminal records, or other sensitive personal data described in Section 26 of the Thai PDPA.
Please do not enter such information in free-text fields. If sensitive data must be processed in an exceptional case, we will identify an appropriate legal basis and provide any additional notice required by law.
4. Purposes and legal bases
4.1 Website operation
We process technical data to deliver pages and content, select the website language, maintain stability, diagnose errors and protect our infrastructure. The legal basis is the Company's legitimate interest in providing a functional and secure website under Section 24(5) of the Thai PDPA.
4.2 Rental requests and rental arrangements
We process request data to prepare an offer, clarify the vehicle, dates, price and handover location, contact the customer, prepare and perform a rental agreement, and support the request. The legal basis is taking steps at the customer's request before entering into a contract and performing a contract under Section 24(3) of the Thai PDPA.
4.3 Security and abuse prevention
We process technical data to detect automated requests, protect forms from spam, prevent fraud, investigate incidents and protect users and information systems. The legal basis is the Company's legitimate interest under Section 24(5) of the Thai PDPA.
4.4 Analytics and effectiveness measurement
With your prior consent, we may count visits, identify traffic sources, analyse page views, assess website performance and measure the effectiveness of promotion and campaigns. The legal basis is consent under Section 19 of the Thai PDPA.
Analytics consent is voluntary. Refusing consent does not restrict browsing the website, submitting a rental request or contacting the Company.
4.5 Legal obligations and legal claims
We may process data to comply with Thai law, respond to public authorities, maintain required records, and establish, exercise or defend legal claims. The legal bases are compliance with a legal obligation under Section 24(6) of the Thai PDPA and the Company's legitimate interest in protecting its rights under Section 24(5).
5. Cookies
5.1 rc24_locale
This cookie stores the selected website language for up to one year. It is necessary to provide the website with the user's chosen settings and is not used for analytics tracking.
5.2 rc24_cookie_consent
This cookie stores whether the user allowed or rejected analytics cookies for up to one year. It is necessary to remember the user's decision and is not used to analyse behaviour.
5.3 Analytics cookies
Analytics services and their cookies are loaded only after you allow them in the cookie notice. If you reject them, analytics modules are not loaded.
You can change your decision through “Cookie settings” in the website footer. If you withdraw a previous permission, the page reloads and further analytics collection stops. Withdrawal does not affect the lawfulness of processing performed before the withdrawal.
6. Analytics services
Depending on the current website settings, we may use one or more of the services described below. If a service is disabled, its script is not loaded by the website.
6.1 Yandex Metrica
Yandex Metrica may be used to count visits, identify traffic sources and understand page-view sequences. Our integration disables Webvisor, recording of form-field activity, click maps, automatic outbound-link tracking and ecommerce features.
Yandex Privacy Policy: https://yandex.com/legal/confidential/
6.2 Google Analytics 4
Google Analytics 4 may be used for visit and page-view statistics. The page URL, page title and referrer are sent. Google Signals is disabled in our integration.
Google Analytics data information: https://support.google.com/analytics/answer/6004245
6.3 Meta Pixel
Meta Pixel may be used to record page views and measure campaign effectiveness. Automatic event configuration is disabled in our integration.
Meta Privacy Policy: https://www.facebook.com/privacy/policy/
6.4 TikTok Pixel
TikTok Pixel may be used to record a website visit and measure campaign effectiveness. Advanced Matching is disabled in our integration. We do not send names, phone numbers or email addresses to TikTok through Advanced Matching.
TikTok Pixel information: https://ads.tiktok.com/resources/help/article/tiktok-pixel
Analytics services may receive the page URL and title, referrer, event time, cookie identifiers, IP address, approximate location, and browser, device and operating-system information.
We do not intentionally send analytics services your name, phone number, email address, request content or form-field values. Analytics identifiers are pseudonymous and are not guaranteed to be anonymous personal data.
7. Google reCAPTCHA form protection
When Google reCAPTCHA is enabled, it runs when a rental request is submitted or confirmed to protect the website from spam, fraud and automated requests.
reCAPTCHA may process an IP address, browser and device parameters, technical interaction signals, the _GRECAPTCHA cookie, verification time and a single-use token. The token is used to verify the request and has a limited validity period.
The reCAPTCHA result is used only to assess whether a request is legitimate. It is not used to decide whether to enter into a rental agreement. If the form rejects a legitimate request, you can contact us by phone, email or a listed messenger.
Google states that, from 2 April 2026, it acts as a processor for reCAPTCHA Customer Data and that the necessary _GRECAPTCHA cookie is used for risk analysis and abuse prevention. Google reCAPTCHA documentation: https://docs.cloud.google.com/recaptcha/docs/faq
8. Recipients of personal data
Access to personal data may be provided, only to the extent necessary, to authorised RC24 employees and contractors; hosting, database, backup and technical-support providers; email and internal-notification providers; Google when reCAPTCHA is used; analytics providers after the user has consented; WhatsApp, Telegram, Meta or another communication service selected by the user; accountants, auditors and legal advisers where necessary; and public authorities, police, courts or other recipients where disclosure is required by Thai law.
We do not sell personal data.
Service providers processing data on our behalf must use it only for the agreed purposes and apply appropriate safeguards.
9. Transfers outside Thailand
Google, Meta, TikTok, Yandex, communication services and some technical-infrastructure providers may process personal data outside Thailand.
Before enabling such a provider, we must identify a permitted transfer mechanism under Sections 28 and 29 of the Thai PDPA, such as an adequate level of protection, contractual or other appropriate safeguards, or an applicable legal exception.
If consent is required for a particular transfer because the destination does not provide adequate protection, we will request separate informed consent after explaining the relevant risks.
10. Retention periods
Rental-request data, its processing history and related communications are retained for up to 60 months after the last activity on the request or the end of the relationship.
Documents required for accounting, tax or other mandatory records are retained for the period required by Thai law.
Technical website logs are ordinarily retained for up to 90 days unless longer retention is necessary to investigate an incident or establish, exercise or defend a legal claim.
The rc24_locale and rc24_cookie_consent cookies are retained for up to one year.
A reCAPTCHA token is retained only for the time necessary to perform its single-use verification.
Analytics data is retained for the period configured in the relevant analytics account and described by the provider's policy.
Withdrawing consent stops future analytics processing but does not necessarily delete data lawfully collected before the withdrawal. You may separately request deletion where the conditions of the Thai PDPA are met.
When a retention period expires, personal data is deleted, destroyed or irreversibly anonymised unless further retention is required by law or for legal claims.
11. Your rights
Subject to the conditions of the Thai PDPA, you may have the right to withdraw consent; obtain confirmation that your data is processed; access your data and receive a copy; learn the source of data obtained without your consent; receive data in a portable format where provided by law; object to certain processing; request correction of inaccurate or incomplete data; request deletion, destruction or irreversible anonymisation; request restriction or suspension of processing; and lodge a complaint with Thailand's Office of the Personal Data Protection Commission.
To exercise a right, email privacy@rentcar24.online. Include your name, contact details, the nature of your request and information that allows us to locate the relevant rental request.
To protect personal data, we may request reasonable proof of identity or a representative's authority. We will not request more information than is necessary for verification.
An access or copy request will be handled without undue delay and, where there is no lawful ground for refusal, within 30 days after we receive a complete request.
Some rights are not absolute. We may refuse a request where permitted by law or a court order, or where fulfilling it would adversely affect another person's rights and freedoms. Where the law permits, we will explain the reason for refusal.
12. Security
We apply organisational and technical measures designed to protect personal data against unlawful access, use, alteration, loss, destruction or disclosure.
Access is limited to people who need it for their work. Security measures are reviewed in light of risks and changes in technology.
If a personal data breach occurs, we assess the risk. Where Section 37 of the Thai PDPA requires it, we notify the PDPC without undue delay and, where feasible, within 72 hours after becoming aware of the breach. If the breach is likely to create a high risk, we also notify affected individuals and explain available remedial measures.
13. Data relating to minors
The website and vehicle-rental services are not intended for people who cannot independently enter into the relevant contract.
We do not knowingly collect a minor's data on the basis of the minor's independent consent where Section 20 of the Thai PDPA requires consent from a parent, legal representative or guardian.
If you believe that a minor has provided data without the required authority, contact privacy@rentcar24.online.
14. Third-party websites and services
The website may contain links to external websites, maps, social networks and messengers. After you follow such a link, data processing is determined by the operator of the relevant service.
We do not control the content or privacy practices of third-party services.
15. Changes to this Policy
We may update this Policy when the website, providers, processing purposes or Thai law changes.
The current version is published on this page with its effective date. If a change materially affects consent previously given, we will request new consent where required by law.
16. Questions and complaints
You may first send a question or request to privacy@rentcar24.online.
If you believe that your rights have been infringed, you may lodge a complaint with Thailand's Office of the Personal Data Protection Commission. Official PDPC information and services: https://gppc.pdpc.or.th/