Privacy Policy

1.1 Account and profile data

• Full name
• Residential unit number, building, and property details
• Contact information: telephone number (optional) and email address
• Device identifiers and IP addresses (for security and platform integrity)
• Profile photographs (where provided)

1.2 Communications

• Chat messages between residents and the property management team
• Social posts, and the moderation record created when another resident reports a post

1.3 Building and property records

• Notice photographs — images attached to a building notice
• Parcel records — arrival photograph, tracking number, recipient (including a free-text name for someone not registered on the Platform), staff note, and timestamps
• Parcel handover logs — who collected the parcel, and the name of the staff member who released it
• Visitor records — visitor name, access code, pass link, and gate scan events, including reusable passes issued for a helper, nanny, or driver. This category includes personal data about people who have never installed the app, supplied to us by a resident.
• Maintenance requests — title, description, and up to five photographs per request
• Suggestions — topic, description, and an optional photograph
• Amenity bookings and shuttle use — which facility, when, by whom; shuttle timetable and live-status use
• Payment slip images — a photograph or scan of a bank transfer slip, uploaded to settle an invoice
• Billing and payment records — issued invoices, amounts, payment method, and status

1.4 Camera and photo library access

The Platform uses the device camera and photo library for six purposes: scanning invite, pickup, and visitor QR codes, and photo capture for notices, parcels, maintenance requests, suggestions, and payment slips. Any of these photo uploads may come from the camera or from an existing image in your photo library.

1.5 Website enquiries (qasaliving.com)

When you submit a support or sales form on our website, we collect the details that form asks for, your message, and any file attachments. We also process the network (IP) address of the request to block automated submissions and to limit how many can be sent in a day, not as part of your enquiry, and on the basis of our legitimate interest in protecting the site from abuse.

1.6 Cookies and similar technologies

Our website uses cookies and similar technologies for analytics and security. For details on what we use and how to manage your preferences, see our Cookie Policy.

1.7 Abuse-prevention data

To prevent spam and automated abuse of our forms, we apply short-lived daily submission limits keyed on the contact details provided and the requester's network address, and we use a hidden field designed to capture automated ("bot") submissions.

We process your personal data on the following lawful bases under the PDPA:

• Contractual Necessity: To fulfil obligations under your property management or tenancy agreement.
• Legitimate Interests: To operate, maintain, and continuously improve the Platform, to respond to and process enquiries submitted through the website, and to protect our forms against abuse.
• Legal Obligation: To comply with applicable Thai laws and regulatory requirements.
• Explicit Consent: Where required, particularly for sensitive personal data as defined under Section 26 of the PDPA.

We use your personal data to:

• Provide and support core Platform features for residents and the property management team, including notices, parcels, maintenance requests, suggestions, visitor management, amenity bookings, and billing
• Deliver notices, announcements, and operational updates from your property management team
• Respond to support and sales enquiries submitted through the website
• Analyse usage patterns to improve Platform performance and user experience
• Prevent abuse of our forms and services
• Comply with legal and regulatory obligations under Thai law

We disclose personal data only as follows:

• Your property management team, for the property you reside in or manage, as needed to operate the Platform (e.g., notices, parcels, maintenance, visitor passes, billing).
• Service providers who process data on our behalf, under contractual confidentiality and data protection obligations:
  • Resend — email delivery, including message attachments
  • Cloudflare — anti-automation / bot-challenge protection, which receives the requester's IP address
  • Google — analytics
• Legal and regulatory authorities, where required by law or to protect the rights, property, or safety of the Company, our users, or the public.

We do not sell personal data.

Our standard retention period is 3 years from the date of last activity for account data, unless a longer period is required by Thai law or regulatory obligation.

You may request deletion of your account and associated data at any time, subject to the exceptions described in Section 7.

Platform data is hosted within US-based data centres in encrypted form, or in jurisdictions that provide an adequate level of data protection as recognised under the PDPA's cross-border transfer provisions.

Website enquiry data is additionally processed outside Thailand by Resend (email delivery), Cloudflare (bot protection), and Google (analytics). Each provider processes data under its own data protection terms.

Under the PDPA and, where applicable, the GDPR, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Correct any inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your account and personal data. We will erase what we are able to. Some records must be kept for a period set by Thai law or by the building's own contract — issued invoices, parcel handover logs, and visitor records are the usual examples — and we will tell you which of these apply to your data and when they expire.
• Right to Object: Object to certain processing of your data, subject to applicable legal requirements.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: Lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand if you believe your data protection rights have been violated.

Verified requests are processed promptly, subject to applicable legal requirements. To exercise any of these rights, submit a written request to support@qasaliving.com. All requests will be acknowledged within 72 hours and resolved within 30 business days.

If you have a Resident App, QasaStaff App, or Admin Dashboard account, you may request deletion of your account and associated personal data at any time, using either method below:

• In-app: Go to Settings → Account → Delete Account, and follow the prompts (Resident App and QasaStaff App), or the equivalent path in the Admin Dashboard.
• By request: Email support@qasaliving.com from your registered address.

We will delete or de-identify your personal data within 30 business days of a verified request, except for records we are required to retain under Section 7 (issued invoices, parcel handover logs, and visitor records), which will be retained only for the legally required period and then deleted.

We implement reasonable technical and organisational measures — including encryption in transit and at rest, access controls, and regular review of our practices — to protect your personal data against unauthorised access, disclosure, alteration, or destruction. No system is completely secure, and we cannot guarantee absolute security.

The Platform is intended for use by adults responsible for a residential unit or acting on behalf of the property management team. We do not knowingly collect personal data from children. If you believe a child's data has been provided to us, please contact us at support@qasaliving.com so we can address it.

QasaLiving reserves the right to update this Privacy Policy at any time. Material changes will be communicated through the Platform.

For all privacy-related inquiries, please reach out to us directly:

• Email: support@qasaliving.com
• Company: MessageSpring Co., Ltd.
• Location: Bangkok, Thailand