Updated: 19 October 2026
easygo.rent is a car and bike rental aggregator on Koh Samui. The platform decides which personal data to collect and why, so under Thailand's Personal Data Protection Act (PDPA 2019) we act as both the data controller and the data processor. This page explains what we store and how you control it.
Your name, email and phone number when you sign up. Booking data: dates, vehicle, pickup method, amounts and payment marks. If you upload rental documents: scans or photos of your passport, visa, driving licence and international driving permit, plus the numbers and dates on them. Reviews and messages. Technical information about your device and browser so the map and filters work.
To make and carry out your booking (basis: contract). So the rental owner can check your licence and passport before handing over a vehicle (basis: your consent when you upload documents). To show nearby rental points, keep your favourites and count your review in the platform rating (basis: contract and our legitimate interest). To protect the platform from fraud and keep records the law requires (legitimate interest and legal obligation). Google Analytics runs only with your consent.
The rental owner and the staff of their point see your name, contacts and documents only for the booking you made with them, and only for the rental. Platform administrators get access when it is needed for support or to review a complaint. Other customers and outsiders never see your documents: files sit in private storage and open through temporary links. We do not sell data to third parties for advertising.
These are the most sensitive data we hold, so upload starts only after your explicit consent, which you confirm with a checkbox before sending a file. You can withdraw consent at any time: delete the file in your account and it is erased from storage. We ask for documents only so the owner can hand you a vehicle, and we use them for nothing else.
Account data and documents: while you have an account or until you delete the file yourself. If you delete your account or data, we erase documents and personal data within 30 days. We may keep booking and payment records without personal contacts for up to 5 years, because Thai accounting and tax law requires it and they are needed in disputes between a customer and an owner.
The database and files are on Supabase servers and the website runs on Vercel. These servers are outside Thailand, so your data is transferred abroad. We choose providers that protect data at least as well as the PDPA requires.
Some cookies are needed for the site to work: they keep you signed in and remember your language. We always set those. We also use Google Analytics to count visitors and see which pages they view. Those cookies are switched on only if you press Accept. You can change your mind at any time with the Cookie settings button at the bottom of the page.
You can ask what data we hold about you, get a copy, correct it, restrict or object to processing, move your data and withdraw consent. You can delete your account with all its data using the Delete my data button in your account. If you believe we have violated your rights, you may complain to Thailand's Personal Data Protection Committee (PDPC).
Access is limited by database permissions: a customer sees their own data, an owner sees the data of their point. If a breach puts your rights at risk, we will notify the PDPC within 72 hours and write to you.
A contact email for legal questions will appear on this page closer to launch.