Privacy Policy

1. Who we are

ScooterExpress is a motorbike and scooter rental business operating from Sukhumvit 39 in Bangkok, Thailand. We run this website and the booking system that customers use to reserve a bike, manage a booking and contact us.

In this policy, "ScooterExpress", "we", "us" and "our" mean the business operating this website. Our contact details are set out in section 14.

This policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it and the rights you have under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").

It applies to:

• people who browse the public website;
• people who create a customer account;
• people who submit a booking, including guests who book without an account;
• people who rent a motorbike from us or communicate with us about a rental;
• people who contact us by email, phone, WhatsApp, LINE or the website contact form.

If a separate legal entity operates the rental business, its details are shown in the rental agreement and invoice for your booking. We do not publish a company registration number or registered address that has not been confirmed by the business owner.

2. Information we collect

We collect information you give us, information created when you use the website or make a booking, and limited technical information recorded by our servers.

Information you give us

• Identity and contact details: first name, last name, email address and telephone number.
• Rental eligibility information: nationality, passport number, driving licence number and whether you hold an International Driving Permit (IDP), where required for the rental.
• Booking details: the motorcycle or scooter you choose, rental start and end dates, pickup and return arrangements, add-ons, the province you tell us you will ride in, and any notes you add to the booking.
• Account details: your name, email address and password if you create an email account, or your Google account name, email address and profile photo if you choose Google sign-in.
• Communications: the content of messages you send through the contact form, email, WhatsApp, LINE or another support channel, and our replies.
• Consent choices: whether you asked for a payment reminder or agreed to optional communications, and the date and time you accepted these terms.

Information created when you book

When you submit a booking, our system creates and stores:

• a booking reference and booking status;
• the bike, dates, pickup location and rental duration;
• the rental price, security deposit, any add-ons and the total amount;
• the payment method and payment status;
• whether the booking was made as a guest or by a signed-in customer;
• the version of the Terms of Service you accepted and the time you accepted it;
• operational notes added by authorised staff, such as inspection or handover notes.

Account and sign-in information

Customer accounts are managed with Supabase, our authentication and database provider. Passwords are stored as salted hashes and are never visible to our staff.

If you choose Continue with Google, Google authenticates you and returns your name, email address, profile photo and a Google account identifier. We store that identifier so the same Google account is matched to the same customer on future visits. We do not receive or store your Google password.

Payment information

We currently offer cash at pickup and, when enabled for your booking, PromptPay QR transfer. The methods actually available are shown at checkout before you confirm.

• For cash payments, we record the amount and mark the booking as paid when staff receive the cash.
• For PromptPay, we show a QR code and a payment reference. Our staff check the incoming transfer and mark the booking as paid manually. We do not receive your bank login details, card number or full bank account information.
• We do not currently process card payments on this website and do not store complete card numbers.

Technical information

Like most websites, our hosting and infrastructure providers record technical information when a request reaches the site, including:

• IP address and approximate location derived from it;
• browser type, device type and operating system;
• the pages or API routes requested and the time of the request;
• error and security logs.

We also use cookies and similar browser storage needed to keep you signed in and to remember basic preferences. Analytics are used only when configured for the site, as explained in section 6.

3. How we use your information

We use personal information for the following purposes:

• Providing a rental: checking availability, creating and confirming a booking, preparing the bike, handing it over, inspecting it on return and managing the rental agreement.
• Managing your account: creating your customer account, signing you in, keeping your booking history available and letting you manage or cancel a booking.
• Payments and accounting: calculating the price and deposit, displaying payment instructions, reconciling payments, issuing receipts and maintaining financial records.
• Customer support: answering questions, resolving booking issues, handling changes, cancellations and complaints.
• Safety and security: verifying identity and licence details at pickup, preventing fraud and misuse, protecting the website and investigating security incidents.
• Legal compliance: meeting tax, accounting, consumer protection, road traffic and law-enforcement obligations that apply to the rental.
• Service improvement: understanding how the website is used, diagnosing errors and improving the booking experience. Where analytics are enabled, we use aggregated usage information for this purpose.
• Optional communications: sending a payment reminder only if you opted in, and sending service messages about your booking. We do not add you to a marketing list without a separate, clear consent.

Under the PDPA, we rely on:

• contract performance, because we cannot provide a rental without your identity, contact and booking details;
• legal obligations, for tax, accounting and lawful requests from authorities;
• legitimate interests, for security, fraud prevention, service improvement and defending legal claims, balanced against your rights;
• consent, where we ask for it, such as an optional payment reminder or optional marketing. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Payments and financial information

Payment instructions are generated for the booking and are visible only to the customer and authorised staff.

For PromptPay, the QR code contains the business's PromptPay identifier and the amount. Your bank or payment app processes the transfer. We see the incoming payment in our bank account and the reference you used, and authorised staff mark the booking as paid. We do not have access to your bank account or banking credentials.

For cash at pickup, staff record that payment was received. We may keep a receipt or invoice linked to the booking for accounting purposes.

We do not sell payment information. We do not ask for your card PIN, one-time password, bank password or full card number by email, WhatsApp or phone. If someone claiming to be ScooterExpress asks for those details, do not provide them and contact us using the details in section 14.

5. Information sharing

We share personal information only where it is needed for the purposes described in this policy:

• Infrastructure and database providers: Supabase hosts the database, authentication and file storage used by the website. Hostinger provides hosting for the production site, and email is delivered through the email provider configured for the business.
• Google: if you use Google sign-in, Google processes the authentication. The site may also load Google Maps, Google reviews or Google Analytics when those features are enabled.
• Payment and financial providers: banks and PromptPay participants process transfers. Our staff reconcile the payment against the booking.
• Communication providers: email delivery and messaging providers used to send booking confirmations, reminders and replies.
• Authorised staff: employees and contractors who need the information to prepare the bike, hand it over, inspect it, reconcile payments or answer your support request.
• Professional advisers: accountants, insurers, lawyers or auditors where necessary and subject to confidentiality.
• Authorities: police, courts, regulators or other public bodies where we are legally required to disclose information, or where disclosure is necessary to establish, exercise or defend legal claims.
• A successor business: if the business is sold or reorganised, information may be transferred as part of that transaction under equivalent protections.

We do not sell your personal information. We do not share it for third-party advertising.

6. Cookies and similar technologies

We use a small number of cookies and browser storage entries:

• Authentication and session cookies set by Supabase, which keep you signed in to your customer or staff account. Without them, account and booking management cannot work.
• Security cookies used to validate sign-in flows and protect forms against cross-site request forgery.
• Preference storage in your browser, such as a saved theme or language choice.
• Analytics, only if Google Analytics 4 or Google Tag Manager is configured for the site. Analytics help us understand which pages are used and where errors occur. We configure analytics to avoid collecting booking form contents, and we do not intentionally send names, email addresses, phone numbers or payment details to analytics.

We do not use advertising or retargeting cookies by default. If that changes, this policy and any required consent banner will be updated before those cookies are used.

You can block or delete cookies in your browser settings. Blocking essential cookies will prevent you from signing in, but you can still browse the public pages and contact us.

7. International data transfers

Our service providers may process information on servers outside Thailand. Supabase, Hostinger, Google and email providers operate infrastructure in multiple countries, so your information may be transferred to and processed in those countries.

Where information is transferred outside Thailand, we rely on appropriate safeguards permitted by the PDPA, such as contractual protections with the provider and the provider's security commitments. You can contact us for more information about the safeguards that apply to a specific transfer.

8. How long we keep information

We keep personal information only as long as reasonably necessary for the purpose it was collected, and then delete or anonymise it.

As a guide:

• Booking and rental records are kept while the rental is active and afterwards for accounting, tax, warranty, insurance and dispute purposes.
• Account information is kept while your account is open. If you ask us to close it, we remove or anonymise account data that is not needed for a booking or legal obligation.
• Payment and invoice records are kept for the period required by Thai accounting and tax rules.
• Support conversations are kept for as long as needed to resolve the issue and for a reasonable period afterwards.
• Security and server logs are kept for a limited period and then rotated or deleted.

When information is no longer needed, we delete it securely or convert it into aggregated information that no longer identifies you.

9. How we protect information

We use reasonable technical and organisational safeguards, including:

• encrypted connections (HTTPS) between your browser and the website;
• hashed passwords and provider-managed authentication;
• server-side access checks so customers can only see their own bookings;
• role checks on staff and administrator features;
• restricted access to production systems and credentials;
• database rules that limit direct public access to booking and customer records;
• logging and review of administrative actions;
• keeping confidential keys on the server rather than in browser code.

No website or storage system is completely secure. We cannot promise that unauthorised access will never occur, but we investigate suspected incidents, take steps to contain them and notify affected people and the competent authority where the PDPA requires it.

10. Your rights under the PDPA

Subject to the conditions and exceptions in the PDPA, you have the right to:

• access your personal information and receive a copy of it;
• correct inaccurate or incomplete information;
• delete or destroy information, or anonymise it, where it is no longer necessary or was collected unlawfully;
• restrict processing while a request is being considered or where processing is unlawful;
• object to processing based on legitimate interests or to direct marketing;
• withdraw consent where we rely on consent, without affecting processing that already took place;
• data portability, where the law provides it and the information was provided by you and processed automatically;
• lodge a complaint with the Personal Data Protection Committee or another competent authority.

To make a request, contact us using the details in section 14. Please tell us what you want and which email address or booking the request relates to. We may ask for reasonable proof of identity so we do not disclose information to the wrong person. We aim to respond within the period required by the PDPA.

We will not treat you differently for exercising your rights. Some requests may be limited by legal record-keeping obligations, the need to defend legal claims, or the rights of another person.

11. Children and young riders

Our website and rental service are intended for people who can lawfully enter a rental agreement and hold the licence required for the vehicle. We do not knowingly collect personal information from children through the website.

If a booking is made by an adult on behalf of a younger rider, the adult is responsible for ensuring the rider meets the legal and rental requirements. If you believe a child has given us personal information without appropriate consent, contact us and we will review and delete it where required.

12. Your choices

You can:

• update your account name, phone number and password in the customer portal;
• ask us to correct information that you cannot edit yourself;
• opt out of the optional payment reminder by leaving the checkbox at checkout unticked;
• withdraw consent for optional communications at any time;
• request deletion of your account, subject to booking and legal retention requirements;
• block non-essential cookies in your browser.

Booking confirmations and service messages about an active booking are not marketing and are sent as part of the rental service.

13. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The published version on this page is the current version, and the effective date at the top of the page shows when it started to apply.

If a change materially affects how we use information you have already provided, we will take reasonable steps to inform affected customers, for example by email or a notice on the website. Earlier versions are retained in the website's version history for reference.

14. Contact us about privacy

For privacy questions or requests:

• Email: booking@scooterexpress.co
• Phone: +66 92 281 3833
• Address: 185 Soi Sukhumvit 39, Khlong Tan Nuea, Watthana, Bangkok 10110, Thailand

If you are not satisfied with our response, you can contact the Office of the Personal Data Protection Committee in Thailand or another competent supervisory authority.