Privacy policy

The data controller is NomadNest Co., Ltd., 50, 58-59 Huay Kaew Rd, Chang Phueak, Mueang Chiang Mai, Chiang Mai 50300. For any question or request about your personal data, e-mail support@nomadnest.co.th.

• Contact details: your name, e-mail address and phone number.
• Passport data: the scan of the photo page and the data read from its machine-readable zone (MRZ): names, passport number, nationality, date of birth, sex, expiry date; plus place of birth, date and place of issue.
• The scan of the passport page with your latest entry stamp (and visa sticker), and the date until which you are permitted to stay.
• Your ID photo.
• Arrival details: arrival date, flight or vehicle number, where you came from, port of entry, TM.6 number.
• Your address in Thailand (printed on the forms), and the delivery address and recipient phone for Flash Express.
• For the TM.30 add-on: your proof of address (booking confirmation or rental contract) and the TM.30 receipt.
• Payment metadata: amounts, payment method, payment and refund reference numbers and dates. We never receive or store card numbers: card details go directly to our payment provider. For a refund by bank transfer: the PromptPay number or bank account you give us.
• Technical data: your IP address (for security and abuse protection) and the e-mails we send you.

• To prepare, print and deliver your packet, file your TM.30 if ordered, take payment, process cancellations and refunds and keep you informed: this is necessary to perform our contract with you (PDPA section 24(3)).
• Some documents may show sensitive data (for example religion or blood group printed in a passport), and the automatic photo check analyses your face: we process these only with the explicit consent you give when you order (PDPA section 26). You may withdraw consent at any time; we can then no longer prepare the packet.
• To keep accounting and tax records: a legal obligation (PDPA section 24(6)).
• To protect the service against fraud and abuse (rate limits, security checks): our legitimate interest (PDPA section 24(5)).

We do not use your data for advertising and we do not sell it.

We share personal data only with these service providers, and only what each needs:

• Beam Checkout (Beam Data Co., Ltd., Thailand): payments and refunds. You enter your payment details on Beam Checkout’s own page, not on ours; we receive the payment result, the method and reference numbers.
• Anthropic (Claude API): your ID photo is sent for the automatic photo quality check, and messages our staff write to you may be translated into your language. Anthropic processes this data to return the result and, under its commercial terms, does not use it to train its models.
• Google: our e-mails to you are sent through Google’s e-mail service (SMTP).
• Cloudflare (Turnstile), when switched on: a security check against bots when an order is created and, if needed, before photos are uploaded.
• Flash Express: the recipient name, phone number and delivery address of your parcel only.
• Thai Immigration: you hand in the packet yourself. If you order the TM.30 add-on, we submit the TM.30 notification (name, passport and nationality details, arrival and address details) to Immigration for you.

Scans, photos and documents are stored on our own servers. Passport reading (MRZ) and background removal of the photo run on our own servers as well.

Some providers (Anthropic, Google, Cloudflare) process data outside Thailand. We use them under their data-processing terms, which provide safeguards for such transfers as required by the PDPA.

• Your personal data and files (scans, photo, TM.30 documents, addresses, contact details, form data, refund account) are deleted 30 days after your order ends (sent, picked up, cancelled or refunded). Unpaid orders expire after 24 hours; their data is deleted 1 day later.
• A minimal accounting record — order number, amounts, payment method, payment and refund reference numbers, status and dates — is kept for at least 5 years, as Thai accounting and tax law requires. It no longer contains your name, contact details or passport data.

Under the PDPA you have the right to:

• get access to and a copy of your personal data, and know how we obtained it;
• have incorrect or incomplete data corrected;
• have your data deleted, or its use restricted;
• receive your data in a common electronic format or have it sent to someone else;
• object to processing, and withdraw your consent at any time;
• complain to the Office of the Personal Data Protection Committee (PDPC).

To use these rights, e-mail support@nomadnest.co.th with your order number from the e-mail address you ordered with. We may ask you to confirm your identity and reply within 30 days. Deleting data before your order is finished means we can no longer prepare or deliver your packet; data we must keep by law (section 5) cannot be deleted earlier.

We do not use advertising or analytics cookies. The site stores only what it needs to work:

• in your browser’s local storage: your current order number and its access key (so you can continue the order and see its status) and your language;
• a cookie with your language, so the page opens in the right language;
• Beam Checkout’s payment page (a separate site we send you to for paying) and, when switched on, Cloudflare Turnstile — they may use their own cookies for security and fraud protection.

You can delete these at any time in your browser settings; you then need the link from our e-mails to see your order status.

Your order can only be opened with a random access key that only your device holds; we store only a fingerprint (hash) of it. Files are stored privately and shown to our staff only through short-lived links. Only staff who process orders have access. All connections are encrypted (HTTPS).

We may update this policy; the date at the top shows the current version. Questions or requests: support@nomadnest.co.th, or by post to NomadNest Co., Ltd., 50, 58-59 Huay Kaew Rd, Chang Phueak, Mueang Chiang Mai, Chiang Mai 50300.