How we handle your data

1. Our approach

FastTrack BKK ("we", "us") treats data sovereignty as a product choice: we decide what we collect, where it is stored, how long we keep it, and who can access it. We do not outsource website usage analytics to third-party session-replay vendors. Booking data and optional website analytics are handled as separate systems with different purposes and retention rules.

2. Two kinds of data

These streams are not stored in the same database. A booking record is not merged with analytics replay by default; where we link a completed booking to a browsing session, we use opaque identifiers supplied at checkout, not passport numbers in analytics storage.

3. Booking data

When you make a booking, we process personal data needed to deliver the service, including:

• Contact details, flight information, and passenger names
• Passport data (encrypted passport numbers, passport photos, selfies) for operator handoff
• Payment references (blockchain transaction hash, wallet address, amounts)

Passport numbers are encrypted at rest (AES-256-GCM). Images are stored in encrypted blob storage and served via time-limited signed URLs. Passport-related uploads are automatically purged 30 days after the flight date. We share the minimum necessary details with our vetted airport partner operator to deliver the service. We do not sell or rent booking data.

Full legal detail: Privacy Policy.

4. Website analytics (FastTrack Analytics)

If you accept analytics in our consent banner, we use first-party FastTrack Analytics — software we operate ourselves — to collect usage events and optional session replay on this website. If you decline, we do not enable analytics collection or session replay for your browser session.

• No third-party session replay (for example Microsoft Clarity or similar marketing analytics replay tools)
• Consent-first: analytics runs only after your explicit choice on the banner
• Separate storage: analytics events and replay chunks live in a dedicated analytics database and object storage, not in our booking database
• Retention limits: usage events are retained for up to 90 days; session replay for up to 30 days, then automatically purged
• Erasure: we can delete analytics data tied to a visitor identifier on request (subject to verifying the request)

Analytics may record page paths, clicks, and a masked replay of page structure. We configure replay masking for sensitive fields where applicable. Do not enter passport or payment details into free-text fields on marketing pages.

5. What we do not do

• Sell or rent your personal data to data brokers or advertisers
• Use third-party ad-tech pixels for on-site session replay on this booking site
• Require analytics consent to complete a booking — analytics is optional
• Store passport numbers inside our analytics product database

6. Infrastructure

Our systems run on established cloud providers under our control (including hosting, databases, and encrypted object storage). Data may be processed in regions where those providers operate data centres. We choose subprocessors for reliability and security; a current list of categories is: web hosting and CDN, application and database hosting, encrypted blob storage, and email delivery for transactional messages.

This page describes architectural choices and defaults. It does not replace the Privacy Policy for lawful bases, international transfers, or formal data-subject requests.

7. Your choices

• Decline analytics on the consent banner — no usage replay or analytics events are collected for that choice
• Change your mind by clearing site data for this domain; the banner will appear again on your next visit
• Request access, correction, or deletion of booking personal data via Contact; we respond within 30 days where applicable law requires
• Analytics erasure: contact us with details from your request; we will action deletion of analytics visitor data where we can verify the request