Privacy policy
This website is a static information site. We do not use advertising or tracking cookies, third-party analytics (e.g. Google) or user accounts.
Contact
If you contact us via WhatsApp, phone or e-mail, we use your details only to answer your request. WhatsApp is operated by WhatsApp Ireland Ltd./Meta; their privacy policy applies. WhatsApp messages started from this website contain a short reference code (e.g. “Ref: X-GEN-EN-HEADER-1234”). It only shows us which page and button you used, is kept temporarily in your browser tab and is visible to you before you send the message. To see which pages bring enquiries, a click on a WhatsApp button also sends this reference code (project, language, page area – no name, no phone number, no IP address stored) to our own server, where it is only counted.
If you tap “Get new projects first” and allow notifications, we store only the push address created by your browser and your language on our own server, to tell you about new projects and reports at most once a day. You can turn this off at any time with the same button or in your browser settings; the address is then deleted.
Enquiry forms
On the report page, on the project pages and in the contact section you can – as an alternative to WhatsApp – send us an enquiry with a form (instant PDF, price list & floor plans, call back). We then process the details you enter: your (first) name, your WhatsApp/phone number or e-mail address and – only if you choose them – country, budget, purchase timeframe, purpose, unit types, preferred language, preferred contact channel and call-back time. The country may be preselected from your location; you can change or remove it. In addition, the enquiry contains the page and project it was sent from, the language version, a campaign or referral code from the link (if any), the device type (phone, tablet, computer), the time and the text of your consent. We do not store your IP address with the enquiry and use no cookies or fingerprinting for it.
Purpose: to answer your request, send you the information you asked for and contact you about it. Legal basis: your consent, which you give by ticking the box (Art. 6(1)(a) EU GDPR; consent under the Thai Personal Data Protection Act, PDPA). Providing the data is voluntary – without it we cannot answer via the form, but you can always write to us on WhatsApp instead.
Security: your details are encrypted in your browser before they are sent (end-to-end, public-key encryption) and are stored on our own server (Cloudflare) only in encrypted form. Only our team can decrypt them in our internal enquiry inbox – neither the hosting provider nor anyone else can read them. Status, notes and the responsible advisor are stored encrypted as well; notifications to our team contain no personal data. The server only keeps anonymous totals (day, form, project, language, source). To prevent misuse, a pseudonymised value (a hash of your IP address and a secret that changes daily) is counted for at most 2 hours – never together with your enquiry.
Storage period: enquiries are deleted automatically 18 months after receipt at the latest, earlier if you ask us. Your rights: you can withdraw your consent at any time with effect for the future (this does not affect processing before the withdrawal) and ask for access, correction, deletion, restriction or a copy of your data, and you can lodge a complaint with a data protection authority. A short message to us via WhatsApp or e-mail is enough.
Statistics without cookies
To see how many people visit this website and which pages, functions and contact buttons are used, our own server (Cloudflare – no Google, no third parties) counts visits. Your browser sends the page address (without any parameters – e.g. names in personal offer links are never transmitted), the language version, the referring website (domain only, e.g. instagram.com) or a campaign code from the link, and a screen-size class; the server adds the country (derived from the IP address) and the device type (phone, tablet, desktop). We also count anonymously which functions are used – e.g. project finder (steps and the answers chosen), project comparison, yield calculator (used or not – never the values entered), quiz (number of correct answers), viewing booking (weekday and hour), photo gallery and floor plans, videos, map, language and currency switches, push notifications and sharing – as well as downloads (e.g. brochures, condo report, contact card, calendar file, story images) and links to other websites (e.g. Google Maps, YouTube, Instagram). When you leave or hide a page, we record how far it was scrolled (in steps of 25 %) and roughly how long it was actively used (in time ranges). When you tap a WhatsApp, phone or e-mail button, we count which of our business contacts and which page or project it was – never your own number or name, and never what you type into forms or messages. To count unique visitors per day without cookies, a daily ID is calculated from a secret value that changes every day, your IP address and your browser identifier; your IP address itself is never stored, daily IDs are deleted after 2 days and cannot be traced back to you. Only totals are kept (up to 3 years); a list of the latest anonymous actions (country, device type, page and action – no IP address, no ID) is kept for 48 hours. Bots are not counted. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is recorded. Devices of our own team are excluded from the statistics by a setting stored only in that browser.
Contact log (origin of enquiries)
When you contact one of our advisors from this website by WhatsApp, phone or e-mail, or send one of our request forms, we store a pseudonymous log entry: time, type of contact, the reference code that appears in your message (e.g. “Ref: X-COPA-DE-HEADER-4821”), advisor, project, language, how you found us (e.g. Instagram), page, country and device type (mobile, tablet or computer). We do not store names, phone numbers, e-mail addresses or IP addresses in this log, and no cookies are used.
Purpose: assigning enquiries to the channel they came from (website and social media) – our legitimate interest in the correct internal attribution of enquiries (Art. 6(1)(f) GDPR; Thailand: PDPA, legitimate interest). The entries are linked by cryptographic hashes (SHA-256), so later changes become visible. They are deleted automatically after 24 months. If your browser sends “Global Privacy Control” or “Do Not Track”, no entry is created.
X Academy (training)
For our training “X Academy” (access only with a personal code) our own server (Cloudflare – no third parties) stores: an encrypted fingerprint (hash) of the access code – never the code itself –, a first name as label, the chosen language, creation and expiry date and the learning progress (completed lessons, quiz and exam results, certificate number). We do not store an e-mail address, phone number or IP address; to protect against misuse, failed attempts are only counted briefly in memory (without IP). The name on the certificate is entered only in your browser and is not transmitted. Anyone who knows a certificate number can check its validity with date and result – without a name.
Purpose: providing the training and proof of completion. Legal basis: performance of the training agreement (Art. 6(1)(b) GDPR; contractual basis under the Thai PDPA). The data is deleted automatically 24 months after the last activity, or immediately on request.
Marketplace (listings and enquiries)
When you list a property, we store the details and photos of the property to check and publish the listing (photos are reduced in size in your browser and location data is removed). Your name and contact details go end-to-end encrypted to our enquiry inbox – they are never shown publicly. Your personal link lets you manage or delete the listing at any time. Listings in review are deleted after 45 days, ended listings after 12 months. Enquiries about a listing and search requests are stored like our other enquiry forms (encrypted, deleted after 18 months at the latest). Descriptions are translated automatically with an AI translation service of our hosting provider (Cloudflare); only the description text is processed, without personal data.
Enquiries via WhatsApp, phone or at our showroom
If you contact one of our advisors directly (e.g. via WhatsApp, phone or at our showroom), the advisor may record your first name, contact details, language and property interest in our encrypted enquiry inbox, so that your enquiry is handled reliably and no request gets lost. Only authorised persons at X Property can read these entries. If your first message contained a reference code from this website, we note that the contact came via the website. The entries are deleted after 18 months at the latest – or earlier on request.
Language and country
If you open the English version, we show you the same page in your language when your browser language (or, if unknown, your country) matches one of our languages. If you choose a language yourself, a small cookie “xl” (language code, 1 year) remembers your choice so that we never switch it again. A cookie “xc” (country code only, 30 days) is used to preselect the currency. Both cookies contain no personal data and are not used for tracking.
Purchase tracker
If your advisor sets up a personal purchase tracker for you (page /x/kauf/), the status of your purchase – e.g. your first name, project, unit, price, payment steps and dates – is encrypted on the advisor’s device before it is saved on our server (end-to-end, AES-GCM). The key is in your personal link (the part after “#”, which browsers do not send to the server) and – so that your advisor can update the page – also in your advisor’s app, encrypted there with the advisor’s personal PIN. Our server and our hosting provider cannot read the content – but anyone who has the complete link can, so please share it only with people you trust. The server also stores when the page was last updated and last opened (at most once a day). If you turn on notifications, we store the push address created by your browser and your language in order to notify you about a new step, without content; you can turn this off at any time.
You can delete the page yourself at any time with “Delete this page”. To prove that you hold the link, your browser sends the key once; the server only checks it, deletes the content, the notification subscriptions and the advisor’s write key, and does not keep the key. The next time your advisor opens their purchase list, their app automatically removes its short entry for this page (first name, project, key). Only an empty marker with the time of deletion remains, so that the link can show that the page was deleted. Trackers that have been neither opened nor updated for 24 months are deleted automatically. Purpose: keeping you informed about your purchase (Art. 6(1)(b) GDPR; Thai PDPA: contract).
Commission agreement (online acceptance)
If we send you a personal link to accept a commission agreement (page /x/agree/), our server stores the agreement text shown to you, a fingerprint (SHA-256 hash) of this text, its language and the times at which it was sent and accepted or declined. The agreement names the property, the advisor and the commission terms – not your name or contact details. To accept, you tick the box yourself and type your name: we store only a fingerprint (hash) of the typed name, never the name itself, and a fingerprint of your IP address calculated with a secret value – not the IP address itself. If you decline, we store the time, the language and this IP fingerprint. The link contains a secret token of which the server stores only a hash; unused links expire after 30 days.
Purpose: proof that, and on which terms, the commission agreement was concluded – performance of the agreement and our legitimate interest in being able to prove it (Art. 6(1)(b) and (f) GDPR; Thai PDPA: contract and legitimate interest). Our internal finance records refer to deals only by reference codes (e.g. project, listing or enquiry); names and bank details are not stored there in plain text. These records are kept for as long as they are needed as proof of the agreement and to meet statutory retention periods for business and accounting records.
Partner programme
Some visitors reach us through a partner – an independent person who recommends X Property (a partner page /p/… or a link or QR code with a partner code such as “P-…”). The partner code is kept in your browser tab during the visit and is added to the reference code of your WhatsApp message (“· src P-…”); it is also stored with the related entry in our contact log and with enquiry forms, and visits to partner pages are counted in our cookie-free statistics. This is how we credit a recommendation to the right partner. In their partner area, partners see only totals for their own code (page views, contacts, number of enquiries, confirmed brokered deals with date, project and status) – never names, phone numbers, messages or IP addresses of customers.
For partners: a partner page shows only the details the partner has agreed to in writing (e.g. name, photo, languages, contact). Access to the partner area works with a personal code that we store only as a hash, together with the time of the last visit; failed log-in attempts are counted for 2 hours with a pseudonymised value (a hash of the IP address and a secret that changes daily). Applications sent with the “Become a partner” form are stored like our other enquiry forms (end-to-end encrypted). Purpose: correct attribution of recommendations and settlement of partner shares – our legitimate interest and, for partners, performance of the partner agreement (Art. 6(1)(b) and (f) GDPR; Thai PDPA: contract and legitimate interest). Confirmed deals and their status history are kept as proof for as long as partner shares can be claimed and statutory retention periods for business records require.
AI processing (marketplace)
On the marketplace we use Workers AI, the AI service of our hosting provider Cloudflare. The AI models (e.g. from Google, Meta or Microsoft) run on Cloudflare’s own servers; the content is not passed on to the makers of the models. We use it (1) to translate listing descriptions automatically into our website languages when we review and approve a listing – machine translations are marked as such and the original text can be shown; (2) when an owner asks for a suggested description or titles while listing or on the management page – the AI receives only the listing details (e.g. type, size, rooms, price, features, building) and the owner’s own notes, but no name or contact details, and the result is only a marked draft that the owner checks and saves; and (3) when an owner asks for it, to suggest which room each listing photo shows – only small copies of the photos are processed, and our server does not store the result.
Every AI-generated text is checked automatically for contact details and invented numbers and discarded if necessary. AI does not decide whether a listing is published – a person reviews every listing. According to Cloudflare’s published terms, content processed with Workers AI is not used to train the AI models offered there. Purpose: presenting listings in several languages and helping owners with their texts and photos – the service requested by the owner and our legitimate interest (Art. 6(1)(b) and (f) GDPR; Thai PDPA: contract and legitimate interest).
External services
- Map: map tiles by OpenStreetMap are loaded when you view the map.
- Exchange rates: current rates are loaded from open.er-api.com (no personal data).
- Hosting: the hosting provider may process technical access logs (IP address, time) for security.
Hosting by Cloudflare and transfers abroad
This website, our server functions and their databases run on the network of Cloudflare, Inc. (USA). Cloudflare processes the data on our behalf as a processor under its data processing addendum, which includes the EU Standard Contractual Clauses. Cloudflare operates a global network: your request is answered by a nearby data centre, and stored data can be located in data centres in other countries, e.g. in the USA – that is, outside Thailand and the EU. For security and protection against attacks, Cloudflare processes technical access data (e.g. IP address, time, requested address, browser type); our server logs (Workers Logs) are kept by Cloudflare for at most 7 days. Push notifications that you switch on are delivered without content via the push service of your browser’s manufacturer (e.g. Google, Apple, Mozilla or Microsoft).
Your rights
You can ask us at any time which data we hold about you and request its deletion (Thailand PDPA / EU GDPR). Contact: see the contact section.
Version 2026-10-15 · Last updated: 15 October 2026
Condo map (OpenFreeMap)
Our condo map (/map/) and the building maps load map tiles, map fonts and map data from OpenFreeMap (tiles.openfreemap.org), a free map service based on OpenStreetMap data. Only when a map is shown does your browser connect directly to these servers; like any website, they see your IP address and the requested map area. No cookies are set for the map and we share no other data. Building photos and the map software are delivered from our own server. “My location” is only used after you tap the button; your position is processed in your browser only and is never sent to us or stored.
Partner links (Living in Pattaya)
Links to partners on our checklist go through xproperty.pro/out/…. We count clicks per day, partner and language only – no IP address, no cookie, no profile. The counters are deleted after 400 days. Paid partner places are always labelled.
Client voices
If you share your experience on /voice/, the form reaches our inbox end-to-end encrypted (like other enquiries, deleted after 18 months at the latest, earlier on request). With your consent we publish only your first name, country, project and text. You can withdraw at any time with the link you receive – the voice is then removed from the website immediately; published voices are deleted after 36 months at the latest. Voices never enter the first-contact log.
Response time
To show how fast we reply, we count per website enquiry only a time class (under 15 minutes, under 1 hour, under 24 hours or later – unanswered enquiries count as later) and the day of the enquiry. So that each enquiry counts only once, we keep its random internal ID – no names, no contents. The figure appears only from 20 enquiries; counters and IDs are deleted after 400 days.
“We list it for you”
If you ask an advisor to list your apartment, the advisor records the listing on your behalf. It goes online only after you confirm it with your personal link. Your contact details are stored end-to-end encrypted in our inbox. Without confirmation within 14 days the prepared listing is deleted.
If you decline or do not confirm, we also delete your encrypted contact details from our inbox.
Price check for owners
If you request a price or rent check for your apartment on a building page, your details reach us end-to-end encrypted (purpose: preparing the check and contacting you). Like other enquiries they are deleted after 18 months, earlier on request.
Check page (/verify/)
The number check runs only in your browser. For the photo check your browser computes a 16-character fingerprint – the photo is never uploaded. Listing codes and fingerprints are not stored; we keep only anonymous daily counters per type of check and result (400 days).
Anonymous demand for owners
Building alerts: if you ask on the condo map or a building page to be told when a unit becomes free in a specific building, our server also keeps an unencrypted monthly count per building (building ID, buy or rent, number) – no names, contact details or times. Our advisors use these counts to ask owners in that building about listing their unit. The counts are deleted after about 3 years.
After a sale or rental
When an owner marks a listing as sold or rented, they can voluntarily state the price achieved. We store it without personal data for 5 years and publish it only summarised, from 5 cases per area.
Lease-end reminder
Owners can store the month in which a lease ends. We use it only to remind the owner and their advisor about renewal or re-letting – it is never public and never sent to the tenant.
Founder programme and neighbour referral
Listings in the founder programme stay online for 180 days instead of 90.
If a neighbour lists through your referral link, your listing is extended once by 90 days. Otherwise the marketplace runtimes stated above apply.