Privacy Policy

Draft: This document is a draft and must be reviewed by qualified legal counsel before publication.

Last updated: [LEGAL.PRIVACY_LAST_UPDATED]

1. Who we are

This website is operated by Echo Autoparts, registration number [COMPANY.REGISTRATION_NUMBER], 13 Bang Na-Trat Frontage Rd, Bang Wua ("we", "us"). We are the data controller for personal data collected through this website.

For privacy questions or requests, contact sales@echoautopart.com.

Pending legal review: Counsel should confirm obligations under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA) and any other laws that apply to users in buyers' countries, and whether a data protection officer must be appointed.

2. Data we collect

2.1 Request for quotation (RFQ) submissions

When you submit an RFQ, we collect:

• Company name
• Contact person name
• Email address
• Country
• Phone and/or WhatsApp number
• Parts lists, including part numbers, descriptions, quantities and vehicle details
• Files you upload, such as spreadsheets, photos of parts and tender documents
• Any message or notes you include

Uploaded files may contain personal data you choose to include. Please avoid uploading documents containing personal data that is not needed for the quotation.

2.2 Registered business accounts

If you register an account, we collect your name, company, email address, country, phone number, password (stored in hashed form) and account activity such as RFQ history and saved preferences.

2.3 Contact messages

If you contact us by form, email, phone or messaging app, we keep the content of your message and your contact details.

2.4 Analytics

We use three analytics systems to understand how the website is used, for example which pages are visited and which searches return no results.

Our own analytics runs on our systems. It records events such as page views, searches and request-for-quotation steps. A visit is identified by a random session identifier that is hashed before it is stored, only the host name of a referring website is kept, and query strings are removed from recorded page addresses.

Google Analytics 4, provided by Google, sets its own cookies in your browser to recognise returning visits and measure how traffic reaches the website. Technical data processed may include pages visited, referring page, approximate location derived from your IP address, and device and browser type. It is configured for measurement only: advertising storage, advertising identifiers and ad personalisation are switched off, so this data is not used for retargeting or advertising profiles. Google processes the data on our behalf under its own terms, and the data may be transferred to and stored on servers outside your country.

When you send a request for quotation, a sourcing request or an availability request, or open a WhatsApp or email contact link, the fact that it happened is also recorded in Google Analytics, with a small set of non-identifying details: the type of request, how many lines or files it contained, the destination country code, and the page or market it came from. The contents of your enquiry, your name, your company and your contact details are never sent to Google — those stay in our own systems.

If you are in the European Economic Area or the United Kingdom, we ask before any analytics cookie is set: nothing is stored in your browser until you accept, although requests that carry no identifier and no cookie are still sent to Google so that visit and enquiry counts can be estimated. Everywhere else, the analytics cookies are set when you first visit the website.

Cloudflare, which delivers this website, adds its own page-view measurement script when the page is served. It sets no cookie, stores nothing in your browser and does not identify you across websites.

Analytics data is used in aggregate to improve the website.

2.5 Server and security logs

Our servers record technical information such as IP address, request time and browser type to operate the website securely and to detect abuse.

3. How we use your data

Purpose	Data used	Legal basis (to be confirmed by counsel)
Responding to quotation requests	RFQ data and uploaded files	Steps taken at your request before entering a contract
Processing and fulfilling orders	Contact, company, order and shipping data	Performance of a contract
Managing your account	Account data	Performance of a contract
Answering enquiries	Contact message data	Legitimate interests
Improving the website	Aggregate analytics	Legitimate interests
Security and fraud prevention	Logs and account data	Legitimate interests
Legal, tax and customs obligations	Order and shipping records	Legal obligation

We do not sell personal data. We do not use your data for third-party advertising.

We may contact you about your RFQ or order by email, phone or WhatsApp using the details you provided. Any marketing communications would be sent only in accordance with applicable law, and you can opt out at any time.

4. Sharing your data

We share personal data only where needed:

• Suppliers and manufacturers: part details from your RFQ may be shared to confirm availability and pricing. We share contact details with suppliers only where necessary to fulfil your order.
• Logistics providers: freight forwarders, carriers, customs brokers and inspection companies receive consignee and shipment details needed to ship your order.
• Service providers: hosting, email and file storage providers that process data on our behalf.
• Authorities: customs, tax or other authorities where required by law.

5. International transfers

Our buyers are located in many countries, and shipment data necessarily moves between Thailand and destination countries. Where personal data is transferred outside Thailand, we take steps required by applicable law.

6. Retention

We keep personal data only as long as needed for the purposes above:

• RFQ data: [PRIVACY.RFQ_RETENTION_PERIOD]
• Account data: while the account is active and [PRIVACY.ACCOUNT_RETENTION_PERIOD] after closure
• Order and shipping records: as required by tax, customs and accounting laws
• Analytics data: [PRIVACY.ANALYTICS_RETENTION_PERIOD]

7. Cookies and local storage

We use an essential cookie to keep you signed in, analytics cookies set by Google Analytics where you have accepted them, and your browser's own storage to keep your RFQ list. See our cookie policy.

8. Security

We use technical and organizational measures to protect personal data, including encrypted connections (HTTPS), access controls and hashed passwords. No system is completely secure; please notify us if you suspect a security issue.

9. Your rights

Subject to applicable law, you may have the right to access, correct, delete or obtain a copy of your personal data, to object to or restrict processing, and to withdraw consent where processing is based on consent. You may also have the right to complain to a data protection authority.

To make a request, email sales@echoautopart.com. We may need to verify your identity.

10. Business users

This website is designed for business buyers and is not intended for children.

11. Changes

We may update this policy. The latest version is always available on this page.

12. Contact

Echo Autoparts 13 Bang Na-Trat Frontage Rd, Bang Wua Email: sales@echoautopart.com Phone: [COMPANY.PHONE]