This Privacy Policy explains how Plate Mate collects, uses, shares and protects personal data, and what rights you have. It is our privacy notice under Thailand's Personal Data Protection Act B.E. 2562 (2019) (the "PDPA") and the notifications and guidelines of the Personal Data Protection Committee (the "PDPC").
Short version: we collect only what we need to sell you food, deliver orders, run our vending machines and our partner program. We do not sell personal data. Advertising tracking (Meta Pixel) works only if you click "Accept". You can ask us at any time to see, correct or delete your data.
1. Who we are
The data controller is HEALTHY FOOD 2024 CO., LTD., a company registered in Thailand, operating under the brand Plate Mate (formerly OK Healthy Food) ("Plate Mate", "we", "us").
- Registered address
- 18/395 Moo 5, Nong Prue Subdistrict, Bang Lamung District, Chonburi, Thailand
- Company registration no.
- 0205567029088
- Privacy contact (email)
- privacy.platemate@gmail.com
- Phone
- 096-296-4888 (+66 96 296 4888)
- WhatsApp / Telegram
- links in the website footer; Telegram @okhealthyfood
- Website
- https://platemateth.com
We have not appointed a Data Protection Officer (DPO), because the PDPA does not currently require it for our type and scale of processing. Please send all privacy questions and requests to the email above. If we appoint a DPO later, we will publish the contact details here.
2. Scope of this policy
This policy applies to personal data we process when you:
- visit platemateth.com, including the vending map and menu, the meal plans page, the frozen sets page and the partner program page;
- buy food or drinks from a Plate Mate vending machine;
- order meal plans or frozen sets, usually through WhatsApp, Telegram or LINE;
- apply to our partner program, or are introduced to us as a building manager, committee member or other contact;
- write to us by email, phone, messengers or on social media (for example Instagram @platemate_th);
- send us a complaint, refund request or feedback.
It does not cover websites, apps and platforms run by other companies, even if we link to them (see section 15). How we sell food and run the partner program is described in our Terms of Use.
3. What personal data we collect
We collect data directly from you, automatically when you use our website, and in some cases from third parties (for example a payment provider confirming a payment, or a partner who introduces a building manager to us).
| Context | Examples of data | Source |
|---|---|---|
| Website visit | IP address, browser and device type, operating system, language, pages viewed, date and time, referring page, advertising campaign tags (UTM) from the link you followed, technical logs and security signals | Automatically, through our hosting provider Cloudflare and our website |
| "Find the nearest machine" button | Your device location (coordinates). It is used only inside your browser to sort machines by distance and is not sent to our servers. If you accepted Meta Pixel, only the ID of the nearest machine and the rounded distance are sent as an event, not your coordinates. To show the map around you, your browser loads map images for that area from the map tile provider | Your browser, only after you allow location access |
| Meal plan calculator | Sex, age, height, weight, activity level, goal, calculated calorie target. Calculated only in your browser and not sent to us. It reaches us only if you include the result in your message to our manager | You |
| Orders (meal plans, frozen sets) | Name, phone number, messenger account name, delivery address and location pin, order details, delivery date and time, delivery notes, payment confirmation (for example a transfer slip), messages with our manager | You, through WhatsApp, Telegram, LINE, phone or email |
| Vending purchases | Machine, product, time and amount of the sale, payment method. We do not receive your card number or e-wallet account details; payments are processed by the payment provider | Our machines and payment providers |
| Resident wish for a machine | Condo name, city, map link or address (optional), your name (optional), the contact you chose (phone, WhatsApp or email), what you would like to buy, whether you can introduce us to the building manager, comment, language, the page address, campaign tags, IP address and time of submission | You, through the form on our "For residents" page |
| Request from a building | Your name and role, condo or building name, management company, city, type of property, number of apartments and occupancy, map link, possible installation spot, what you are interested in (assessment, tasting, proposal, several buildings), the contact you chose, comment, language, the page address, campaign tags, IP address and time of submission | You, through the form on our "For building managers" page |
| Partner program application | Your name, agency (optional), the contact you chose, building name, city, map link, number of apartments and occupancy (optional), how you are connected to the decision makers, comment, language, the page address, campaign tags, IP address and time of submission | You, through the partner program form on our website |
| Partner program participation | If you take part in a partner program, we give you a separate notice about any additional data we need at that stage. | You |
| Building contacts | Name, position, work phone and email of juristic office staff or committee members we deal with | You, a partner who introduced you, or public sources |
| Communication | Emails, chat messages, call notes, social media messages and their content | You |
| Marketing measurement | Meta cookie identifiers, page views and button clicks (for example WhatsApp or Telegram buttons, form submission) | Meta Pixel, only after you click "Accept" |
| Machine camera | Images of people near the machine at the time of a purchase, malfunction or incident | Automatically, by the camera built into some of our machines |
| Complaints and refunds | Description of the problem, photos, receipts or payment slips, machine location, time of purchase, refund account details | You |
4. Sensitive personal data
We do not intentionally collect sensitive personal data as defined in Section 26 of the PDPA (for example health data, religious beliefs, biometric data).
Sometimes customers tell us about allergies, dietary restrictions or health conditions so that we can adjust an order. If you choose to share such information, we use it only to prepare and deliver your order, on the basis of your explicit consent, and we keep it only as long as needed for that purpose. Please do not send us medical documents. Our meal plans are not medical nutrition and do not replace advice from a doctor or dietitian.
5. Why we use your data and on what legal basis
| Purpose | Lawful basis (PDPA) |
|---|---|
| Taking, preparing, delivering and supporting your orders; answering your questions | Contract, or steps before entering into a contract at your request (Section 24(3)) |
| Running our vending machines, processing sales, handling malfunctions, refunds and complaints | Contract (Section 24(3)); legitimate interests (Section 24(5)) |
| Reviewing partner applications, contacting you and the building, preparing agreements | Contract or pre-contract steps (Section 24(3)) |
| Tax and accounting records, bookkeeping, responding to authorities | Legal obligation (Section 24(6)), including the Revenue Code and the Accounting Act B.E. 2543 |
| Contacting building management and juristic offices about installing a machine | Legitimate interests (Section 24(5)) |
| Reviewing disputed purchases and malfunctions, protecting machines against damage and theft (machine camera) | Legitimate interests (Section 24(5)) |
| Website security, preventing spam, fraud and abuse, keeping technical logs | Legitimate interests (Section 24(5)) |
| Improving our menu, machines, locations and website using sales statistics and feedback | Legitimate interests (Section 24(5)) |
| Measuring advertising with Meta Pixel and similar marketing technologies | Consent (Section 19) |
| Sending promotional messages and offers | Consent, or legitimate interests where the law allows for existing customers; you can always opt out |
| Using health-related information you volunteer for an order | Explicit consent (Section 26) |
| Establishing, exercising or defending legal claims | Legitimate interests (Section 24(5)); Section 26(4) for sensitive data |
| Transfers abroad where no other safeguard applies | Consent or another exception under Section 28 |
Where we rely on legitimate interests, we balance our interests against your rights and freedoms. You can object to this processing (see section 12).
6. AI-assisted processing
To answer partner applications faster, we may use an AI model (Claude, provided by Anthropic) to summarise an application and to draft an email reply. The data shared for this is the content of the application and our previous correspondence with you.
- A person at Plate Mate reviews, edits where needed and approves every message before it is sent.
- We do not make decisions that have legal or similarly significant effects on you solely by automated means.
- We do not use your data to train AI models, and we use the AI service under terms that restrict the provider from using our business data to train its models.
7. Cookies and similar technologies
Our website uses a small number of technologies that store or read information on your device:
| Name / technology | Purpose | Type | Duration |
|---|---|---|---|
| pm_lang (localStorage) | Remembers the language you chose | Strictly necessary | Until you clear your browser data |
| pm-consent (localStorage) | Remembers whether you accepted or declined Meta Pixel, and when | Strictly necessary | Until you change your choice or clear your browser data |
| Cloudflare security and performance | Protects the site against attacks and bots, delivers pages quickly | Strictly necessary | Short-term, set by Cloudflare |
| Meta Pixel (for example _fbp cookie) | Measures visits from our ads and actions such as clicks on WhatsApp or Telegram buttons and form submissions | Marketing, only with consent | Up to about 3 months for _fbp, as set by Meta |
Meta Pixel is loaded only after you click "Accept" in the banner. If you click "Decline", it is not loaded. You can change your choice at any time with the "Privacy settings" link in the website footer. Withdrawing consent stops future collection but does not affect what was collected before.
When your browser loads fonts (Google Fonts) and map images (OpenFreeMap, based on OpenStreetMap data), those providers receive your IP address and technical request data, as with any website resource. We do not use these services to track you.
You can also block or delete cookies and local storage in your browser settings. Strictly necessary items are needed for the site to work properly.
8. Who we share your data with
We share personal data only when needed for the purposes above, with:
- Cloudflare: website hosting, content delivery, security, and the database where partner applications are stored (Cloudflare Workers and D1);
- Meta Platforms: Meta Pixel (only with consent) and WhatsApp, when you message us there;
- Telegram: when you message us there, and for internal notifications about new partner applications to our team;
- LINE: when you message us there;
- Google: our email mailbox partners.platemate@gmail.com (Gmail), Google Fonts, and Google Maps Platform to find a building by the name you type in our forms;
- OpenStreetMap / Photon (komoot): finding a building by name when Google search is not used. Only the building name and the site language are sent, never your contact details;
- Resend: sending service emails, when this service is enabled;
- Anthropic: AI drafting of replies to partner applications (see section 6);
- OpenFreeMap and OpenStreetMap data: map display;
- delivery couriers and riders: your name, phone, address and order details needed for delivery;
- payment providers and banks: PromptPay, TrueMoney, Alipay, WeChat Pay, card acquirers and our banks, to process payments and refunds;
- accountants, auditors and professional advisers, bound by confidentiality;
- government authorities, including the Revenue Department, courts and law enforcement, when the law requires it;
- a buyer or successor, if our business or part of it is reorganised, merged or sold, under equivalent protection.
Our service providers act as data processors on our instructions, or as independent controllers under their own privacy policies (for example messenger platforms). We do not sell personal data.
9. Transfers outside Thailand
Several of our providers store or process data outside Thailand, for example in the United States, the European Union, Singapore or the United Arab Emirates, or across global networks of data centres.
We make such transfers in line with Sections 28 and 29 of the PDPA and the PDPC notifications on cross-border transfers in force since 24 March 2024, relying on one or more of the following:
- the transfer is necessary to perform a contract with you or to take steps at your request before entering into it (for example using messengers and email to process your order);
- appropriate safeguards offered by the provider, such as standard contractual clauses or similar contractual commitments and certified security programmes;
- storage or transit through cloud services with appropriate technical protection;
- your consent, after being informed, where no other basis is available.
You may contact us to get more information about the safeguards for a specific transfer.
10. How long we keep your data
| Data | Retention period |
|---|---|
| Requests from residents and buildings, partner applications and related correspondence | Up to 2 years after the last contact; if a partnership or installation follows, for the period of the relationship and the periods below |
| Tax and accounting records | At least 5 years, or longer if required by law (Revenue Code, Accounting Act) |
| Order chats and order records | Up to 2 years after the last order, except records we must keep for accounting |
| Machine camera recordings | Only as long as needed to review a purchase issue or incident, then deleted or overwritten automatically |
| Complaints and refund requests | 3 years after the case is closed |
| Health-related information volunteered for an order | Only while needed to fulfil the order, then deleted |
| Website and security logs | Short periods set by our hosting provider, usually days or weeks |
| Marketing consent and preferences | Until you withdraw consent, plus a record of the withdrawal |
We may keep data longer if the law requires it, or for as long as needed to establish, exercise or defend legal claims, including during legal limitation periods. When data is no longer needed, we delete, destroy or anonymise it.
11. How we protect your data
- Data is encrypted in transit (HTTPS) between your browser and our website.
- Access is limited to staff who need it for their work, with personal accounts and strong passwords or two-factor authentication where available.
- We choose service providers with recognised security practices and limit what data they receive.
- Our forms include protection against spam and automated abuse.
- We review our security measures when our services change.
No system is completely secure. If a personal data breach occurs that is likely to create a risk to your rights and freedoms, we will notify the Office of the PDPC without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk is high, we will also inform you without undue delay, together with the steps we are taking.
12. Your rights
Under the PDPA (Sections 19 and 30 to 36, and Section 73) you have the right to:
- withdraw consent at any time, where we rely on consent. This does not affect processing carried out before the withdrawal;
- access your personal data and get a copy, and ask how we obtained data you did not give us;
- data portability: receive data you gave us in a commonly used machine-readable format, or ask us to send it to another controller where technically feasible;
- object to processing based on legitimate interests, and to direct marketing at any time;
- erasure: ask us to delete, destroy or anonymise your data in the cases set by law;
- restriction: ask us to suspend the use of your data, for example while we check a correction request;
- rectification: ask us to correct inaccurate data and complete or update incomplete data;
- complain to the Personal Data Protection Committee through the Office of the Personal Data Protection Committee (PDPC): www.pdpc.or.th.
How to exercise your rights
- Send your request to privacy.platemate@gmail.com, or contact us by phone, WhatsApp or Telegram.
- We may ask you to confirm your identity, for example by replying from the phone number or email you used with us. We ask only for what is needed to verify you.
- We respond within 30 days of receiving your request. Requests are free of charge. If a request is clearly unfounded or excessive, we may refuse it or charge a reasonable fee, and we will explain why.
- We may refuse or limit a request where the law allows it, for example when we must keep data for tax purposes or to defend legal claims. We will tell you the reason and record it as required by law.
13. Direct marketing
We send promotional messages only with your consent or where the law allows it. Each message gives an easy way to stop further messages, for example telling our manager that you no longer want them. You can also object at any time by contacting us. Service messages about your order or application are not marketing and will still be sent.
14. Children and minors
Our services are intended for adults. Under Thai law, a person under 20 years of age is a minor. We do not knowingly collect personal data from children under 10. A minor aged 10 to under 20 should involve a parent or guardian when giving consent for anything the minor cannot do alone under the law.
Our partner program is open only to persons aged 20 and over. We may ask you to confirm your age. If we learn that we hold data of a child without required consent, we will delete it.
15. Third-party websites and platforms
Our website links to and works with services of other companies, such as WhatsApp, Telegram, LINE, Instagram, Facebook and Google Maps. When you use them, their own terms and privacy policies apply. We recommend reading them. We are not responsible for how these companies process data on their platforms.
16. If you do not provide your data
Most data we ask for is needed to provide our services. If you do not provide it:
- without contact details and an address we cannot accept or deliver an order;
- without the required fields we cannot review a partner application or contact you about it;
- without details of a purchase we may be unable to check a complaint or process a refund.
Declining Meta Pixel has no effect on your ability to use the website.
17. Changes to this policy
We may update this policy when our services, providers or the law change. The date at the top shows the latest version. If changes are significant, we will announce them on the website and, where required, ask for your consent again.
18. Language versions
This policy is available in English, Thai and Russian. If the versions differ, the English version prevails to the extent permitted by law.
19. Contact us
- Company
- HEALTHY FOOD 2024 CO., LTD. (Plate Mate)
- Address
- 18/395 Moo 5, Nong Prue Subdistrict, Bang Lamung District, Chonburi, Thailand
- privacy.platemate@gmail.com
- Phone
- 096-296-4888 (+66 96 296 4888)
- Telegram
- @okhealthyfood
See also our Terms of Use.