Privacy policy

BusyBaht compares grocery prices, unit prices and promotions across the Thai retailers it covers (currently Makro, Lotus's, Tops and Big C), so a shopper can see which basket comes out cheapest and where. We are an information service, not a shop: nothing is sold on this site, no payment is taken, and any purchase happens at the retailer.

Visitors do not need an account, and most of what this site does works without us knowing who you are. Where we do hold information, Thailand's Personal Data Protection Act ("PDPA") treats it as personal data, so this policy explains what traces exist, why we keep them, how long for, and what you may ask us to do with them. It applies to shoppers, to the people who operate the site, and to the developers who build on it.

We are the data controller for the purposes of the PDPA. Our registered operator details and business address will be added here once the company is registered; until then, the contact details in this policy are the way to reach us.

By default, very little. For most visitors, nothing at all.

• Browsing, searching, comparing and basket building need no account. A visitor does not give us a name, email address or phone number to use this site.
• The things you save stay on your device. Shopping lists and your basket are written to your own browser's storage, not to our servers. Clearing your browser's site data removes them completely, and we cannot see them.

In the few cases where information does reach us, it is:

• Operator accounts. When someone is invited to operate or maintain the site, we hold their name and email address, the permissions they have been granted, and a record of what their account has done, so the admin console can show who signed in and what they may do.
• Developer accounts. A developer with an API credential has the name and email address that were recorded on their account, so that access can be granted, used and withdrawn.
• Correspondence. If you email us, we receive the address, the message, and anything in it.
• Technical logs. Like any hosted site, ours records the network level of activity: IP address, timestamps, the pages and requests served, and the browser's user agent. We use these to keep the site working, to diagnose problems and to defend it, and we do not try to decode them into who someone is.
• Analytics. Only if you accept the cookie banner, the site loads Google Analytics, which records the pages you visit, roughly where you are (country and city, derived from your IP address), your device and browser type, and actions such as adding a product to a list. If you decline, or never answer, Google's script is never loaded and none of this is collected.

Each category above is used only for the purpose that created it, on a defined lawful basis under the PDPA:

• Operating the comparison service (collecting prices, matching products and showing you the results) relies on our legitimate interest in running the site you came to use. That interest is balanced against yours: nothing about you is disclosed beyond what it takes to serve the page.
• Operator and developer accounts exist for the administrative agreement under which access was granted, and are handled on that basis. Signing in, issuing credentials and auditing what an account does are the running of that agreement.
• Correspondence is used to answer you, which is our legitimate interest in responding to people who write to us.
• Technical logs support the security and stability of the site (a legitimate interest of ours) and our legal obligations where an incident requires records.
• Analytics rests on your consent, given through the cookie banner, and is used only to understand how the site is used so we can improve it. You can withdraw consent at any time by deleting the cookie-consent cookie; the banner will ask again.

We never sell data or use it for marketing. Because our main use rests on legitimate interest, you may object at any time; the contact section below shows how, and we will honour valid objections as the PDPA requires.

While the prices we compare are public, the people behind them are not: the retailers receive no information about you from us, and we do not sell, rent or trade personal data.

A small number of processors see the data needed to run the site, each under a contract that lets them use it only on our instructions:

• Hosting and infrastructure providers hold the servers the site runs on, which is where the account records and technical logs above live.
• Google, as our analytics provider, receives the analytics data described above, and only from visitors who accepted the cookie banner. Google may process it outside Thailand.
• An email delivery provider sends the transactional mail we generate: invitations to join as an operator, and notices about accounts. It receives only the address and the message.
• Professional advisers and authorities see information only where the law compels it, for example to respond to a lawful request or to defend legal claims.

Nothing else receives personal data, and this policy will name any new category here before it exists in practice.

The site sets far fewer cookies than most, because it keeps state in your browser and because nothing is loaded that needs to watch you. Concretely:

• The consent record. The banner remembers your choice in a cookie-consent cookie so it does not ask again. The value is read by nothing else: it is a permission record, not a way of recognising you.

• Operator sessions. When you sign in to the admin console, two HttpOnly cookies (supermarket.session and supermarket.refresh) hold your session. They are set by the server and cannot be read by a script on the page.

• Analytics cookies. If you accept the banner, Google Analytics sets _ga and _ga_* cookies to tell one visit from the next. They are never set if you decline.

There are no advertising cookies; we do not do cross-site tracking or use analytics for advertising. Declining costs you nothing: every feature of the site works the same either way, and the only difference is whether Google Analytics is loaded. You can delete cookies in your browser settings at any time; you will simply be asked to choose again.

The PDPA gives you rights over the personal data described here, and you do not need a reason to use them:

• Access: to know and to see what we hold about you.
• Rectification: to have inaccurate data corrected.
• Erasure: to ask that data about you be deleted.
• Restriction: to have processing paused while a question about it is resolved.
• Portability: to receive the data you gave us in a usable form, where the law allows.
• Objection: to challenge processing that rests on legitimate interest.
• Withdrawal of consent: for the few things that ask for it, at any time.

To exercise any of these, write to the address in the contact section. We verify identity with standard checks before acting, reply well within the period the PDPA allows, and will tell you in plain terms what we did and why. If your data lives only on your own device (the save baskets and lists), you do not need us: clear your browser's site data and it is gone.

You may also complain to Thailand's Personal Data Protection Committee (the PDPC) if you believe your rights have been breached.

We keep data only as long as the purpose above still exists, and then dispose of it securely:

• Browser-stored lists and baskets stay on your device until you clear them; we never hold them for you.
• Operator and developer accounts are kept for as long as the account is needed, then for a short period afterwards while access controls and audit records still matter, after which the identifying details are removed.
• Correspondence is kept while it is useful to answer and then deleted, in line with any legal obligations to keep it.
• Technical logs are kept for a bounded operational period: long enough to diagnose an incident, short enough that they do not become a profile.
• Backups may briefly hold a copy of other data after it is deleted, until the next backup cycle rolls them out, as is true of any hosted service.

If we are required by law to keep something longer, we keep the minimum the law allows.

When this policy changes, the "Effective" date at the top of this page is the date the new version takes effect. Material changes (a new use of data, a new sharing arrangement, a new analytics provider) are announced on this page at least as clearly as the change itself deserves, and are applied no earlier than their effective date.

Your browser-stored data needs no announcement: it stays where it is regardless of a policy change. For anything else, the rights in this policy apply to the data we hold under whichever version was in force when we collected it. Keep a copy of the version you rely on if it matters to you.

The operator of BusyBaht can be reached by email at hellobusybaht.com. If you are writing about your own data, tell us the account or correspondence in question and what you would like done, and we will respond within the period the PDPA allows and in plain language.

If you believe a request of ours has not, in your view, been answered properly, you may also raise it with Thailand's Personal Data Protection Committee.