"Inno Smart Farm" (website https://www.smartfarm.mnkales.com) is a multi-tenant farm record-keeping system operated by the owner of Farm Bandansuk, Moo 4, Tha Mai Ruak Subdistrict, Tha Yang District, Phetchaburi 76130, Thailand ("the Service Provider", "we", "us"). Service provider in legal name: Inno Smart Farm.
This policy is prepared under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). Our roles are divided as follows.
| Data | Data controller | Data processor |
|---|---|---|
| Account and registration data (name, email, password, PIN, sessions, system usage logs) | The Service Provider | - |
| Data that a farm enters into the system, such as workers, customers, suppliers, plots, yields, photos and audio | The customer farm concerned (the owner or administrator of the farm that registered), because the farm decides which data is recorded and why | The Service Provider, processing only on the farm's instructions and for the farm's purposes |
Accordingly, a farm that uses the system must have a legal basis and must inform its own workers, customers and suppliers before recording their data. If you are a worker, customer or supplier of a farm and want to exercise your rights over data that the farm recorded, please contact that farm first. We will help the farm act on those rights as required by law.
When you press the "Sign in with LINE" button or open an invitation link through LINE, you are sent to the LINE permission page (operated by LY Corporation) and we receive only the following data from LINE.
Purpose: to verify your identity and sign you in, to link the account to farm memberships (for example accepting a farm owner's invitation), and to show the linked LINE name on the farm's user management page. If you add the official Inno Smart Farm account as a friend, it may be used to contact you on LINE later. We do not store LINE access tokens or refresh tokens; they are used once during sign-in and discarded immediately, and we do not view your friend list or chats.
Legal basis: contract (providing the sign-in service, s.24(3)) for the user ID and display name, and consent (s.19) for the email and the friend status, which you give on the LINE permission page and can withdraw at any time.
Retention: until you unlink, a farm owner unlinks your LINE for you, or the account is deleted. Temporary data of the sign-in step (verification code, random value) is deleted within 1 day. An account created with LINE that is not in any farm, has no password set and has had no activity for more than 30 days is deleted automatically together with its LINE link.
Right to unlink: you can unlink at any time yourself under Profile > "Connected accounts" > "Unlink" (you must confirm your password; an account that signs in with LINE only must set a password first), or in the LINE app > Settings > Account > Authorized apps > Inno Smart Farm > Unlink. The system deletes the LINE user ID, display name, picture URL and the email from LINE, and signs out the devices that signed in with LINE immediately (your account and farm data remain). In addition, LY Corporation is the data controller of the LINE service itself; please see LINE's privacy policy.
| Purpose | Legal basis (PDPA) |
|---|---|
| Create and maintain accounts, verify identity, provide the farm record-keeping service as agreed | Contract / steps at the request of the data subject before entering into a contract (s.24(3)) |
| Security: prevent unauthorized access, rate limiting, after-the-fact review (audit log, server log), prevent misuse | Legitimate interest (s.24(5)) |
| Keeping production records under GAP / food safety standards, traceability and product recalls | The farm's legitimate interest (s.24(5)) and compliance with the law (s.24(6)) as applicable |
| Showing lot information on the public QR page | As determined by the farm, limited to the allowlisted data (section 5) |
| Receiving and following up consumer complaints | Legitimate interest (s.24(5)) |
| Counting visits to improve the service and its security (anonymous data, no cookies, no persistent identifier) | Legitimate interest (s.24(5)), based on our own assessment, not legal advice |
| Personnel health data | Explicit consent (s.26) or another basis permitted by s.26, such as compliance with labor / occupational health law |
| User profile picture (if uploaded) | Consent (s.19) |
| Sign in with LINE and linking the account to farm memberships (LINE user ID, display name, picture URL) (section 2.4) | Contract (s.24(3)) |
| Email from LINE and friend status with the official account (section 2.4) | Consent (s.19), given on the LINE permission page and withdrawable by unlinking |
We do not sell personal data, we do not use data for advertising, and we do not build profiles for marketing.
Please do not enter other sensitive data (such as religion, race, criminal records or biometric data) in the notes fields of the system.
| Recipient | Role / data |
|---|---|
| DigitalOcean, LLC (Singapore data center, SGP1) | Cloud infrastructure provider that hosts the server, database, uploaded files and backups |
| LY Corporation (LINE Login / LINE Official Account) | Provides LINE Login and the official account when you choose to sign in with LINE or add us as a friend. LY Corporation is the data controller of the LINE service itself, sends us the data described in section 2.4, and receives your IP address / device data under LINE's policy. We do not send your farm data to LINE. |
| GAP auditors / certification bodies / buyers | When the farm itself chooses to export a report (for example an xlsx file) or shares a link with those parties |
| Government agencies / courts | When a law or an order of a competent authority requires disclosure |
Because the server is located in Singapore, storing and processing the data is a cross-border transfer of data under Sections 28-29. We choose providers with international-standard security measures and use encryption in transit (HTTPS). By registering and accepting this policy, you acknowledge such transfer. We do not sell or disclose data to anyone other than those listed here.
| Data | Period |
|---|---|
| Farm production records | As set in the farm's settings (record_retention_years, default 2 years per GAP requirements) and for as long as the farm uses the service. Farms should keep records for at least as long as the relevant laws / standards require. |
| User accounts | Until you or the farm request deletion of the account, or the farm is deactivated |
| Sign-in sessions | For the life of the session, until you sign out or it is revoked |
| LINE link (LINE user ID, display name, picture URL, email from LINE) | Until you or the farm owner unlink, or the account is deleted (section 2.4) |
| Temporary data of the Sign in with LINE step | 10 minutes during sign-in, then deleted within 1 day |
| Accounts created with LINE that are in no farm and are inactive | Deleted automatically after more than 30 days |
| Audit log | As long as needed for after-the-fact review and security, for the life of the farm's use of the service |
| Visit statistics (raw data, no IP) | 35 days |
| Daily summarized visit statistics | 13 months |
| Server log (journald) | According to the server operating system's rotation / deletion cycle |
| Backups | Daily backups kept for 14 days, then deleted automatically. Deleted data may remain in backups for up to 14 more days. |
| Issue reports from customers (QR) | Kept as part of the farm's complaint records for the record retention periods above |
When the period ends, we or the farm will delete the data or make it non-identifiable, unless the law requires it to be kept longer.
No system is completely secure. You should choose passwords that are hard to guess, not share your PIN, and sign out on public devices.
Under the PDPA you have the following rights.
How to exercise your rights: contact us on LINE ID mimmii38, stating your name, farm and the right you want to exercise. We may ask you to verify your identity before acting, and we will reply within 30 days of receiving the request. Users who are farm owners / managers can edit most data themselves in the system and export the farm's data. Exercising rights may be limited as the law provides, for example for data that must be kept by law or that affects the rights of others.
This service is for adults (age 20 or older, or adult by marriage). Minors who need to use it (for example, workers under 20 whom a farm employs lawfully) must have the consent of their legal representative under Section 20 of the PDPA. If the minor is 10 years old or younger, consent of the person exercising parental power is always required. We do not intend to collect minors' data without such consent. If you find that we have, please tell us so that we can delete it.
If a personal data breach occurs that poses a risk to the rights and freedoms of individuals, we will notify the PDPC within 72 hours of becoming aware of it where feasible, and if the risk is high we will promptly notify the affected data subjects (and the farms concerned) together with remedial measures.
We may update this policy from time to time. For significant changes, we will give reasonable advance notice in the system or through another appropriate channel and update the date / version number above. Unless the law requires fresh consent, continued use after the effective date means you acknowledge the change.
Data controller: Inno Smart Farm (the owner of Farm Bandansuk)
Address: Moo 4, Tha Mai Ruak Subdistrict, Tha Yang District, Phetchaburi 76130, Thailand
Contact channel for personal data matters: LINE ID mimmii38
Data Protection Officer (DPO): not appointed; please use the contact channel above
Supervisory authority: Office of the Personal Data Protection Committee (PDPC)
See also: Terms of Service · ภาษาไทย (Thai version)