Privacy Policy

This policy explains how WalnutZite collects, uses, and discloses your personal data. It is prepared under the Personal Data Protection Act B.E. 2562 (2019) (PDPA) and aligns with the General Data Protection Regulation (GDPR) for users in the European Economic Area.

1. Data Controller

WalnutZite platform ownerlocated at Bangkok, Thailandis the data controller for the account data of this service. Contact us about personal data at walnutzite@gmail.com

2. Our role differs by data type

This point matters and is often overlooked: because WalnutZite is a website-building tool, the data involved falls into two layers that the law treats differently.

• Your account data — name, email, payment information, system usage. We are the data controller and this policy applies directly.
• Visitor data on the website you build — people who fill out a contact form, place an order, or book on your site. We are only the data processor acting on your instructions, and you are the data controller for those people. This means you have a legal duty to publish your own website's privacy policy, obtain consent where required, and respond to visitors' rights requests.

3. Data we collect

• Account data — website name, website address (subdomain), email, and your password after one-way hashing. We do not store and cannot read your password.
• Data from third-party sign-in — if you choose to sign in with a Google account, we receive only your email, name, and profile picture. We do not access any other data in your Google account.
• Usage data — aggregate page counts and visits, and timestamps of key actions (create, edit, publish), for security and for billing under your plan.
• Technical data — IP address, browser type, and access time, kept to prevent abuse and to enforce rate limits.
• Payment data — we do not store your credit card number. Payments are processed by a PCI DSS-compliant payment provider. We keep only the payment status and the information needed to issue receipts.

4. Purposes and legal bases

We process your data under the following legal bases:

If you do not provide the data needed to perform the contract, such as your email and password, we will not be able to create an account or provide the service to you.

5. Cookies

We use only the cookies strictly necessary for the system to function: cookies that keep you signed in and security cookies. These cannot be disabled because the system would not work without them. The sign-in cookie is set as host-only and carries theHttpOnly and Secure flags so that client-side scripts cannot read it.

We do not use cookies for advertising or cross-site tracking. Visit statistics are collected in aggregate and are not tied to an identifiable person.

6. Disclosure of data

We do not sell your personal data. We disclose data only to the following parties, and only to the extent necessary:

• Global cloud infrastructure and content delivery network (CDN) providers, for hosting data and serving your website
• PCI DSS-compliant payment providers
• Transactional email providers, for confirmation and notification emails
• Government authorities or courts, when required by a lawful order

Every provider is contractually bound to process data only on our instructions. You may request a full list of our data processors at walnutzite@gmail.com

6.1 Registering a domain through us — a different case

If you register a domain through WalnutZite, we must send thedomain holder's name, address, email, and phone numberto the domain registrar and to the registry for that extension, because ICANN's rules and each extension's rules require accurate holder data to be on file for the entire registration period.

These recipients are not data processors acting on our instructions — unlike the providers listed above, they are independent data controllers of their own under domain-industry rules. This means:

• Some of your data may be published through the public WHOIS/RDAP system. How much is published depends on the domain extension and on whether a privacy/proxy service is in use.
• They may keep your data even after you delete your account with us, for whatever period their own rules set — typically the full registration period plus some time after expiry. Deleting your account with us deletes the data we hold, but cannot delete what the registrar holds.
• When you transfer a domain out to another provider, the holder data remains with the registry for that extension.

For this reason we ask for your separate consentbefore we send holder data out for the first time, and we record the date and time you gave it. If you do not consent, we will not register the domain for you — you can still register elsewhere and connect it to your website as usual. The legal basis for this data transfer is necessity for performance of the contract under which you asked us to register the domain.

7. International data transfers

Our systems run on a network of servers distributed across multiple countries so your website loads quickly. Your data may therefore be processed outside Thailand. We transfer data only to destination countries with adequate data-protection standards, or rely on Standard Contractual Clauses with our providers, as required by PDPA Section 28 and GDPR Chapter 5.

8. Data retention periods

• Account data and website content — kept for as long as your account is active. After a website is suspended, we retain the data for a further 1 year, in two periods: the first 90 days, when the site is restored immediately on ordinary payment, and day 91 through day 365, when the data remains intact but the website is archived — restoring it in this period carries an additional data-retention fee. Once the 1 year has passed, the data is permanently deleted. (A trial website that was never subscribed to is deleted 90 days after the trial ends.) We send periodic email reminders before the deletion date.
• Personal data of visitors to your website — orders, contact-form messages (including RSVPs), members, and newsletter recipient lists are kept with your website and deleted together with it, never earlier. You control this data as the site owner: you can export your orders, members, and newsletter recipients at any time from Tools > Export, read contact-form messages in your Messages inbox, and ask us to delete specific records or send you a copy of anything else.
• Files you delete from the media library — moved to the recycle bin and kept for 7 days so they can be restored; after that, the system deletes them permanently and automatically. While in the bin, files still count toward the website's storage quota. If you need to delete a file immediately (for example, to fulfil an erasure request), use the permanent-delete button or empty the recycle bin from the media library page.
• Website content backups — your website content is backed up automatically once a day; we keep the 7 most recent daily backups plus 4 more weekly backups (covering roughly the past month). If you save a manual restore point, we keep the 3 most recent, and the snapshot the system saves before each restore is kept for 30 days. Backups past their retention period are deleted automatically. Backups are encrypted at rest, do not count toward the website's storage quota, and are deleted in full along with the website when its data is deleted. Backups cover content only — they do not include orders, members, or newsletter recipient lists, which can only be restored by requesting them from our team.
• Database recovery history — our database provider keeps a point-in-time recovery history of the last 30 days, which we use only to recover from a technical failure. Data that you or we delete, including data erased at the end of a retention period or on your request, leaves this history within 30 days of the deletion.
• Technical and security logs — kept for no more than 12 months.
• Domain holder data — kept for as long as you have a domain registered through us, because the registrar requires it on file for the entire registration period. After your last domain with us expires, we keep an encrypted copy for 12 months to respond to domain-name ownership disputes, then delete it. What the registrar itself holds is governed by Section 6.1.
• DNS record copies — if you point a domain's nameservers at another provider, we keep a copy of its DNS records so we can rebuild them when you return; we delete the copy when you return, when the domain is removed from your account, or when your account is deleted.
• Accounting and tax records — kept for 5 years as required by the Revenue Code, even after you close your account.

9. Security

Passwords are stored as irreversible hashes. All data is transmitted over HTTPS. Each website's data is isolated at the database level, and keys used to connect to external services are encrypted at rest. If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify the Office of the Personal Data Protection Committee within 72 hours and notify you without undue delay, as required by law.

10. Your rights

Under PDPA Sections 30 through 36, you have the following rights:

• Right of access — request to view and obtain a copy of your personal data.
• Right to rectification — request correction of inaccurate or outdated data.
• Right to erasure — request deletion or anonymization of your data.
• Right to restrict processing — request that we temporarily stop using your data.
• Right to object — object to processing carried out under the legitimate-interest basis.
• Right to data portability — request your data in a machine-readable format, or request that we transfer it to another data controller.
• Right to withdraw consent — withdrawable at any time, without affecting processing carried out before withdrawal.
• Right to lodge a complaint — you may complain to the Personal Data Protection Committee if you believe we have failed to comply with the law.

Exercise these rights by sending a request to walnutzite@gmail.comWe will respond within 30 days of receiving your request, and there is no charge for a normal request.

11. Data of minors

This service is intended for business operators and is not directed at anyone under 20 years old. If a minor wishes to use the service, they must obtain consent from their legal guardian under PDPA Section 20. If we discover that a minor's data was collected without valid consent, we will delete that data.

12. Changes to this policy

If we make a material change, we will notify you by email or through the website admin dashboard at least 30 days before it takes effect, and we will always update the effective date at the top of this page.

13. Contact us

Personal data matters and rights requests: walnutzite@gmail.com
General inquiries: walnutzite@gmail.com
Address: Bangkok, Thailand