The Personal Data Protection Act B.E. 2562 (the "Law") aims to protect the privacy rights of data subjects. The collection, use, or disclosure of personal data must comply with the conditions and methods prescribed by Law. To ensure that the processing of personal data through the activities of [Pending registration — legal entity name] (the "Company", "we"), operator of the Maibit Platform, complies with the Law, the Company has prepared this Privacy Policy (the "Policy") so that you, as a data subject, are informed of and aware of the importance of protecting your personal data.

1. Definitions

"Personal Data" means information about an identifiable natural person, whether directly or indirectly, such as name, age, gender, date of birth, national ID number, phone number, email, or photo, but excluding data of deceased persons.

"Sensitive Personal Data" means personal data concerning race, ethnicity, political opinions, beliefs, religion, sexual behavior, criminal records, health data, disability, genetic data, biometric data, or other data prescribed by Law (e.g. religion that may appear on a copy of a national ID card).

"Processing" means the collection, use, disclosure, or any action taken on personal data, including transfer, destruction, or deletion.

"Data Subject" or "you" means the natural person whose personal data the Company processes under this Policy.

2. Collection of Personal Data

The Company collects your personal data only for lawful purposes and within its legal authority, through channels including:

• Registration via email or phone number
• Registration or login via Google or Facebook accounts
• Identity verification (KYC) through uploaded official documents
• Information you enter in Chat, Listings, or Orders
• Technical data collected automatically when you use the Platform

Where personal data is collected from other sources, the Company will notify you and act in accordance with the Law within 30 days of collection.

3. Types of Personal Data

• Identity data: photo, full name, age, date of birth
• Contact data: address, phone number, email
• Account data: user account, usage history, reviews
• Verification evidence: national ID card, official documents for KYC
• Transaction & financial data: purchase history, top-ups, withdrawals, bank account details for withdrawal
• Technical data: IP address, Cookie ID, activity log
• Other data: messages in Chat, dispute evidence, feedback

4. Purposes of Processing

• To create and manage user accounts
• To carry out sales, payments, and the escrow system
• For identity verification (KYC) and withdrawals
• To resolve disputes and provide after-sales service
• To prevent fraud, money laundering, and breaches of the Terms
• To prevent the exchange of contact details or off-platform transactions
• To comply with the Terms of Service and the law
• To analyze and improve Platform performance
• For marketing and communications (with consent)

5. Legal Bases for Processing

The Company processes your personal data on the following legal bases:

• Contract: to perform the service agreement, e.g. creating an account, processing transactions
• Legitimate interest: e.g. fraud prevention, security, service improvement
• Legal obligation: e.g. identity verification, retaining transaction records as required by law
• Consent: e.g. marketing, promotional communications, analytics cookies

6. Consent & Minors

Where no other legal basis applies, the Company will always seek your consent before or at the time of collection. You may withdraw consent at any time.

The Company does not intend to collect data from minors without guardian consent:

• Minors aged 10 but under 20 years require consent from a person exercising parental authority
• For minors under 10, a person exercising parental authority must act on their behalf

If the Company learns that data from a minor was collected without consent, it will delete or destroy the data immediately.

7. Processing for Marketing

The Company may process personal data for advertising and marketing through channels such as Google, Facebook, LINE, or other analytics tools, only with your consent.

If you do not wish to receive marketing communications, you may opt out at any time via the "Unsubscribe" link in emails or through account settings. Withdrawal of consent does not affect processing already lawfully carried out.

8. Disclosure & Transfer of Data

The Company discloses your personal data only for the purposes collected or within its legal authority, and may disclose to:

• Payment gateway providers, to process top-ups and withdrawals
• Server and infrastructure providers (e.g. cloud providers)
• Analytics and marketing service providers
• Government authorities or where required by law
• Counterparties in a dispute, only data necessary for resolution

The Company ensures third-party processors maintain data protection standards as required by Law. Where data is transferred abroad, the Company will act in accordance with the standards prescribed by Law.

9. Data Retention Period

The Company retains your personal data throughout your use of the service and as long as necessary to fulfill the stated purposes or as required by law (e.g. financial transaction data that must be retained by law).

When you close your account, the Company retains only data necessary under the law and deletes or destroys unnecessary data.

10. Rights of Data Subjects

You have the following legal rights regarding your personal data:

Processing time is counted from when the Company receives complete documents. You may exercise these rights via the Help Center. The Company may refuse a request where it has lawful authority to continue processing, recording the reason.

11. Cookies

The Company uses cookies and similar technologies to support website functionality, enhance security, analyze usage, and improve your experience.

Cookies necessary for website functionality are used without consent; analytics and marketing cookies are used with your consent. You may change or withdraw consent at any time through cookie settings.

12. Security Measures

The Company maintains appropriate security measures — administrative, technical, and physical — to prevent loss, unauthorized access, use, alteration, modification, or disclosure of data, covering confidentiality, integrity, and availability.

KYC verification documents are stored in private storage and accessible only by authorized staff.

13. Data Breach Notification

In the event of a personal data breach, the Company will notify the Personal Data Protection Committee Office within 72 hours of becoming aware, where feasible. Where the breach poses a high risk to your rights and freedoms, the Company will notify you without delay, along with remedial guidance.

14. Changes to This Policy

The Company may amend this Policy from time to time, announced via the Platform. Continued use after changes constitutes acknowledgment of the revised Policy. This Policy takes effect from 1 September 2026.

15. Contact Details

Data Controller / Data Protection Officer (DPO):

Company: [Pending registration — legal entity name]
Address: [Pending registration — registered address]
Email: privacy@maibit.com
or via the Help Center.