Who we are
DURIO INNOVATION Co.,Ltd. operates duri:trace, the tracking service at duriotrace.in.th. In this notice “we” means DURIO INNOVATION, acting as the data controller, and “you” means anyone who uses the site — whether you hold an account or were simply handed a tracking link.
A tracking page is public by design. Anyone holding a device ID or a label reference code can open it and read that device's history. If you pass a tracking link to somebody, they will see what you see.
What we collect
| What | What it includes | When we get it |
|---|---|---|
| Account details | Your name, your email address or the identifier your login provider gives us, and which provider you used. | When you sign in with LINE. |
| Device readings | Temperature, humidity, battery voltage, and the location a logger reports. | Sent by the logger itself. It describes a shipment rather than a person, but it is linked to your account once you pin a device. |
| Your settings | Alert thresholds, pinned devices, your notification choices, and the time zone your browser reports. | When you set them. |
| Access logs | Your IP address, your browser's user-agent, the page you arrived from, and the time of each request. | Automatically, on every page and API request. |
| Report records | The verification code and SHA-256 fingerprint of each PDF report issued, the device and period it covers, and who downloaded it. The readings inside the report are not stored. | When a report is downloaded. |
Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Showing a device's history, and producing CSV and PDF exports. | Performance of our contract with you, and our legitimate interest in providing the service. |
| Sending threshold, location-change and daily-digest alerts over LINE. | Your consent, given when you switch an alert on and withdrawn when you switch it off. |
| Letting anyone check that a PDF report is genuine and unaltered. | Our legitimate interest in the integrity of a document you may hand to someone else. |
| Keeping access logs to detect abuse, diagnose faults and investigate incidents. | Our legitimate interest in the security and reliability of the service. |
Who else receives it
We disclose personal data only to the following, and only for the reasons given.
| Recipient | What they receive | Why |
|---|---|---|
| LINE | Your login identifier, and the text of any alert we send you. | To sign you in, and to deliver the notifications you asked for. |
| OpenFreeMap | Your IP address and browser user-agent. | They serve the map tiles on a tracking page; the request cannot be made without revealing this. |
| Our hosting and infrastructure providers | Whatever passes through the servers in the course of running the service. | To operate and maintain duri:trace, under contract and on our instructions. |
We do not sell personal data, and we do not disclose it for advertising.
Sending data abroad
LINE and OpenFreeMap operate outside Thailand, so using duri:trace involves transferring some personal data out of the country — chiefly your IP address, and your login identifier if you sign in with LINE. We rely on sections 28 and 29 of the Act for these transfers.
How long we keep it
| What | How long |
|---|---|
| Device readings | Deleted 30 days after a device's last reading. |
| Access logs | Rotated daily, or sooner if a file reaches 50 MB, and the newest 30 files kept — in practice about a month. |
| Account and settings | Kept while your account exists, and deleted when you close it. |
| Report records | Kept indefinitely, because a report handed to a third party must stay verifiable. The link to your account is removed when your account is deleted. |
Your rights
The Act gives you the following rights over your personal data. Section numbers are given for reference.
- Access (s.30)
- Ask for a copy of the personal data we hold about you, and where we got it.
- Portability (s.31)
- Ask us to give it to you, or send it to another controller, in a machine-readable form.
- Object (s.32)
- Object to processing we carry out on the basis of legitimate interest.
- Erasure (s.33)
- Ask us to delete it or make it anonymous.
- Restriction (s.34)
- Ask us to suspend our use of it while something is being resolved.
- Rectification (s.35)
- Ask us to correct anything inaccurate, incomplete or out of date.
- Withdraw consent (s.19)
- Turn off any alert you switched on. Withdrawing is as easy as consenting, and does not affect what we did beforehand.
- Complain (s.73)
- Complain to the Office of the Personal Data Protection Committee if you think we have broken the Act.
To exercise any of these, write to us using the details below. We will answer within 30 days. We may first need to establish who you are — we will not hand one person's data to whoever asks for it.
Keeping it safe
Traffic to the site is encrypted in transit. Access to the administrative console is restricted to named staff accounts, and the internal device API is unreachable from the public internet. Reports carry a SHA-256 fingerprint so that alteration can be detected.
Changes to this notice
We review this notice periodically. If we change it in a way that matters to you, we will say so on this page and update the date above.
Contact us
For any question about this notice, or to exercise a right under it, contact us at: