1. Who we are
The data controller for this website is PWSM Co., Ltd. (“Dank PoS”, “we”, “us”), juristic person registration number 0845565015793, registered at 11/111 Moo 4, Bo Phut, Ko Samui, Surat Thani 84320, Thailand.
- Privacy enquiries: privacy@dankpos.app
- Data Protection Officer: DPO appointment in progress; the privacy team handles requests meanwhile, privacy@dankpos.app
This notice covers the public website, its forms and the emails we send about them. When licensed shops use the Dank PoS software to serve their own customers, the shop is the data controller for that customer data and we act as its data processor under a data processing agreement. Questions about a shop’s customer records should be directed to that shop first.
2. Personal data we collect
What we collect depends on how you use the site:
| When | Personal data | Source |
|---|---|---|
| Every visit | IP address, browser and device type, pages requested, referrer, timestamps (server and security logs). | Your browser, via our hosting provider |
| Every visit, only if you accept analytics | Pseudonymous analytics identifiers (Google Analytics cookies), pages viewed, approximate location from IP, device and performance metrics. | Your browser |
| Demo request | Full name, work email, company name, phone / LINE ID (optional), notes (optional), your answers to the pricing assessment, and the IP address and browser details recorded with your acknowledgement. | You |
| Access request (all roles) | Full name, email, phone, selected role, your IP address (abuse prevention), and a record of your notice acknowledgement and age confirmation. | You |
| Club Member request | Medical-cannabis patient card / recommendation ID (sensitive health data) and preferred club location. | You |
| Practitioner request | Medical Council registration number, clinic name and province, optional licence verification link. | You |
| Retail Manager request | Dispensary / brand name, headquarters province, an account-recovery phrase (stored only as a one-way hash), company tax ID, legal company name, authorised contact phone and email, wholesale request. | You |
| Producer request | Farm / brand name, licence number, distribution provinces, capacity snapshot, company tax ID, legal company name, authorised contact phone and email. | You |
| Business verification (Manager / Producer) | Registered company details (name, address, status, business type, establishment year) and cannabis-shop licence details (licence number, expiry, location). | Public registries: Department of Business Development (DBD) open data and the DTAM cannabis licence registry |
| Emails you send us | Your email address, name and anything you include in the message or attachments. | You |
If you do not provide the information marked as required, we cannot process your demo or access request. Providing it is not a statutory requirement, but it is necessary to enter into a contract with you.
3. Why we use it and our legal basis
| Purpose | Legal basis (PDPA) | GDPR equivalent |
|---|---|---|
| Respond to demo requests and prepare quotes | Steps at your request before a contract (s.24(3)) | Art. 6(1)(b) |
| Verify eligibility and create your account | Contract (s.24(3)) | Art. 6(1)(b) |
| Verify a Club Member’s patient card / recommendation ID | Explicit consent for sensitive data (s.26) | Art. 9(2)(a) |
| Check business and licence details against DBD / DTAM registries | Legitimate interests in only onboarding licensed businesses, and compliance with cannabis regulations (s.24(5), s.24(6)) | Art. 6(1)(f), 6(1)(c) |
| Send confirmation, onboarding and status emails | Contract (s.24(3)) | Art. 6(1)(b) |
| Prevent abuse (IP-based submission limits) and keep the site secure | Legitimate interests (s.24(5)) | Art. 6(1)(f) |
| Keep evidence of notices, consents and requests | Legal obligation and legitimate interests (s.24(5), s.24(6)) | Art. 6(1)(c), 6(1)(f) |
| Website analytics and performance measurement | Consent (s.19) | Art. 6(1)(a) |
| Load embedded media (SoundCloud) automatically | Consent (s.19) | Art. 6(1)(a) |
| Respond to authorities and legal claims | Legal obligation; establishment or defence of legal claims (s.24(6), s.26(4)) | Art. 6(1)(c), 6(1)(f) |
We do not sell personal data, do not use it for targeted advertising, and do not send marketing. If we ever introduce marketing we will ask for separate, optional consent first.
Business verification includes an automated risk score built from registry matches. The score only helps our compliance team prioritise; every application is decided by a person. You can ask for the reasons behind a decision and contest it.
4. Sensitive personal data
The only sensitive personal data we ask for is the medical-cannabis patient card or recommendation ID in a Club Member request, which is health data under PDPA s.26. We process it only with your explicit consent, given through a separate checkbox, and only to verify your eligibility. Staff access is restricted, and we do not share it with other shops or third parties except where the law requires.
You can withdraw this consent at any time by emailing privacy@dankpos.app. We will then stop using and delete the ID. Withdrawal does not affect processing that already took place, but we may no longer be able to keep your membership active. If you prefer not to submit the ID online, contact us and we will arrange another way to verify.
Please do not send us any other health information, criminal-record data, or ID-card scans unless we ask for them.
5. Cookies and similar technologies
We only use strictly necessary storage until you make a choice in the cookie banner. Analytics (Google Analytics 4, Vercel Analytics, Vercel Speed Insights) and automatic embedded media (SoundCloud) run only if you opt in. Google Analytics runs with advertising features and Google Signals switched off. We honour the Global Privacy Control browser signal as a refusal of optional cookies.
Full details, including each cookie’s name and lifetime, are in our Cookie Policy (/cookies). You can change your choice at any time:
6. Who we share it with
We share personal data only with the following parties, and only for the purposes above:
- Vercel Inc. (USA): website hosting, server logs, and (with consent) Vercel Analytics and Speed Insights.
- Supabase Inc. (Singapore region): database and account authentication for form submissions and consent records.
- Resend (USA): sending confirmation and status emails, and receiving emails sent to our addresses.
- Google LLC (USA): Google Analytics 4, only if you accept analytics.
- Cloudflare Inc.: delivery of software downloads, and the Turnstile bot check shown when you press download (it receives your IP address and basic browser signals).
- SoundCloud Global Ltd: the music player, only when you press play or accept embedded media.
- Thai public registries (DBD, DTAM): we send a tax ID, company name or shop name to look up public records when verifying a business application.
- Authorities, courts and professional advisers: where required by law or needed to establish, exercise or defend legal claims.
- A buyer or successor: if Dank PoS is reorganised or sold, subject to this notice.
Our service providers act as data processors under written agreements and may not use your data for their own purposes.
7. International transfers
Some of the providers above store or access data outside Thailand, including Singapore (our database), the United States and the European Union. Where the destination country does not have adequate data-protection standards, we transfer data under the safeguards allowed by PDPA s.29 and the PDPC notifications on cross-border transfers, namely contractual clauses in our providers’ data processing agreements (including EU Standard Contractual Clauses). We may also rely on s.28 exceptions, such as a transfer needed to perform a contract with you. You can request a copy of the relevant safeguards from us.
8. How long we keep it
| Data | Retention period |
|---|---|
| Demo requests | 12 months after submission, unless you become a customer |
| Access requests that are pending, declined or abandoned | 12 months after submission (for audit and abuse prevention) |
| Approved access requests | For as long as the account is active, then up to 12 months after it is closed |
| Patient card / recommendation ID | Until verification is complete and membership is active, or until you withdraw consent |
| Business verification records | For the life of the account and up to 5 years after, where cannabis or tax rules require it |
| Consent and notice-acknowledgement records | For as long as the related data is kept, plus 12 months |
| Emails and support correspondence | Up to 24 months after the conversation ends |
| Server and security logs | 30–90 days |
| Google Analytics event data | 2 months (GA4 data-retention setting) |
At the end of the period we delete or anonymise the data. Backups are overwritten on a rolling cycle.
9. Security and breach notification
We use HTTPS (TLS) for all traffic and role-based access controls for staff. Server-side keys stay out of the browser. Secrets such as recovery phrases are stored only as one-way hashes. Tenant data is protected with encryption keys managed in Google Cloud KMS. Submissions are rate-limited and access is logged.
If a breach is likely to put your rights and freedoms at risk, we will notify the PDPC Office within 72 hours of becoming aware of it (PDPA s.37(4)). If the risk is high, we will also notify you without delay and explain what we are doing about it.
10. Your rights
Under the PDPA (ss.19, 30–36) you have the right to:
- Withdraw consent at any time, as easily as you gave it (cookie settings, or email us).
- Access your personal data, get a copy, and ask how we obtained data you did not give us.
- Data portability receive your data in a commonly used machine-readable format, or have it sent to another controller.
- Object to processing based on legitimate interests.
- Erasure have your data deleted, destroyed or anonymised when it is no longer needed or you withdraw consent.
- Restriction have us suspend use of your data while a request or dispute is being resolved.
- Rectification have inaccurate or incomplete data corrected.
- Complain to the Office of the Personal Data Protection Committee (PDPC Office), www.pdpc.or.th.
To exercise a right, email privacy@dankpos.app with the subject “Privacy request” and tell us what you need. We may ask for reasonable proof of identity. We will respond within 30 days, normally free of charge. If we cannot fully meet your request, for example because the law requires us to keep the data, we will tell you why and keep a record of the refusal.
11. Age restriction
This website and the Dank PoS platform are intended only for people aged 20 or over. The entry gate asks you to declare your age, and we keep only a flag in your browser that you did so (no date of birth, 12 months). That is the age of majority in Thailand and the minimum age for cannabis-related services. We do not knowingly collect data from minors. If we learn that we have, we will delete it. Parents or guardians can contact us to request deletion.
12. Additional information for EU and UK residents
If the GDPR or UK GDPR applies to you, the GDPR legal bases above apply. You also have the right to lodge a complaint with your local data-protection supervisory authority. Where we rely on legitimate interests we have balanced them against your rights; you can ask us for details.
13. Additional information for US residents
For the purposes of the California Consumer Privacy Act (as amended by the CPRA) and other US state privacy laws: in the last 12 months we collected the categories of personal information described in Section 2. These are identifiers, contact details, professional or commercial information, internet activity, and sensitive personal information (health-related identifiers, used only for eligibility verification). We collected them for the business purposes in Section 3 and disclosed them only to the service providers in Section 6.
- We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the last 12 months.
- We honour the Global Privacy Control signal.
- You may request to know, access, correct or delete your personal information, and limit the use of sensitive personal information, by emailing us. You may use an authorised agent.
- We will not discriminate against you for exercising these rights.
14. Changes to this notice
We update this notice when our processing changes. The effective date above shows the current version. We will notify you of material changes through the website or by email, and ask for fresh consent where the law requires it.
15. Contact us
- Company: PWSM Co., Ltd., 11/111 Moo 4, Bo Phut, Ko Samui, Surat Thani 84320, Thailand
- Privacy / data-subject requests: privacy@dankpos.app
- Data Protection Officer: DPO appointment in progress; the privacy team handles requests meanwhile, privacy@dankpos.app
- General support: support@dankpos.app
- Telephone: +66 64 446 0097
This notice is available in Thai and English. For users in Thailand, the Thai version prevails if the two differ.