Privacy Notice (PDPA)

1. Who we are

VoltaicOS Technologies Co., Ltd., Tax ID / DBD company registration number 0835569016808, registered office 46/419 Phrabaramee Rd, Kathu, Kathu District, Phuket 83120, Thailand, operates the VoltaicOS platform and this website.

Privacy contact: support@voltaic-os.com. Data protection contact: [DATA PROTECTION CONTACT / DPO — TO BE COMPLETED].

2. Our two roles: Controller and Processor

VoltaicOS acts in two clearly separated roles. Where we determine the purposes and means of processing, we are the Data Controller. Where we process data on behalf of a subscribing organisation, that organisation is the Controller and VoltaicOS is the Data Processor.

3. Where VoltaicOS is the Data Controller

We act as Controller for:

• website visitors and their interaction with public pages;
• demo requests and other sales enquiries;
• SaaS account registration and administration;
• subscriptions, payments and Payment Receipts;
• security, access and audit logs;
• support requests and complaint records;
• direct marketing to business contacts who have consented;
• records kept to demonstrate legal and regulatory compliance.

4. Where VoltaicOS is the Data Processor

We act as Processor, on the documented instructions of the subscribing organisation, for data placed in that organisation's tenant:

• the customer's own customers, contacts and employees;
• energy, production and asset records;
• PPA and contract data;
• offtaker information;
• documents, PPA Billing Notes and related operational outputs;
• any other information uploaded or connected by the subscribing organisation.

5. Categories of personal data

• Identity and contact data: name, business email, company, country, job context.
• Account data: user ID, organisation, role, authentication events.
• Commercial data: plan, subscription status, payment records, receipt references.
• Technical data: IP address, device and browser information, approximate country, timestamps.
• Interaction data: support tickets, complaints, demo request content, communication history.
• Tenant-provided data: personal data contained in records uploaded by subscribing organisations.

6. Sources of data

• directly from you (forms, account creation, support requests);
• automatically from your device when you use the website or platform;
• from the subscribing organisation that granted you access;
• from authorised connected systems, meters, monitoring providers and payment providers.

7. Purposes and legal bases

• Providing and administering the platform — performance of a contract.
• Responding to demo requests and enquiries — processing necessary to take steps at your request prior to entering a contract, and our legitimate interest in responding to business enquiries. A demo request does not depend on your consent to this notice, and no acceptance of the VoltaicOS SaaS Terms of Service is required to request a demonstration.
• Billing, receipts and accounting — contract and legal obligation.
• Security, fraud prevention, abuse protection and audit logging — legitimate interest and legal obligation.
• Support, complaint handling and service quality — contract and legitimate interest.
• Direct marketing to business contacts — your separate, explicit and optional consent. Declining marketing consent does not prevent you from requesting a demonstration or receiving a reply. You may withdraw marketing consent at any time by using the unsubscribe link in any marketing message or by contacting us at the privacy address below; withdrawal does not affect processing carried out before withdrawal.
• Regulatory record-keeping and service administration — legal obligation and legitimate interest.

8. Recipients and subprocessors

We share personal data only with service providers necessary to operate the service — cloud hosting, database and infrastructure, transactional email delivery, and the payment service provider [PAYMENT SERVICE PROVIDER — TO BE COMPLETED] — under contractual confidentiality and data-protection obligations. Current subprocessors and hosting locations: [SUBPROCESSOR NAMES AND HOSTING LOCATIONS — TO BE COMPLETED].

We do not sell personal data.

9. International transfers

Some subprocessors may process data outside Thailand. Where this happens, transfers are made under appropriate safeguards permitted by the PDPA, such as adequate-protection standards or contractual protections.

10. Retention

• Demo requests and sales enquiries: retained while the opportunity is active and for a reasonable follow-up period thereafter, then deleted.
• Account data: for the duration of the account and a limited period after closure.
• Payment and receipt records: retained for the statutory accounting and tax retention period under Thai law.
• Security and audit logs: retained for a limited period appropriate to security needs.
• Support and complaint records: retained for service administration and regulatory compliance.
• Tenant data processed on behalf of a customer: retained under that customer's instructions; after termination it remains available for a limited retrieval period, then is deleted or anonymised.

11. Security measures

We apply access control and role separation, encryption in transit, restricted administrative access, tenant isolation, logging and monitoring, and regular review of technical and organisational measures.

12. Data breach handling

We maintain an incident response process. Where a personal data breach is likely to result in risk to data subjects, we notify the Office of the Personal Data Protection Committee, and affected data subjects where required, within the timeframes set out in the PDPA. Where we act as Processor, we notify the Controller without undue delay.

13. Cookies and analytics

The website uses strictly necessary storage to keep the service working and to remember your language and currency preference (stored locally in your browser). Non-essential analytics or marketing cookies are only used where you have given separate consent, and consent can be withdrawn at any time.

14. IP-based language and currency selection

Your IP address may be used to estimate the country you are connecting from, in order to select English or Thai, to display USD or THB, and for security and fraud prevention. This is a country-level estimate only — we do not determine precise geolocation and we do not store your IP address for localisation purposes.

You can always override the automatic selection using the language and currency controls in the site header; your manual choice is stored in your browser and takes priority. Regulatory reporting is never used as a legal basis for additional profiling.

15. Regulatory service metrics

Where applicable, VoltaicOS maintains aggregated records of monthly active users in Thailand, platform revenue generated in Thailand, and complaint and resolution statistics. These records are kept solely for regulatory compliance and service administration, and are not used to profile individuals.

16. Blockchain and personal data

No names, emails, account identifiers, documents, meter readings or other personal data are written directly to a public blockchain. Only non-reversible hashes, Merkle roots or transaction references may be anchored, solely as cryptographic integrity evidence.

17. Your rights under the PDPA

To exercise your rights, contact support@voltaic-os.com. If your data is held in a customer's tenant, we will refer your request to that organisation as Controller.

• access to your personal data and a copy of it;
• rectification of inaccurate or incomplete data;
• erasure or anonymisation, where legal grounds apply;
• restriction of processing;
• objection to processing, including direct marketing;
• data portability;
• withdrawal of consent at any time, without affecting prior lawful processing;
• the right to lodge a complaint with the Personal Data Protection Committee.

18. Complaints

Privacy complaints can be submitted to support@voltaic-os.com. We acknowledge complaints, investigate them and respond within the period required by law. You may also complain to the Office of the Personal Data Protection Committee in Thailand.

19. Version and changes

Version 1.1, effective 2026-10-07 — updated official company registration, address and contact details. Version 1.0 dated 2026-09-03 was the initial document.

Material changes will be published here with a new version number and effective date.