Service operator
Loading operator details…
[Owner must provide: legal entity name in English]
[Owner must provide: tax identification number]
[Owner must provide: registered address in English]
[Owner must provide: public contact and privacy email]
Paddle — Merchant of Record
Paddle.com is the Merchant of Record for Paddle purchases in both Thailand and Global editions: Paddle is the seller to the buyer, processes payment and applicable taxes, and issues the buyer’s invoice/receipt and applicable tax documentation. XBalance supplies the software service, not a second invoice for the same Paddle purchase.
Scope and roles — PDPA and GDPR
This policy addresses Thailand’s PDPA and the GDPR where applicable. The service operator controls account and service-operation data. For customer, supplier and employee data entered by a business, that business is the controller and XBalance acts as its processor on documented instructions.
Data and sources
We receive data from you, your business and integrations you choose: names, email addresses, business details, accounting documents, attachments, activity records and device information. Paddle processes purchase and payment information under its own policy. We receive necessary transaction references and payment status.
Purposes and lawful bases
Processing supports contractual service delivery and support, legal obligations, and legitimate interests in security balanced against individuals’ rights. Marketing or other consent-based processing requires separate consent that can be withdrawn. Without necessary information, we may be unable to provide the service.
Recipients and international transfers
Necessary information may be shared with cloud, email and AI providers for tasks you request, or authorities where required by law. We do not sell data. The owner must confirm the subprocessor list, hosting countries and transfer safeguards before launch. Transfers require applicable PDPA and GDPR safeguards, such as adequacy decisions or SCCs where relevant; this draft does not certify that these are already in place.
Retention
Data is retained only as needed for its purpose, contract and applicable accounting or tax obligations. Trial expiry or cancellation does not automatically delete data. Erasure requests are assessed against legal exceptions and evidence-preservation needs; retained records must have restricted use.
Rights and complaints
Subject to applicable law, you may request access, copies, correction, erasure, restriction, portability, objection and withdrawal of consent. Withdrawal does not affect earlier lawful processing. Use the contact below; identity verification is required. Requests are handled within statutory deadlines, generally one month under GDPR with permitted extensions. You may complain to Thailand’s PDPC or the relevant EEA supervisory authority.
Security and breaches
Controls include access restrictions, tenant separation and encryption in transit. No system is completely secure. Qualifying incidents are handled under PDPA/GDPR notification rules, including the 72-hour supervisory-authority deadline where required and notice to affected individuals where applicable.
Cookies, AI and changes
Necessary storage supports sign-in and preferences. Consent-requiring analytics must follow your choices. AI suggestions require human review and are not intended as solely automated decisions with legal effects. Material changes will be communicated through an updated policy.