1. Scope of this policy
This policy covers personal data we collect through the Site, through our contact and service request forms, through email and messaging apps when you write to us, and through our newsletter.
It does not cover how our Partners handle your data once you engage them directly. Each Partner is an independent data controller for its own processing and has its own privacy policy. We will tell you who a Partner is before sharing anything with them, and we encourage you to read their policy.
2. Who is responsible for your data
Naskio Limited is the data controller for the personal data described in this policy.
- Company: Naskio Limited
- Incorporation: Hong Kong, Certificate of Incorporation No. 80333049
- Business Registration No.: 80333049-000-05-26-8
- Registered office: Unit B, 11/F, Yam Tze Commercial Building, 23 Thomson Road, Wan Chai, Hong Kong
- Privacy contact: contact@expats-thailand.com
3. What personal data we collect
Information you give us directly. When you fill in a form, email us or message us, we collect what you choose to tell us. Depending on the request, this typically includes:
- Identity and contact details: name, email address, phone number, messaging handle, nationality, and country of residence.
- Situation details relevant to your request: your intended city, your timeline, your budget range, your family situation (including whether children are relocating with you and their ages, where relevant to schooling or insurance), your professional situation, and your current or intended visa type.
- Correspondence: the content of the messages you exchange with us.
- For chargeable services: billing details such as your billing name and address, and the reference of the payment you made. We do not store full card numbers: payments, where applicable, are handled by the payment provider.
Guide waitlists and newsletter. When you sign up to be notified about a guide or to receive our newsletter, we collect your email address, the guide or list you chose, the page you signed up from, your language, and the date and version of the consent you gave.
Information collected automatically. When you browse the Site, our hosting provider automatically records technical data in server logs, including your IP address, browser type and version, device type, the pages you viewed, and the date and time of your visit. This is standard infrastructure logging, used to keep the Site running and secure.
Information from third parties. Occasionally a Partner may tell us that a request we referred has progressed or concluded, so that we can follow up with you appropriately. We do not receive detailed files from Partners about you.
4. Sensitive data
Some requests naturally touch on sensitive information. Health information is the main case: an insurer needs to know about pre-existing conditions in order to quote accurately, and that information may need to reach them so that the quote you receive genuinely reflects your situation.
We do not ask for sensitive data unless it is genuinely necessary for the request you have made. Where you provide it, we use it solely for that request, share it only with the specific Partner concerned, with your agreement, and delete it once it is no longer needed. If you would rather share health details directly with the insurer and not with us, tell us: we can arrange the introduction and step back.
5. Why we process your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and assessing your situation | Performance of a contract, or steps taken at your request prior to entering into one |
| Introducing you to a relevant Partner and sharing the information they need to respond | Performance of a contract; consent where sensitive data is involved |
| Delivering and administering a chargeable service, including billing | Performance of a contract |
| Sending you the newsletter | Consent, withdrawable at any time |
| Notifying you when a guide you signed up for is released, and measuring interest in upcoming guides | Consent, withdrawable at any time |
| Following up on an ongoing request, and contacting you about it | Legitimate interest in providing the service you asked for |
| Keeping the Site secure and operational, diagnosing technical faults | Legitimate interest in the security and integrity of our systems |
| Improving our content and services based on the questions we receive | Legitimate interest in improving what we offer |
| Keeping accounting and tax records | Legal obligation under Hong Kong law |
| Establishing, exercising or defending a legal claim | Legitimate interest, or legal obligation |
Where we rely on legitimate interest, we have considered whether that interest is outweighed by your rights, and we have concluded it is not. You can object to processing based on legitimate interest (see Section 11).
6. Who we share your data with
We do not sell your personal data, and we do not share it for third-party advertising.
- Partners, where relevant to a request you have actually made. We share only what is necessary for them to respond: for example, we would not send your budget to an insurer, or your health details to a landlord. We tell you who we are introducing you to before we do it.
- Service providers acting on our instructions: Vercel, which hosts the Site; Resend, which sends the emails generated by our forms; Google (Google Sheets), where form submissions and sign-ups are recorded; and Microsoft 365, which we use to correspond with you. These providers process data on our behalf, under their own security and data protection commitments.
- Professional advisers, such as accountants or lawyers, where necessary and under a duty of confidentiality.
- Authorities or regulators, where we are legally required to disclose, or where disclosure is necessary to establish or defend a legal claim.
- A successor, if our business or part of it is transferred, in which case this policy continues to apply to the data transferred.
7. International data transfers
We operate across borders: the company is registered in Hong Kong, and our Partners are mostly based in Thailand. Our hosting and productivity providers operate global infrastructure.
Your personal data will therefore be transferred outside your country of residence, including outside the European Economic Area, and to countries whose data protection laws may differ from those where you live. Where we transfer data, we rely on appropriate safeguards in line with applicable law, including the standard contractual protections offered by our providers, and we limit transfers to what is necessary for the purposes set out in this policy.
8. Cookies and similar technologies
We currently use only strictly necessary cookies. These are needed for the Site to work and are not used to track you:
| Type | Purpose | Duration |
|---|---|---|
| Language preference | Remembers whether you are browsing in English or French | Persistent, until cleared |
| Session and security | Keeps your session functioning and protects against common web attacks | Session, or short-lived |
We do not currently use analytics cookies, advertising cookies, social media tracking pixels, or any third-party tracking technology. No non-essential cookie is placed on your device.
You can block or delete cookies through your browser settings. Blocking strictly necessary cookies may cause parts of the Site to stop working correctly.
If we introduce analytics or any other non-essential cookies in future, we will update this section and put a consent mechanism in place before those cookies are set.
9. How long we keep your data
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a service | Up to 24 months after our last exchange, then deleted |
| Records relating to a chargeable service (contract, invoices, related correspondence) | 7 years, in line with Hong Kong record-keeping requirements under the Inland Revenue Ordinance and the Companies Ordinance |
| Sensitive data shared for a specific request | Deleted once the request is concluded |
| Newsletter subscriber data | Until you unsubscribe, then removed from the mailing list |
| Guide waitlist sign-ups | Until the guide is released and you have been notified, or until you ask us to remove you. If a guide is not released, deleted after 24 months. |
| Server logs | Retained for a short period by our hosting provider for security and diagnostic purposes |
If you ask us to delete your data sooner, we will do so, except where we are legally required to keep it, in which case we will tell you what we are keeping and why.
10. Data security
We take reasonable technical and organisational measures to protect your data:
- The Site is served entirely over encrypted connections (HTTPS).
- Access to enquiry and client data is limited to the team members who need it to do their work.
- Our email and document tools are protected by multi-factor authentication.
- We rely on our hosting provider's infrastructure security, including its protections against common attacks.
- We share with Partners only what is necessary, rather than forwarding entire files.
No system is completely secure, and we cannot guarantee absolute security. If a data breach occurs that is likely to affect your rights, we will notify you and the relevant authority where required to do so.
11. Your rights
We extend the same set of rights to everyone who uses our services, wherever you live, rather than limiting them to residents of particular jurisdictions. You have the right to:
- Access the personal data we hold about you, and obtain a copy.
- Rectify data that is inaccurate or incomplete.
- Erase your data, where we have no overriding legal reason to retain it.
- Restrict processing in certain circumstances, for example while a dispute about accuracy is resolved.
- Object to processing based on legitimate interest, including any direct marketing.
- Portability: receive the data you gave us in a structured, commonly used format.
- Withdraw consent at any time, where processing is based on consent. This does not affect processing already carried out.
- Complain to a supervisory authority.
To exercise any of these rights, write to contact@expats-thailand.com. We will respond within 30 days. We may ask you to confirm your identity before acting, to make sure we are not disclosing your data to someone else.
If you are in the European Economic Area or the United Kingdom, these rights correspond to those under the GDPR and UK GDPR, and you may complain to your national data protection authority.
If you are in Thailand, these rights correspond to those under the Personal Data Protection Act (PDPA), and you may complain to the Office of the Personal Data Protection Committee.
12. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Recommendations are made by people, based on what you have told us.
13. Children
Our services are aimed at adults. We do not knowingly collect personal data directly from anyone under 18.
Where a family relocation request involves children, a parent or legal guardian provides the relevant details (typically first names, ages and schooling needs) on their behalf. That information is used solely for that request, shared only with the Partners concerned (for example a school or an insurer), and deleted in accordance with Section 9.
14. Third-party sites
Where the Site links to a Partner, a government page or another third-party resource, that site's own privacy policy applies to any data you provide there. We are not responsible for the data practices of sites we do not operate.
15. Changes to this policy
We may update this policy from time to time, for example if we introduce analytics, add a new category of Partner, or change providers. The "last updated" date at the top of the page reflects the most recent revision. Where a change materially affects how we use data you have already given us, we will make reasonable efforts to notify you directly.
16. How to contact us
For any question about this policy, about the data we hold on you, or to exercise your rights:
- Email: contact@expats-thailand.com
- Post: Naskio Limited, Unit B, 11/F, Yam Tze Commercial Building, 23 Thomson Road, Wan Chai, Hong Kong
17. Complaints
If you are not satisfied with how we have handled your data or your request, tell us first: we would rather fix it directly. Write to contact@expats-thailand.com and we will look into it and respond.
You also have the right to complain to a data protection authority: the Office of the Personal Data Protection Committee in Thailand, your national data protection authority in the EEA or the UK, or the Office of the Privacy Commissioner for Personal Data in Hong Kong.