Privacy Policy

Legal entity: Grither Company Limited Company registration number: 0835567012945 License: Authorized Money Changer No. MC225670133 Address: 48/1 Moo 2, Rawai, Mueang Phuket, Phuket 83130, Thailand Website: grither-ex.com Data protection contact: gritherexchange@gmail.com Phone: +66 94 262 8045

The Company acts as the controller of personal data received through the website, contact forms, business correspondence, telephone enquiries and customer services at our office, unless the nature of specific processing indicates otherwise.

• Personal data means information relating to an identified or identifiable individual.
• Processing means any operation performed on personal data, including collection, recording, retention, use, disclosure and deletion.
• Client means an individual seeking a cash foreign currency exchange service.
• User means an individual visiting the website or contacting the Company through an available communication channel.
• Cookies are small files that the website or integrated services may store in a user's browser.

The Company processes personal data for specified and lawful purposes and limits its collection to information necessary to provide services and meet applicable obligations.

Depending on the circumstances, processing is based on:

• taking steps in response to a client's request and performing an agreed transaction;
• compliance with legal obligations, including customer identification, foreign exchange regulations, accounting and anti-money laundering requirements;
• the Company's legitimate interests, including security, fraud prevention and handling enquiries, subject to the rights of data subjects; or
• the data subject's consent, where required by applicable law.

The Company takes reasonable steps to keep data accurate and up to date, restrict access, and discontinue processing when its relevant purpose has been fulfilled, unless continued retention is required or permitted by law.

Information provided when contacting us: name, telephone number, email address, messenger identifier, message contents, requested currency and proposed exchange amount.

Transaction-related information: data needed to record and document a transaction, including currency type, amount, exchange rate and supporting documentation. Where required by applicable rules, we also process identification document information and other details necessary to identify the client and verify a transaction.

Technical information: IP address, browser and device details, pages visited, referral source, website interactions and technical errors. The scope of such information depends on the website features and service settings in use.

Video surveillance: recordings from CCTV cameras installed at the office are used to protect visitors and staff, safeguard property and investigate incidents.

Contact details are generally necessary for us to respond to an enquiry. Where customer identification or additional documents are legally required for a particular currency exchange transaction, failure to provide the required information may prevent the transaction from proceeding.

The Company processes personal data to:

• respond to enquiries and provide information about exchange rates, currency availability and office hours;
• arrange and carry out transactions involving foreign currency banknotes;
• identify customers and perform required checks;
• maintain legally required records and supporting documentation;
• protect the office and website and prevent fraud;
• handle complaints, correct errors and resolve disputes;
• maintain the website, analyse visits and measure advertising effectiveness where an appropriate legal basis exists; and
• send informational or promotional communications where permitted by law, including with consent where required.

The Company does not sell personal data. Access may be granted to authorised staff and, where necessary, to the following categories of recipients:

• hosting, technical support, email and communication service providers;
• messaging service providers selected by the user to contact us;
• providers of website analytics, advertising tools and mapping services;
• professional advisers and other parties engaged on a lawful basis; and
• government and supervisory authorities where disclosure is required by law.

Website operations may involve Vercel, Google (including Google Analytics, Google Ads and maps), Yandex (including Metrica and maps), Meta (including Pixel and Conversions API), PostHog, Telegram and WhatsApp. Information is shared with an individual provider according to the website feature in use and the user's chosen communication method.

Where third-party service providers are engaged, the Company implements the organisational and contractual measures required to protect personal data within its obligations under applicable law.

Personal data may be processed outside Thailand when international hosting, analytics or communication services are used. Such transfers are made on a legal basis and subject to safeguards required under the PDPA and other applicable requirements.

The Company retains personal data for the period necessary to fulfil the relevant processing purpose, comply with legal obligations and protect lawful rights.

Transaction records and supporting documents are retained for the mandatory periods prescribed by applicable foreign exchange, accounting and anti-money laundering rules. Enquiries and related correspondence are retained for as long as necessary to respond, address subsequent complaints and meet legal obligations. The retention of technical data and identifiers depends on the processing purpose and relevant service settings.

At the end of the applicable period, personal data is deleted, anonymised or retained on another lawful basis.

Subject to the conditions and limitations of applicable law, individuals may:

• request information about the processing of their personal data and access to that data;
• request correction of inaccurate or incomplete information;
• withdraw consent where processing is based on consent;
• request deletion, destruction or anonymisation of data, or restriction of processing, where provided by law;
• object to processing where a corresponding legal right exists;
• request data portability where provided by law; and
• lodge a complaint with the competent data protection authority.

Requests may be sent to gritherexchange@gmail.com. To safeguard personal data, we may request information reasonably necessary to verify the requester's identity. Certain rights may be limited by the Company's legal obligation to retain records.

Processing subject to Thai law is governed by the PDPA. Where specific processing falls within the scope of other mandatory data protection rules, the applicable rights are respected to the extent required by those rules.

The Company implements organisational and technical measures intended to prevent unauthorised access, misuse, alteration, disclosure and loss of personal data. Access is limited to personnel who require it to perform their duties.

If a personal data security incident is identified, the Company takes steps to mitigate its consequences and provides notifications where required by applicable law.

Cookies and similar technologies may be used to operate the website, analyse visits and assess advertising campaign performance.

Functional technologies support the correct operation of the website and user preferences.

Analytics technologies provide information about page visits and user interactions. Depending on website settings, Google Analytics, Yandex Metrica and PostHog may be used for these purposes. Some analytics tools can record interactions with page elements, including clicks, scrolling and use of interface controls.

Advertising technologies help measure campaign results and website interactions. These include Google Ads and Meta Pixel / Conversions API.

External mapping and messaging services may process technical data under their own privacy policies.

Users can manage cookies through their browser settings; service providers may also offer privacy controls. Where applicable law requires consent for particular technologies, the processing must be supported by the appropriate legal basis.

The website and the Company's services are intended for adults. We do not knowingly collect personal data from minors. Concerns about any such information can be raised using the contact details below.

The Company may amend this Policy. The current version is published at grither-ex.com with its last-updated date. Where changes to processing purposes or legal bases require separate notice or consent, the Company will comply with those requirements.

Grither Company Limited Company registration number: 0835567012945 Authorized Money Changer License: MC225670133 Address: 48/1 Moo 2, Rawai, Mueang Phuket, Phuket 83130, Thailand Email: gritherexchange@gmail.com Phone: +66 94 262 8045 Website: grither-ex.com