Privacy
This notice explains how the portal handles personal data for public visitors, property seekers, external agents and administrators under a Thai PDPA-first, internationally prudent privacy model.
Last updated: 2026-06-22
Wealthy Flow Asset Co., Ltd (Head Office) operates this portal as data controller for the website, agent accounts, lead routing and platform administration.
Registered address: 79/148 Soi Sukhumvit 46, Phra Khanong, Klong Toey, Bangkok 10110 Thailand. Tax ID: 0-1055-58140-31-2. Privacy contact: info@matrix.realestate.
The portal may process account details, agency profile data, property listing data, inquiry contact channels, optional additional notes, internal inquiry replies, bank transfer references, payment proof files, security logs, subscription status and operational analytics.
Visitor contact channels may include email, phone, WhatsApp and a social contact chosen by the visitor. At least one channel is required to submit an inquiry, while the message field is optional.
When a visitor explicitly selects the contact prefill option, the portal stores only recurring contact fields for future inquiry forms: name, email, phone, WhatsApp, social platform and social contact. Free-text messages, notes, selected property data and sensitive listing details are not stored for prefill.
Owner contact details, lead messages, listing contacts, WhatsApp/social lead fields and other sensitive operational fields are encrypted before storage. IP addresses, email addresses and user agents used for security or analytics are stored as privacy hashes where the application design allows it.
Data is used to publish and search property listings, route inquiries, operate agent subscriptions, process bank transfer confirmations, prevent abuse, maintain audit trails, answer support requests and keep the service reliable.
The main legal bases are contract or pre-contract steps requested by the user, legitimate security and platform operation interests, legal/accounting obligations, and consent where a user voluntarily submits contact details or where a non-essential cookie or similar technology would be introduced in the future.
The portal does not sell personal data. Lead details are routed according to listing ownership: legacy account inquiries go to the central administrator, while active external agent listings route to the posting agent dashboard and configured email workflow.
Data may be visible to authorized administrators, the posting agent responsible for a listing, hosting providers, email delivery providers once SMTP is configured, and public authorities when legally required.
Listing photos are stored locally after controlled upload or controlled import. Initial import sources may contain remote photo URLs, but those URLs are used only server-side to download, validate, optimize and store images locally before publication.
The application uses server-side validation, CSRF protection, password hashing, encrypted sensitive fields, protected upload storage outside the public web root and security headers. No public page intentionally exposes private import data.
Contact prefill records are encrypted server-side, linked only to a random first-party cookie token and expire after 6 months unless the visitor refreshes consent by using the option again.
Internal inquiry messages are text-only and messages older than 12 months are removed by the maintenance workflow. Admin login audit data is retained for at least 60 days. Payment and subscription records may be retained for accounting, dispute-handling and legal needs. Other records are kept only while operationally necessary.
The portal is operated for Thailand but can be accessed internationally. Authorized administrators, posting agents, hosting infrastructure and email systems may process data from different locations depending on the final production setup.
Where cross-border processing is required, the owner should use appropriate contractual, security and vendor controls before public launch.
Requests to access, correct, delete, restrict, object to processing, withdraw consent where consent is the basis, or ask how data was obtained can be sent to info@matrix.realestate. The portal owner may need to verify identity before acting on a request.
Users may also contact the competent Thai personal data authority where legally available. This operational notice must be reviewed by qualified legal counsel before public launch and whenever data handling, vendors or legal requirements change.