This Third-Party Information Sharing Consent (the "Consent") is the document by which Advanced Civil Construction & Engineering Co., Ltd. (the "Company"), operator of GearBid, notifies you in advance and obtains your consent when your personal data is shared with external recipients. The Consent is designed to protect your right to choose and to transparently describe the scope of sharing, so that the Company complies with Thailand's Personal Data Protection Act B.E. 2562 / 2019 (the "PDPA"), in particular §27 (disclosure to third parties) and §28 (cross-border transfers).
1. Overview
To deliver core functions such as notification delivery, server hosting, business-document verification, and product analytics, the Company shares some of your personal data with selected external vendors. This Consent specifies what personal data is shared, with whom, for what purpose, and for how long, and obtains your prior consent. Sharing is carried out based on the legal grounds set out in PDPA §27 (consent or contract performance). Where the sharing involves a cross-border transfer, the additional safeguards required by §28 are applied in parallel.
This Consent applies only to the individual sharing relationships described here. The Company's overall framework for personal data processing — covering categories collected, retention periods, and your rights — is described in the Privacy Policy. If the two documents conflict, this Consent applies first as a special rule governing third-party sharing.
2. Sharing Details
The Company currently shares your personal data with the following recipients. The items shared, the purpose, and the retention period for each recipient are shown below.
| Recipient | Items Shared | Purpose | Retention |
|---|---|---|---|
| Email delivery (Resend) | Name, email | Sending transaction, account, and security notification emails | Deleted immediately after delivery |
| SMS delivery (AWS, Amazon Pinpoint SMS) | Phone number | Sending OTP verification and transaction notification SMS | Deleted immediately after delivery |
| Cloud infrastructure (AWS, Thailand Bangkok region) | All service personal data | Server hosting and backup | Until service termination |
| Document OCR (Google Cloud Vision) | Business registration document images | Automatic extraction and verification of business information | Deleted immediately after extraction |
| Product analytics (PostHog) | Device and access information, service usage events | Usage analysis and feature improvement | Until the product-improvement purpose is achieved |
| Social login (LINE) | LINE user ID, access token | LINE social login | Until login integration is disconnected |
The contract down payment and other payments are handled by bank transfer with manual confirmation by our operations team; because no external payment gateway (PG) is integrated, payment information is not shared with any third party. If a PG is introduced in the future, we will amend this Consent and give advance notice of the recipient and items shared.
The Service's core infrastructure (servers and databases) runs in the AWS Thailand (Bangkok) region, so user data is in principle kept within Thailand. However, some recipients — email delivery (Resend), SMS delivery (AWS Singapore region), document OCR (Google Cloud Vision), product analytics (PostHog), and social login (LINE Corporation) — keep servers outside Thailand, so those sharings count as cross-border transfers.
Each recipient holds the status of Data Processor or Joint Controller under the PDPA and, by contract, owes comparable data protection duties including security measures, a prohibition on use outside the agreed purpose, and a prohibition on onward sharing. For cross-border transfers, the Company signs Standard Contractual Clauses or verifies an adequate level of protection recognised by the PDPC, to meet the requirements of PDPA §28.
3. Right to Refuse and Consequences
You have the right to refuse consent for any of the sharing items listed above. However, some sharings are directly tied to core features, so refusing may limit your ability to use those features or the service as a whole.
- Refusing notification (email/SMS) sharing: You will not receive essential notifications such as transaction progress, bid deadlines, and security alerts, which will limit your core use of the platform.
- Refusing cloud infrastructure sharing: Because our servers and databases are built on cloud infrastructure, refusing makes it technically impossible for us to provide the service.
- Refusing document OCR / product analytics sharing: Automatic recognition of business documents or service-improvement analysis will be limited, but essential use of the service is not affected.
- Refusing social login (LINE) sharing: You will not be able to use LINE social login, but you can sign up and log in through other methods such as email. Note that the contract down payment and other payments are handled by bank transfer and are not shared with any external recipient, so there is nothing to refuse in that respect.
You can withdraw or re-give consent for any item at any time by contacting contact@gearbid.io. We will respond within 30 days of receipt. Withdrawal does not affect the lawfulness of processing carried out before withdrawal; after withdrawal, sharing stops immediately.
4. Change Notifications
If we make a material change to any recipient, item shared, purpose, or retention period, we will notify you at least 30 days in advance through in-app notice and email. Examples of material changes include adding a new recipient, expanding the items shared, changing the purpose, or extending retention.
Minor changes that do not materially affect your rights or obligations — such as a recipient's brand name, legal entity name, or address change — will be announced through the in-app notice at least 7 days in advance together with an update to the lastUpdated field of this Consent.
Where a material change relates to consent-based processing, we will ask you to re-consent. For users who do not re-consent, we may keep the prior sharing terms or restrict the relevant feature. If you disagree with the notified change, you can contact contact@gearbid.io. For general information about personal data processing, please also refer to the Privacy Policy.