Privacy Notice

Grand Freight X Solutions Co., Ltd. ("GFX") is the data controller for the personal data described in this notice. Our office is at 15th Floor, JLK Tower, 129 Sukhumvit Rd, Khlong Toei Nuea, Bangkok 10110, Thailand.

For anything about this notice, or to exercise any of the rights in section 9, write to network@gfxth.com. Office hours are Monday to Friday, 9:00 to 18:00 (ICT).

Almost everyone whose data GFX holds is acting for a company rather than in a personal capacity. The categories are:

• Staff at customers, agents, carriers, brokers and suppliers

  What we hold

  Name, job title, employer, work email, work telephone, and the content of our correspondence with you.

• People named on transport documents

  What we hold

  Shipper and consignee contact names, telephone numbers and addresses as they appear on an air waybill, bill of lading, packing list or customs declaration. Occasionally a driver name or a signature on a proof of delivery.

• People who use the enquiry form on this website

  What we hold

  Name, company, email, telephone if you give it, and whatever you write in the shipment and message fields.

• Visitors to this website

  What we hold

  Web server records, including IP address, the pages requested and the time of the request.

GFX does not seek sensitive personal data as the PDPA defines it, and does not ask for it on any form. Where a customs process requires an identity document, we take the number we need and avoid keeping a copy of the card, because a Thai identity card shows religion, which is sensitive data.

Some of it comes from you, when you write to us, fill in the enquiry form, or hand us a document. A great deal of it does not.

In wholesale freight forwarding, shipper and consignee details normally reach GFX from another freight forwarder, an overseas agent or a carrier, as part of a booking. If your name is on a shipment GFX handles, that is most likely how we came to have it. GFX requires its partners to have told you about this and to have a lawful reason for passing it on, and this notice is published at a fixed address so that they can point you to it.

• Answer an enquiry and prepare a quotation

  Legal basis under the PDPA

  Steps taken at your request before entering a contract, section 24(3).

• Book, move, clear and deliver a shipment

  Legal basis under the PDPA

  Performance of a contract, section 24(3), and our legitimate interests in running the service, section 24(5).

• Keep in contact with the people we work with at partner companies

  Legal basis under the PDPA

  Legitimate interests, section 24(5). Only work-role information, used for work.

• Meet customs, carriage, security, tax and accounting obligations

  Legal basis under the PDPA

  Compliance with a legal obligation, section 24(6).

• Keep web server records, and keep this site secure

  Legal basis under the PDPA

  Legitimate interests, section 24(5).

• Send market updates or other marketing by email

  Legal basis under the PDPA

  Consent. You can withdraw it at any time and every message carries a way to stop.

Giving us your details through the enquiry form is not required by any law or contract. You do not have to. But without a name and an email address we cannot reply to you, and without the route, weight and dates we cannot say anything useful about your shipment.

Where information is needed to move cargo, such as the consignee details that go on a transport document, it is effectively required: a carrier will not accept the shipment without it, and customs will not clear it.

• Enquiries that do not become a shipment

  How long

  24 months

• Shipment records, and the accounting records that go with them

  How long

  5 years, and longer where tax, accounting or customs law requires it.

• Business contact details of people we work with

  How long

  For as long as the working relationship continues, and a reasonable period after it ends.

• Web server records

  How long

  90 days

GFX shares personal data with the following categories of recipient, and only as far as the work requires:

• Airlines, shipping lines, terminal and ground handling operators, and trucking companies.
• Overseas agents and partner freight forwarders at origin and destination.
• Customs brokers, and customs and other government authorities in Thailand and abroad.
• Insurers, where cargo insurance is arranged on instruction.
• Our own service providers, including website hosting, email, and accounting, who act on our instructions under a written agreement.
• Professional advisers, and authorities where the law requires it.

GFX does not share customer lists with its partners, and does not use shipment information to approach the customers behind them. That commitment is part of the Partner Trust Charter in our Terms & Conditions.

Freight forwarding cannot be done inside one country. To move a shipment, GFX has to send the details to the people who will handle it at the other end, which means the destination agent, the airline or shipping line, and the customs authority of the destination country. This is inherent to the service, not an extra use of your data, and it happens on every international shipment.

Where personal data goes to a country whose protection standards have not been recognised, GFX relies on the exceptions in the Act: transfer necessary to comply with a legal obligation, and transfer under a contract made in the interests of the person concerned, such as an agreement with a destination agent who cannot deliver the goods without the consignee’s contact details. Where neither applies, GFX relies on contractual safeguards agreed with the recipient.

Under the PDPA you can ask GFX to do any of the following. Write to network@gfxth.com and we will respond as quickly as we can.

1. 1

   Access. Ask what personal data we hold about you, and get a copy of it.

2. 2

   Portability. Ask us to send data you gave us to another organisation, where that is technically possible.

3. 3

   Object. Object to our using your data, including for direct marketing, which you can stop at any time.

4. 4

   Erasure. Ask us to delete or anonymise your data, where we no longer have a reason to keep it.

5. 5

   Restriction. Ask us to stop using your data for a period, for example while a correction is being checked.

6. 6

   Rectification. Ask us to correct data that is wrong, out of date or incomplete.

7. 7

   Withdraw consent. Withdraw consent where we relied on it. This does not affect anything done before you withdrew it.

8. 8

   Complain. Complain to the expert committee of the Personal Data Protection Committee if you believe GFX has broken the law.

GFX keeps personal data on business systems protected by access controls, and gives staff access only to what their work requires. Service providers who handle data on our behalf do so under a written agreement that requires them to protect it and to tell us quickly if something goes wrong.

If a breach of personal data occurs that is likely to affect your rights, GFX will notify the Office of the Personal Data Protection Committee, and will tell you directly where the risk to you is high.

This website does not use advertising cookies and does not track you across other websites. The site remembers your language choice so that it does not have to ask again.

Our web host keeps standard server records of requests to the site, including IP addresses, which GFX retains for 90 days for security and for investigating problems. The enquiry form is handled by our hosting provider on our behalf, which means a form you submit is processed outside Thailand.

GFX may update this notice. The version and date at the top of the page show which version you are reading. Where a change materially affects how we use your data, we will say so rather than quietly replacing the page.