Privacy Policy & Regulatory Compliance
Last Updated: August 2026 • Dual Sovereign Framework: EU Regulation 2016/679 (GDPR) & Thailand Personal Data Protection Act B.E. 2562 (PDPA).
1. Overview & Data Controller
Masar CRM Technologies AB ("we", "us") acts as Data Controller for customer account data and Data Processor for customer leads processed through integrated messaging channels (Instagram Direct, WhatsApp, TikTok).
2. Categories of Personal Data Collected
- Account Data: Name, Corporate Email Address, Company Name, Role, Selected Subscription Plan.
- Lead Contact Data: Phone Numbers, Messenger Handles, Conversation Histories, Lead Deal Values.
- Technical Logs: IP Addresses, Session Identifiers, API Authorization Tokens.
3. Legal Grounds for Data Processing
We process personal data based on: (a) Performance of a Contract under Article 6(1)(b) GDPR, (b) Compliance with legal and accounting obligations under Article 6(1)(c) GDPR, and (c) Legitimate Interests under Article 6(1)(f) GDPR.
4. Data Subject Rights Under GDPR
Under EU GDPR law, you and your end-customers maintain full rights to:
Request a full transcript copy of all stored personal data.
Request immediate deletion ("Right to be Forgotten").
Update or amend incorrect contact details instantly.
Export pipeline lead datasets in structured JSON format.
5. European Data Residency & Security
All customer database instances, message logs, and backup archives are hosted strictly within European Union data centers (Stockholm, Sweden / Frankfurt, Germany) with AES-256 encryption at rest and TLS 1.3 in transit.
6. Data Protection Officer (DPO) Contact
To exercise your GDPR privacy rights or inquire about security practices, contact our Data Protection Officer at dpo@masarcrm.com or support@masarcrm.com.
7. Thailand PDPA & Southeast Asia Data Protection
Masar CRM operates in full compliance with the Thailand Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), protecting the personal data rights of foreign property buyers, domestic investors, and real estate developers across Thailand.
Explicit, verifiable customer consent mechanisms are enforced for foreign property buyers and Thai certified broker networks (Phuket, Bangkok, Pattaya). Prospective buyers retain full control over inquiries, marketing consent, and passport/KYC document processing without bundled conditions.
Secure lead data synchronization between Thailand master developers and international broker desks operates strictly under PDPA Standard Contractual Clauses (SCCs). Transmission channels utilize AES-256 and TLS 1.3 encryption to maintain data subject safeguards internationally.
Thai citizens and foreign buyers possess statutory rights to access personal records, request data portability (Sec. 31), object to processing (Sec. 32), and execute immediate erasure ("Right to be Forgotten", Sec. 33) across all CRM databases and communication logs.
Comprehensive audit logs document the classification of personal data, storage timelines, access logs, and designated Data Protection Officer contacts in compliance with Thailand Personal Data Protection Commission (PDPC) standards.
8. Thai Real Estate Broker Certification & Escrow Transparency
To ensure transparency and compliance across cross-border real estate transactions in Thailand, Masar CRM embeds statutory real estate standards:
Full alignment with Thai Real Estate Broker Association (TREBA) professional standards. Certified broker licensing numbers, agency credentials, and transparent commission agreements are validated across Phuket, Bangkok, and Pattaya broker channels.
Real-time foreign ownership tracking pursuant to the Thailand Condominium Act B.E. 2522 (1979). Project ledgers continuously track and enforce the statutory 49% foreign freehold quota across residential condominium developments.
Strict adherence to Thailand Anti-Money Laundering Office (AMLO) regulations. All international escrow deposits, property booking fees, and Foreign Exchange Transaction (FET / Tor Tor 3) documentation are logged with tamper-evident audit trails.