Privacy Policy
Last Updated: July 17, 2026
Your privacy matters. Learn how OTTOdash collects, uses, shares, and protects your personal data in compliance with Thailand's PDPA.
PDPA Compliant
This policy is written to comply with Thailand's Personal Data Protection Act B.E. 2562 (2019)
1. Introduction
OTTOdash ("we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our vehicle management platform at ottodash.app and its related services (the "Service").
This policy is written to comply with Thailand's Personal Data Protection Act B.E. 2562 (2019) (the "PDPA"). It applies to everyone who uses OTTOdash, including personal drivers, collectors, and dealers who use our separate DealerDash portal.
For the purposes of the PDPA, OTTOdash is the data controller responsible for your personal data. If you do not agree with this policy, please do not use the Service.
Contact for privacy matters: [email protected].
2. Personal Data We Collect
We collect the following categories of personal data:
Account Information: • Email address (required to create an account) • Full name • Phone number (optional) • Profile photo (optional) • Preferred language and app mode (Personal or Collector)
Vehicle Data: • Vehicle registration number • Vehicle Identification Number (VIN) / chassis number • Engine number • Make, model, year, and variant • License plate and province • Vehicle photos and gallery images you upload • Registration book and document scans you upload
Documents & Expiry Data: • Vehicle tax expiry dates • Compulsory Motor Insurance (CMI / พ.ร.บ.) expiry dates • Voluntary insurance details • Driver's license information and expiry
Usage & Cost Data: • Fuel consumption records and costs • Maintenance costs and service history • Expense records you enter
Accident Reports (when you create one): • Accident date, time, and location description • Precise GPS location, but only when you tap to capture it • Photos of damage and the scene • Third-party information you enter (names, contacts, vehicle details) • Witness information • Police report numbers • Insurance claim details
Payment & Subscription Data: • Your subscription plan, tier, billing period, and status • Identifiers assigned by our payment processor, such as customer and subscription IDs • For dealers, organization and credit-ledger records tied to your DealerDash account • Card and payment details are entered directly on the payment processor's hosted page and are never stored on OTTOdash servers
Technical & Analytics Data: • Device type and operating system • Browser type and version • IP address • Feature usage patterns and preferences • Product and usage analytics events (for example, sign-up, login, vehicle added, search, and checkout), recorded in our own systems and through third-party analytics providers • Error and diagnostic logs used to troubleshoot problems
3. How We Use Your Personal Data
We use your personal data for the following purposes:
Service Delivery: • Create and maintain your OTTOdash account • Track and manage your vehicle information • Send expiry reminders for tax, insurance, and licenses • Generate maintenance schedules and alerts • Create and store accident reports
Payments & Subscriptions: • Process subscription payments and renewals through our payment processor • Manage plan changes, credits, and billing for Personal, Collector, and dealer plans • Detect and prevent payment fraud
Service Improvement: • Analyze usage patterns to improve features • Develop new functionality based on user needs • Diagnose bugs and technical issues through error monitoring • Optimize performance and reliability
Communication: • Send service-related notifications • Respond to support enquiries, including through LINE or WhatsApp when you choose to contact us there • Provide important updates about your account • Send marketing communications (only with your consent)
Legal Compliance: • Comply with applicable laws and regulations • Respond to lawful requests from authorities • Establish, exercise, or defend legal claims
4. Legal Bases for Processing
Under the PDPA, we rely on the following legal bases to process your personal data:
Contractual Necessity: • Providing the Service you have requested • Managing your account and vehicle data • Processing subscription payments and delivering paid features • Sending expiry reminders and service alerts
Consent: • Marketing communications and promotional offers • Optional features that require additional data • Non-essential analytics and diagnostic cookies
Legitimate Interests: • Improving our Service and user experience • Preventing fraud and keeping the Service secure • Monitoring errors and performance
Legal Obligation: • Complying with Thai laws and regulations, including tax and accounting record-keeping • Responding to court orders or lawful requests
Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect processing carried out before the withdrawal.
5. How We Share Your Data (Processors & Third Parties)
We do not sell your personal data. We share it only as described below.
Service Providers (Data Processors): We rely on trusted providers to run the Service. They process personal data on our behalf, under contract, and only as needed: • Cloud infrastructure, database, and content-delivery providers - hosting, database, authentication, file and photo storage, content delivery, DNS, DDoS protection, and bot detection • A PCI-DSS-certified payment processor - payment and subscription processing (card details are entered on the processor's hosted page and are never stored on OTTOdash servers) • Email delivery providers - sending account, security, service-notification, and reminder emails (for example account verification, password reset, and tax and insurance expiry reminders, and, where you have opted in, product and marketing updates) • Error-monitoring services - application error monitoring and diagnostic session replay (text is masked and media is blocked) • Analytics providers - product and usage analytics
Contact Platforms: • When you tap a LINE or WhatsApp link to contact a dealer, you are taken to that platform, which then processes your conversation under its own privacy policy • We operate an official LINE account (@ottodash) as a support channel. LINE is provided by LY Corporation, based in Japan, so messages you send us there are processed on servers outside Thailand under LINE's own privacy policy. When you message us, we retain the conversation history and may apply internal labels (such as whether you are writing as a vehicle owner or a dealer, and the topic) so our team can route and answer you. Please do not send passwords or payment card details over LINE
Third Parties (Only with Your Consent or at Your Request): • Insurance companies (for claims you choose to pursue) • Repair shops (for service coordination you request)
Legal Requirements: • Government authorities, courts, or law enforcement when required by law or to protect our rights
We Do NOT: • Sell your personal data to third parties • Share your data for third-party advertising • Give unauthorized parties access to your vehicle data
6. Data Security
We apply appropriate technical and organizational measures to protect your personal data:
Technical Measures: • Encryption of data in transit (HTTPS/TLS) • Encryption of data at rest on our hosting infrastructure • Secure authentication with hashed passwords • Row-level security policies that isolate each user's data • Regular security review and vulnerability assessment
Organizational Measures: • Access to personal data limited to a need-to-know basis • Confidentiality obligations for anyone with access • Incident response procedures • Regular review of our security practices
No method of transmission or storage is completely secure. While we cannot guarantee absolute security, we commit to addressing any personal data breach promptly and in accordance with the PDPA.
7. Data Retention
We keep your personal data only for as long as necessary for the purposes described in this policy:
Account Data: • Kept while your account is active • Deleted within 90 days of a verified account-deletion request, unless we must keep it longer by law
Vehicle Data: • Kept while the vehicle is in your account • Deleted when you remove the vehicle or delete your account
Payment & Transaction Records: • Kept for the period required by Thai tax and accounting law
Accident Reports: • Kept for the period needed to support related insurance or legal claims
Technical & Analytics Data: • Error logs kept for a limited troubleshooting period • Analytics data kept according to our analytics providers' retention settings
You may request deletion of your data at any time, subject to the retention periods the law requires us to observe.
8. Your Rights Under the PDPA
Under Thailand's Personal Data Protection Act B.E. 2562 (2019), you have the following rights:
Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete personal data.
Right to Erasure: Request deletion of your personal data when it is no longer necessary, you withdraw consent, or it was unlawfully processed.
Right to Data Portability: Request your data in a structured, commonly used, machine-readable format and have it transferred where technically feasible.
Right to Object: Object to processing for direct marketing or processing based on legitimate interests.
Right to Restrict Processing: Request temporary restriction of processing in certain circumstances.
Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting processing done before withdrawal.
How to Exercise Your Rights: • Through your Account Settings in the app, or • By emailing [email protected] • We will respond within the timeframe required by the PDPA
You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) if you believe your rights have been infringed.
10. Children's Privacy
OTTOdash is not intended for individuals under the age of 20 (the age of majority for contractual purposes in Thailand) without the consent of a parent or legal guardian.
We do not knowingly collect personal data from a child under 20 without verifiable parental consent. If we learn that we have done so without proper consent, we will take steps to delete that data promptly.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].
11. International Data Transfers
Some of our service providers operate internationally, including in the United States and Japan, so your personal data may be transferred to or processed in countries outside Thailand.
Where data is transferred internationally, we take steps to ensure it remains protected, including: • Choosing providers with recognized security and data-protection practices • Relying on appropriate contractual safeguards with those providers
By using OTTOdash, you acknowledge that your data may be processed outside Thailand as described in this section, in accordance with the PDPA.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or operations.
When we make significant changes: • We will update the "Last Updated" date at the top of this policy • We will notify you by email or in-app notification where appropriate • We may ask you to review and accept the updated policy
We encourage you to review this policy periodically. Continued use of OTTOdash after changes take effect means you accept the updated policy.
13. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:
Data Controller: Ottodash Co., Ltd. (juristic person registration no. 0105569063942) 2 Soi Phueng Mi 7/2, Sukhumvit 93 Road, Bang Chak, Phra Khanong, Bangkok 10260, Thailand
Privacy Contact: Email: [email protected]
We aim to respond to all privacy requests within the timeframe required by the PDPA.
You may also contact the supervisory authority: Personal Data Protection Committee (PDPC) Website: www.pdpc.or.th
Questions about your data?