Privacy Policy

1. Data Controller

BamBite is the data controller responsible for your personal data. For any privacy matter, you can reach us at BamBite@Totals-Inc.com. Our locations are in Pathumwan and Udom Suk, Bangkok, Thailand.

2. Personal Data We Collect

We collect the following categories of personal data. Not all of it applies to every person — browsing the menu collects far less than placing a delivery order.

• Identity and contact — your name, email address, phone number, and date of birth where you give it to us (we use it for the birthday perk and, where relevant, age verification).
• Account credentials — a securely hashed password. We never store your password in readable form. If you sign in with Google or LINE we receive your name, email address, profile picture and an account identifier from them instead of a password. If you sign in by phone, we send a one-time code by SMS.
• Order, reservation and delivery data — what you ordered and any customisation, the outlet, the amount, your contact details for the order, and your billing and delivery address. For delivery orders we also record the precise coordinates of the drop-off point, because the courier needs them to find you.
• Payment data — the amount, currency, payment method and a reference number from our payment provider. We never receive or store your full card number, expiry date or security code — those are entered directly into PayPal’s own secure form and never reach our servers. If you send us a payment slip yourself, for example over LINE, that image reaches our staff and may show your bank account name and a partial account number.
• Membership and loyalty data — your member number and QR code, points balance, rewards redeemed, referral relationships, and stored-value balances. We also derive a simple profile from your ordering history (how recently, how often and how much you order) to decide which offers to show you.
• Preferences you tell us — dietary requirements, allergies, seating preferences, special dates and notes. Allergy and dietary information can reveal health-related details, so we collect it only when you volunteer it, use it only to serve you safely, and you can remove it at any time from your profile.
• Technical and device data — your IP address, browser or app version, device type and pages or screens visited. If you use the site without an account we create a temporary guest record so your cart survives a page refresh; it holds a random guest token, your IP address and browser identifier, and it is deleted automatically after 30 days.
• Notification tokens — if you allow notifications in the mobile app, we store the push token your device issues so we can tell you when your order is ready.
• Reviews you write — the star rating and any comment, plus the name and email address you enter on the form. Your name is shown with the review; your email address is not, and we use it only to keep each dish to one review per person. We also store your browser identifier and a scrambled, one-way version of your IP address — not the address itself — so we can tell repeated fake reviews from real ones. A review is not visible to anyone but our team until it is approved.
• Messages you send us — enquiries, reviews, event RSVPs, job applications including any CV you upload, and support chat conversations.

3. The Mobile App Specifically

The BamBite app asks for a small number of device permissions. Each one is optional, each is requested only at the moment it is needed, and the app works without them:

• Camera — to scan QR codes for member check-in and reward redemption. Scanning happens on your device and no photograph or video is uploaded to us or stored; only the decoded code is used.
• Location — used only while the app is open, to suggest whether Udom Suk or Pathumwan is closer to you, and to set the drop-off point for a delivery order. As a customer, the app never tracks your location in the background; the one exception is the rider portal in section 4, which applies only if you deliver for us. Decline it and you simply pick your outlet yourself.
• Notifications — order and reservation updates and, if you opt in, member offers. You can turn them off in your device settings at any time.

The app shows no advertising and does not use an advertising identifier, and we do not sell your data or share it with data brokers.

4. If You Ride for BamBite

This section applies only to people who deliver orders for us. If you are a customer, none of it describes you. Riders use the same app and website as everyone else, but the rider portal collects things the sections above do not:

• Your application to ride with us — your name, phone number and email address, your LINE ID and vehicle registration if you give them, and the type of vehicle you ride. You may also attach photographs of an identity document and a driving licence. Those two images are visible only to the people who review applications, and are deleted if your application is refused.
• Your live location during a delivery — while you are on duty and a delivery run is under way, the app sends us your position about every 15 seconds: your latitude and longitude, how accurate the reading is, and the direction and speed you are travelling. This is what lets the kitchen and the customer see where an order has got to. It begins when a run begins and stops when that run ends or you go off duty — we do not record where you are between deliveries or after your shift.
• Proof of delivery — a photograph you take at the drop-off point when you complete a run, together with the time you completed it and which orders it covered.

We process the first of these on the basis of your explicit consent, which you give by ticking the box on the application form and may withdraw at any time. The rest we process because it is necessary for the working arrangement between us. Everything in section 13 — your right to see this data, correct it, object to it or complain about it — applies to riders in full.

5. If You Work for BamBite

This section is for employees. If you are a customer, none of it applies to you. Staff sign in to a separate dashboard at admin.bambite.co — the BamBite Admin app is that same dashboard — and it holds employment records that no customer section describes:

• Your employment record and pay — your name, employee number, position, department and branch, your start date and, when it applies, your probation end and leaving dates. It also holds your salary, tax, any bonuses and your net pay. Only administrators and the people who run payroll can see the pay figures.
• Your shifts and attendance — the time you clock in and out, how long that came to, and which branch. To stop clock-ins from anywhere, the system checks the shop's network address and the registered till device instead: clocking in does not record where you are, and there is no location field in a shift record at all. Failed scans are logged with the network address and browser used, so a shared login can be traced back.
• Field visits, if you are enrolled — a few roles visit partners and shops rather than working in one branch. For those people the app can record the visit. It is off for everyone unless management switches it on for you and you then agree to it. Once both are true, and only while you are clocked in, it sends your position roughly every 30 seconds and saves where you stood when you pressed Arrive and Leave, with the place, what the visit was for and how it went. It stops the moment you clock out or either permission is withdrawn, and the server refuses anything sent off the clock.
• Time off you ask for — the dates, the reason you write, whether it was approved, and any note the person deciding left. Please keep the reason brief: it is read by whoever reviews the request, so there is no need to put medical detail in it.
• Documents and signatures — contracts, warnings and other paperwork issued to you, and files kept against your record. These are stored in our own database rather than behind a public link. Where a document is signed in the app, we keep the drawn signature as an image together with the time it was signed and the network address it was signed from, because that is what makes the signature evidence of anything.
• Reviews, tasks and scores — performance reviews written about you, including a rating and notes on strengths and what to improve, the team score at the time it was written, and the tasks you completed with any points and photographs attached to them.

We hold all of this because it is necessary for your employment and, for pay and tax records, because Thai law requires us to. Everything in section 13 applies to you in full: you can ask to see what is held about you, have it corrected, or complain. Asking does not affect your job. Employment records are kept after you leave, for as long as employment and tax law requires — deleting a customer account does not touch them, because they are a different record about a different relationship.

6. Purposes and Lawful Basis for Processing

We process your personal data only where we have a lawful basis under the PDPA:

• Consent — to send you marketing you have asked to receive, for non-essential cookies and tracking, for push notifications, and for storing your dietary and allergy preferences. You may withdraw consent at any time.
• Contractual necessity — to take and fulfil your orders, arrange delivery, manage reservations, run your membership and points, and answer your enquiries.
• Legitimate interests — to operate, secure and improve our services, prevent fraud and abuse, and understand which dishes and offers work, where those interests are not overridden by your rights.
• Legal obligation — to keep accounting and tax records and to comply with lawful requests.

7. Who We Share Personal Data With

We do not sell your personal data. We share it for advertising only if you have accepted marketing cookies — see section 14, where you can also change that choice. We use service providers who process data on our instructions, under agreements requiring them to protect it. The ones that can receive personal data are:

• Payment — PayPal, for card and PayPal payments.
• Delivery — our courier partner, which receives the recipient name, phone number, address and drop-off coordinates for that order.
• Messaging and email — our email delivery providers, our SMS verification provider for one-time codes, LINE for messages you have chosen to receive there, and the internal messaging tools our kitchen staff use to receive order tickets.
• Hosting and media — our cloud hosting provider and our image hosting provider, which stores profile photos, member QR codes and uploaded files.
• Sign-in and digital passes — Google and LINE where you choose to sign in with them, and Apple Wallet or Google Wallet where you choose to add your member card.
• Advertising measurement — if you accept analytics & marketing cookies, Google receives a record of the pages you view through Google Analytics, and LINE receives a record that you visited the site. That is how we can tell how the site is used and whether our LINE advertising reaches anyone. Decline them and neither happens.
• Customer support assistance — our support chat uses an AI service to help draft replies, which means the messages you send in that chat are processed by that provider. Please do not put payment details or sensitive personal information into the support chat.

We may also disclose data where required by law, or to establish or defend legal claims.

8. Digital Tokens and Public Records

If you choose to link a digital wallet address to your account and receive BamBite tokens, that wallet address and the token amount are recorded on a public blockchain. Records on a public blockchain are permanent and cannot be deleted or altered by us or by anyone else, including if you later delete your account. This feature is entirely optional; if you never link a wallet address, nothing about you is written to a blockchain.

9. International Data Transfers

Some of our service providers store or process data outside Thailand. Where personal data is transferred abroad, we take steps to ensure it receives an adequate standard of protection in accordance with the PDPA and any conditions set by the Personal Data Protection Committee (PDPC).

10. Data Retention

We keep personal data only as long as we need it, or as long as the law requires:

• Guest browsing records — deleted automatically 30 days after your last visit.
• Sign-in sessions — refresh tokens expire within days and are destroyed when you log out.
• Order and payment records — retained for the period required by Thai accounting and tax law, even after an account is closed. See the next section for exactly what this means.
• Reviews — kept for as long as the review exists. There is no automatic deletion, because a review is meant to stay useful to the next customer reading it. Ask us and we will remove yours.
• Account data — kept while your account is open, then handled as described below.

11. Deleting Your Account

You can delete your BamBite account at any time, from the app, from your profile on the website, or by asking us. Full instructions, and a plain description of what is erased and what we are required to keep, are on our account deletion page.

In short: your profile, contact details, member card, points balance, preferences and linked sign-in accounts are erased, and you are signed out permanently. Records of completed orders are retained for accounting and tax purposes for as long as the law requires, and those records include the contact and address details supplied with the order. You may ask us to erase those too, and we will do so once the retention period has passed.

12. Data Security

We apply appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, alteration, or disclosure. These include encryption in transit, hashed passwords, role-based access for staff, and short-lived sign-in tokens. No system is perfectly secure, and we will notify you and the PDPC as required by law if a breach affects your data.

13. Your Rights Under the PDPA

Subject to the conditions of the PDPA, you have the right to:

• access your personal data and obtain a copy;
• request rectification of inaccurate or incomplete data;
• request erasure (deletion or anonymisation) of your data;
• request restriction of processing;
• object to the processing of your data;
• request data portability (transfer of your data in a machine-readable format);
• withdraw consent at any time, where processing is based on consent; and
• lodge a complaint with the Personal Data Protection Committee (PDPC).

To exercise any of these rights, email us at BamBite@Totals-Inc.com. We will respond within the timeframes required by the PDPA. We may need to verify your identity first, so that nobody else can obtain or erase your data.

14. Cookies and Similar Technologies

We use essential cookies and local storage to keep you signed in and to remember your cart. These always run, because the site cannot work without them, and they are not used to build a profile of you.

With your consent we also load Google Analytics and LINE's advertising tag. Google Analytics records which pages you view, roughly where you are and how you reached us, so we can see how the site is used; the LINE tag tells LINE that you visited, so we can measure whether our LINE advertising reaches anyone. Nothing is loaded until you accept, and declining stops it entirely.

The mobile app uses the same essential storage on your device and shows no advertising.

15. Children and Age

Our services are intended for adults. We do not knowingly collect personal data from children, and our accounts are not designed for them. Where consent is required and the data subject is a minor under the PDPA, we will seek consent from a parent or legal guardian as required by law. Alcoholic drinks are served only to customers who meet the legal drinking age in Thailand, and we may ask for identification in person.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date, and we will tell you about significant changes through the app or by email.

17. Contact and Complaints

For any questions, requests, or complaints about your personal data, contact us at BamBite@Totals-Inc.com. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand.