Privacy Policy — Thailand Addendum

Personal Data Protection Act (PDPA) Supplement

This addendum applies to users located in the Kingdom of Thailand and supplements our main Privacy Policy. Where this addendum conflicts with the main Privacy Policy, this addendum prevails for users in Thailand.

---

1. Data Controller

For the purposes of the Personal Data Protection Act B.E. 2562 (2019), the data controller is:

Singapore Contact: privacy@cardie.golf

---

2. Cross-Border Data Transfer

Your personal data is transferred to and stored in Singapore, where our servers are located.

Under the PDPA, cross-border transfers of personal data require adequate safeguards. We protect your data through the following measures:

• Standard contractual clauses between Cardie and our data processors (Supabase, AWS) requiring them to maintain data protection standards comparable to the PDPA
• Encryption of your data in transit and at rest
• Access controls and row-level security ensuring only authorized systems and personnel can access your data
• Singapore's own Personal Data Protection Act (PDPA 2012), which provides a comparable level of data protection

The categories of personal data transferred include: account information (name, email), scorecard photos, golf scores and statistics, handicap rating basis preference, social interaction data (reactions, views, and invitations), location data (if enabled), device and service reliability information, and usage analytics (if enabled).

By consenting to our Privacy Policy during onboarding, you acknowledge and consent to the transfer of your personal data to Singapore for the purposes described in this policy.

---

3. Your Rights Under the PDPA

In addition to the rights described in our main Privacy Policy, you have the following rights under Thailand's PDPA:

Right to access — You may request a copy of the personal data we hold about you, or request that we disclose how we obtained your data.

Right to data portability — You may request that we transfer your personal data to another data controller in a commonly used, machine-readable format, where technically feasible.

Right to object — You may object to the collection, use, or disclosure of your personal data at any time, subject to applicable exceptions.

Right to erasure — You may request that we delete, destroy, or anonymize your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent.

Right to restrict processing — You may request that we temporarily suspend the use of your personal data in certain circumstances, such as while we verify its accuracy.

Right to rectification — You may request that we correct any inaccurate or incomplete personal data.

Right to withdraw consent — Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You can withdraw consent for optional data collection (location, analytics) in the App's privacy settings.

Right to lodge a complaint — You have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) if you believe your personal data has been processed in violation of the PDPA.

To exercise any of these rights, use the relevant feature in the App or contact us at privacy@cardie.golf. We will respond within 30 days.

---

4. Lawful Basis for Processing

Under the PDPA, we process your personal data on the following bases:

Consent — For optional data processing including location data and usage analytics. We obtain your consent during onboarding and you may withdraw it at any time.

Contractual necessity — For data processing required to provide the Cardie service, including account management, scorecard processing, round history, handicap calculation, and social features (reactions and views within groups).

Legitimate interest — For device information collection necessary for app functionality and security, where such interest does not override your fundamental rights.

---

5. Sensitive Data

Under the PDPA, certain categories of data are classified as sensitive. Of the data Cardie collects, location data may be considered sensitive personal data. We collect location data only with your explicit, separate consent and only when you actively scan a scorecard. You may use Cardie without enabling location data.

Your handicap rating basis preference (men's or women's course ratings) is a functional calculation setting, not demographic or health data, and is not classified as sensitive personal data under the PDPA.

---

6. Data Breach Notification

In the event of a personal data breach that is likely to cause serious harm to you, we will notify the PDPC and affected individuals without delay and no later than 72 hours after becoming aware of the breach, as required by the PDPA.

---

7. Contact

For questions about this addendum or to exercise your rights under the PDPA:

Email: privacy@cardie.golf Entity: Mapraow Labs Pte. Ltd., Singapore

---

This addendum is provided in English and Thai. In case of conflict, the English version governs.