Privacy Policy

This Policy applies to all data we receive from you via the website, messengers, exchange offices, and any other communication channels.

Company: Grither Company Limited, 48/1, village 2

Data protection contact: gritherexchange@gmail.com

To avoid confusion in the wording below:

• Personal data — any information that can identify you: name, phone, email, passport details, etc.
• Data processing — everything we do with your data: collect, store, use, transfer, delete.
• Cookies — small files the site stores in your browser to remember settings and analyse traffic.
• Application — a form or request (on the website, Telegram, WhatsApp, etc.) through which you provide data for currency exchange and related financial services.
• User / Client — you, if you visit the website or use our services.

• We process data on lawful grounds: to perform our contract with you, to comply with legal requirements (AML/KYC, accounting and tax records), for our legitimate interests (security, fraud prevention, web analytics and advertising performance), or with your explicit consent.
• We collect data only to the extent needed for currency exchange, related financial services, and identity verification.
• We do not use data for purposes we have not informed you about.
• We aim to keep data accurate and up to date — if you report an error, we will correct it.
• We keep data no longer than necessary and delete it when it is no longer needed (subject to legal requirements for retaining financial documents).

What you provide yourself:

• first and last name;
• phone, email, Telegram/WhatsApp handle;
• passport or other ID document — required by client verification laws (AML/KYC); exchange cannot proceed without it;
• card/account details — only as needed for the transfer;
• amount and transaction details.

What is collected automatically:

• IP address, browser and device type;
• pages visited, how you reached the site, and time spent on it;
• cookies and web analytics and advertising data — Google Analytics 4, Yandex Metrica (including Session Replay and click maps) and Google Ads. See section 10 for the full list.

If you visit our office:

• CCTV recordings — solely for security and fraud prevention.

In short: to complete the exchange safely and lawfully. In more detail — we use data to:

• verify your identity and perform currency exchange and related financial services;
• comply with client verification and anti-money laundering laws (AML/KYC);
• contact you about your application and answer questions;
• protect you and ourselves from fraud;
• maintain accounting and tax records;
• respond to official requests from government authorities when required;
• improve the website — understand what works and what does not;
• send useful information and offers — only if you have opted in, and you may unsubscribe at any time.

We do not sell your data. We may share it with third parties only in the following cases:

• banks and payment providers — to complete the transfer;
• government authorities — when required by law (e.g. AML checks);
• our contractors (hosting, analytics, IT support) — they must protect data as carefully as we do;
• with your explicit consent — in all other cases.

We currently use the following contractors:

• Vercel Inc. — website hosting (servers in Singapore);
• Google Ireland Limited — Google Analytics 4, Google Ads, Google Maps and Google reviews;
• Yandex LLC — Yandex Metrica and Yandex Maps;
• Mailgun — delivery of emails from the contact form;
• Telegram — delivery of contact form enquiries to our managers, and correspondence if you message us on Telegram;
• WhatsApp (Meta) — correspondence if you message us on WhatsApp.

Data is transferred abroad — the website and analytics services are hosted on servers outside Thailand. We ensure such transfers are covered by appropriate safeguards and go only to contractors with their own data protection commitments.

Data related to exchange operations (including ID verification documents and transaction details) may be retained for up to 10 years — as required by AML rules and the terms of our Thailand licence. After that period, data is deleted or anonymised.

You may at any time:

• learn what data we hold about you;
• request correction of inaccuracies;
• withdraw consent to data processing;
• request deletion of data — unless the law requires us to keep it longer (e.g. AML/KYC);
• object to use of data for marketing;
• lodge a complaint with the relevant supervisory authority if you believe we have violated your rights.

To exercise any of these rights, email us at gritherexchange@gmail.com.

If you are in Thailand

Your data is processed under the PDPA (Personal Data Protection Act B.E. 2562). You may lodge a complaint with the Personal Data Protection Committee of Thailand (PDPC).

If you are in the EU

You also have GDPR rights: data portability, restriction of processing, and objection to automated decision-making. For EU residents, these rights take priority in case of conflict with other sections of this Policy.

• Access to your data is limited to staff who need it for their work.
• We use technical safeguards (encryption, access control, antivirus protection).
• We regularly review data security.
• If a breach occurs — we must remediate it as soon as possible and, where required, notify you.

Cookies are small files that the site and connected services store in your browser. We use three categories of cookies.

Strictly necessary

These keep the site working: they remember your chosen language (NEXT_LOCALE) and light or dark theme. They cannot be disabled — the site does not work correctly without them.

Analytics

These help us understand which pages you use and what to improve:

• Google Analytics 4 (Google Ireland Limited) — cookies _ga and _ga_ followed by the property ID; stored for up to 2 years;
• Yandex Metrica (Yandex LLC) — cookies _ym_uid, _ym_d, _ym_isad, _ym_visorc; stored for up to 1 year. Session Replay and click maps are enabled: they record your actions on the page — mouse movement, clicks, scrolling and form input (excluding password and payment fields).

Advertising

These let us measure advertising performance and show you our ads on other sites (remarketing):

• Google Ads — cookie _gcl_au; stored for up to 90 days. Data about visits and enquiries is shared with Google as a separate controller.

Embedded widgets

Pages with maps and reviews embed Google Maps and Yandex Maps widgets. These services may set their own cookies under their own privacy policies, which we do not control.

How to opt out

• delete or block cookies in your browser settings;
• install the official Google Analytics opt-out add-on: tools.google.com/dlpage/gaoptout;
• opt out of Yandex Metrica: yandex.com/support/metrica/general/opt-out.html;
• manage Google personalised advertising: adssettings.google.com.

Disabling analytics and advertising cookies does not affect how the site works. Blocking strictly necessary cookies may degrade some features.

Our website and services are for adults only (18+). We do not knowingly collect data from minors. If you believe we have received a child’s data, email gritherexchange@gmail.com — we will delete it.

We may update this document. The new version takes effect when published on this page. Continued use of the site after an update means you accept the new version.

If you have questions about this Policy or how we process your data — contact us:

• Company: Grither Company Limited
• Legal address: 48/1, village 2
• Email: gritherexchange@gmail.com
• Phone: +66942628045
• Licence number: MC225670133