Privacy Policy
Privacy Policy
This policy explains what personal information we handle when you browse this website, submit an enquiry, or contact us through the channels we publish — why we handle it, how long we keep it, and what you can ask us to do.
1. Scope and who we are
1.1 This policy covers
- Browsing any page of yrdprivatecar.com;
- Submitting the enquiry form on this site;
- Contacting us via WeChat, Telegram, WhatsApp, email or phone;
- The follow-up we carry out to reply, quote, confirm and deliver the service you asked for.
1.2 Which laws apply
We operate from Kingdom of Cambodia, our servers are located in Tokyo, Japan, and our visitors come from many countries. Accordingly:
- All visitors: the laws of Kingdom of Cambodia on e-commerce and the reasonable protection of personal information apply.
- Visitors in mainland China: we have additionally written this policy to meet the disclosure requirements of the PRC Personal Information Protection Law (PIPL), and we set out the specific cross-border arrangements in Section 7.
- Visitors in the European Economic Area: we list our processing purposes and legal bases in the format of GDPR Article 13 (Section 4), and your rights in Section 11.
1.3 Who we are
| Item | Detail |
|---|---|
| Operator | YRD AGENT (brand: YRD Cambodia Charter) |
| Country of registration | Kingdom of Cambodia |
| Registration number | 5000474183 |
| Registered address | Phnom Penh, Cambodia |
| Data controller | YRD AGENT |
| Privacy contact | yrdvipcarservice@gmail.com |
| Telephone | +855 17 212 213 |
2. What this website does not do
The boundaries come first, because they determine how little we need to collect:
- This site takes no online payments. We never collect or touch card or bank details.
- This site takes no online bookings. There is no order system and no user accounts.
- You do not need to register to see everything on this site.
Booking, pricing, dispatch and payment all happen off-site, handled by people. The website’s only job is to help you find us.
3. What information we handle
3.1 What you give us
When you submit the enquiry form we receive:
Required (without these we cannot reply to you)
- How to address you;
- The contact channel you choose, and your account on that channel.
Optional (leaving these blank does not stop you submitting, but the less we know, the harder it is to quote accurately)
- Travel date, pick-up, destination, number of passengers, luggage, preferred vehicle, purpose of trip, whether you need a guide;
- Mobile number (with international dialling code);
- Email address;
- Anything else you choose to write in the notes field.
🔴 Please do not enter passport or ID numbers, bank or card numbers, passwords or verification codes, health information, children’s information, or information about other people unrelated to this enquiry. We do not need any of it. If we receive such information by mistake, we will delete or mask it as soon as we notice.
3.2 Technical and security information
To keep the site working and to prevent abuse, we handle:
- Submission time, page language, the policy version shown to you at the time, and the build version of the site;
- Landing page, referring page, UTM parameters, browser User-Agent;
- Raw IP address — used only for short-term rate limiting; never written to the enquiry database;
- A keyed digest of the IP address, plus duplicate/spam risk flags, for security review;
- First-party interaction counts such as opening a contact channel, copying a contact handle, or clicking through to the enquiry form.
Two points worth stating plainly:
- Raw IP addresses exist only in application memory, for about one hour, and then disappear. They never reach the database or the backups. A separate duplicate-submission counter keyed on your contact handle also lives only in memory, for about 24 hours.
- First-party interaction counts contain no visitor identifier whatsoever — no account, no cookie ID, no enquiry reference, no IP. They record only “which kind of action, on which page, in which language, at what time”. They therefore cannot identify you and cannot track you across websites.
3.3 Enquiry follow-up records
So that we can keep working on your request and avoid contacting you twice, we store: the enquiry reference, follow-up status, the staff member handling it, necessary internal notes, quote and outcome status (recorded as a value band, never an exact amount), and the timestamps of those actions.
These are used only to reply to you, to coordinate internally, to manage the service and for security auditing.
3.4 When you contact us on an external platform
When you contact us through WeChat, Telegram, WhatsApp, email or phone, that platform or carrier also processes your account, device and message content. That part is governed by their own privacy policies, not by this one.
If you message our Telegram bot, Telegram processes your user ID, username, display name, message content and send time. The bot does not write your messages into this site’s enquiry database and does not forward them to our staff — it replies with public information and offers you a hand-off to a real person. Our staff record information only where genuinely necessary to reply or arrange a service.
4. Why we handle it, and on what legal basis
⚠️ Different activities rest on different legal bases. Each row below is separate:
| What we do | Why | Legal basis |
|---|---|---|
| Reply to your enquiry, clarify needs, provide a quote | You asked us for a price | Steps prior to entering a contract |
| Confirm and deliver the service you chose; after-sales support | Performing what you confirmed | Performance of a contract |
| Prevent spam, duplicates and abuse; rate limiting | So genuine enquiries are not drowned out | Our legitimate interests (service availability and security) |
| Record which policy version was shown at submission | So that a dispute can be resolved on facts | Our legitimate interests + statutory disclosure duty |
| Understand whether the site works, without identifying anyone | A silently broken form is our most expensive failure | Our legitimate interests |
| Retain or disclose where the law requires it | — | Compliance with a legal obligation |
🔴 We do not rely on your consent to this policy as a basis for processing.
The reason you fill in the form is to get a reply from us, and that is itself a step taken at your request prior to a contract — no separate consent is needed. That is why this site’s form has no “I agree to the privacy policy” checkbox. Instead we show a short, always-visible notice next to the submit button.
It also means that submitting an enquiry only asks us to handle that one request. It does not authorise marketing, advertising, or any unrelated use.
5. What we will never do
We will not:
- Send you marketing emails, SMS or promotional messages you did not ask for;
- Collect identity documents, financial accounts, health data, children’s data or other sensitive categories;
- Collect live or continuous location, or track your movements;
- Build interest, spending-power or behavioural profiles;
- Use your enquiry to target personalised advertising;
- Supply enquiry lists to ad platforms, data brokers or any unrelated third party;
- Sell, rent or trade personal information;
- Reuse your information for a new purpose incompatible with your original enquiry;
- Make decisions with a significant effect on you based solely on automated processing.
Our systems apply limited rules to flag duplicate or suspected spam submissions, but that is used only for security and human review — a flagged enquiry still enters our system and is still seen by a person.
6. Who may see your information
| Who | Within what limits |
|---|---|
| Our customer service staff and management | Replying, quoting, arranging the service |
| Server and backup providers | Hosting, storing encrypted backups, maintaining security |
| Email and notification providers | Alerting our staff that a new enquiry arrived |
| The platform you chose | WeChat, Telegram, WhatsApp and similar |
| The actual driver, fleet or guide | 🔴 Only after you confirm a service, and only the minimum contact and itinerary details needed for that one trip |
| Our website maintenance provider | Restricted access, only where troubleshooting or security work genuinely requires it |
| Competent authorities | Only where required by law, court order, or to protect life or substantial property — and only the minimum necessary |
🔴 Internal notifications about a new enquiry do not contain your full contact details. The summary carries only: enquiry reference, a masked form of how you asked to be addressed, language, the channel name (never the account), route, date, passenger count and a short excerpt of your notes. Full handles, phone numbers and email addresses are visible only inside our password-protected admin area.
We require our providers to handle information as agreed, and never for their own marketing or other purposes.
Third-party policies: Telegram · WeChat / Tencent · WhatsApp
7. Cross-border transfers
We operate from Kingdom of Cambodia and our servers are located in Tokyo, Japan. Our staff and necessary providers may also handle your enquiry outside your own country or region.
Disclosures required by PRC personal information rules:
| Disclosure | Detail |
|---|---|
| Overseas recipient | YRD AGENT |
| Purpose | Replying to your enquiry, quoting, and delivering the service you chose |
| Categories | How to address you, contact channel and account, the trip details you provided, follow-up records, limited security information |
| Means of processing | Receiving, storing, querying, using, necessary transmission, deletion on schedule |
| How to exercise your rights | yrdvipcarservice@gmail.com |
🔴 One point worth being explicit about: the “overseas recipient” here is us. Your information is not handed to some third-party company — it sits on servers we ourselves rent in Tokyo, Japan. It does not leave that system except in the situations listed in Section 6.
For users in mainland China: this processing is “necessary to conclude or perform a contract to which you are a party”, so under the current rules no separate consent is required. We still disclose the arrangement honestly, both at the form and here.
⚠️ Stated plainly: data-protection law in Tokyo, Japan is not identical to the law where you are. If that is not acceptable to you, please do not use the form — contact us directly on WeChat, Telegram, WhatsApp or by phone instead.
Safeguards we apply to cross-border processing include encryption in transit, access control, data minimisation, scheduled deletion, encrypted backups whose decryption key is kept off the server, and contractual limits on our providers.
8. How long we keep it
| Information | Retention |
|---|---|
| Enquiries and follow-up records | No more than 12 months from the date the enquiry is closed |
| Duplicate, spam or abuse records | No more than 90 days |
| IP digests and risk flags | Deleted together with the enquiry they belong to |
| Raw IP in application memory | About 1 hour; the handle-keyed counter about 24 hours |
| Site interaction counts and general security logs | No more than 90 days |
| Telegram and email notification copies | No more than 90 days |
| Admin login sessions | About 12 hours at most |
| Encrypted backups | No more than 30 days per copy |
| Chat history inside WeChat / Telegram / WhatsApp | Per each platform’s own rules, and for the shortest time our work requires |
Where the law, a live dispute or a security incident requires us to keep something longer, we keep only the part that is necessary, restrict what it is used for, and delete it once that reason is gone.
“Deletion” means three different things, and we treat them differently:
- Staff click “delete” in the admin area — this only hides the record, to protect against mistakes. ⚠️ This does not count as deletion.
- An enquiry reaches the end of its retention period — it is physically purged from the live system.
- 🔴 You exercise your right to erasure — immediate physical purge, and it will not be included from the next backup onward.
⚠️ About backups already taken, stated honestly: encrypted backups are whole-database snapshots and cannot be edited record by record. After your information is deleted, an older backup copy may still contain it for up to the 30-day backup cycle. Those copies are used only for disaster recovery, never for day-to-day business, and are destroyed on expiry.
9. Cookies and site statistics
The current public website:
- Sets no first-party cookies at all for ordinary visitors;
- Does not use localStorage or sessionStorage to hold any visitor identifier;
- Loads no Google Analytics, Baidu Tongji, Meta Pixel, or any advertising or behavioural analytics script;
- Records only first-party interaction counts with no stable visitor identifier (see Section 3.2).
There are therefore no non-essential cookies for you to consent to, and this site will never show you a cookie banner.
When our own staff log in to the admin area, a first-party session cookie named
yrd_admin is set for them, scoped to the /admin path and lasting about 12 hours.
Ordinary visitors never receive it under any circumstances.
Once you open WeChat, Telegram, WhatsApp, a map or another third-party service, that platform may use its own cookies, SDKs or device identifiers — technology outside our control.
10. How we protect it
- HTTPS/TLS across the whole site;
- Admin passwords stored as argon2id hashes; we never see any password of yours (this site never asks you to set one);
- The database is not exposed to the internet; the form service listens only on the server’s loopback interface;
- Full contact details masked in internal notifications;
- Rate limiting, input validation and anti-abuse rules;
- Encrypted backups, with the decryption key held offline and never on the server;
- Access limited by role for staff and providers, with significant actions logged;
- Regular review of permissions, deletion, backups and incident handling.
⚠️ No transmission or storage over the internet can be guaranteed absolutely secure. If an incident occurs that may affect you, we will investigate and remediate immediately, and notify the competent authority and affected individuals as applicable law requires.
11. Your rights
You may ask us to:
- Be informed — understand how we handle your information;
- Access and obtain a copy of your information;
- Correct or complete anything inaccurate;
- Erase information that is no longer necessary, has expired, or was handled unlawfully;
- Restrict or object to processing that goes beyond the purposes in this policy;
- Port your information to a recipient you nominate, where the law provides for it;
- Complain and be given reasons — if we refuse a request, we must explain why.
📌 About “withdrawing consent”: as explained in Section 4, we do not rely on your consent as a legal basis, so there is no consent to withdraw. You can ask us at any time to delete your enquiry or to stop contacting you — the effect is the same, and you do not need to give a reason.
How to ask: email yrdvipcarservice@gmail.com with the minimum information we need to locate the enquiry (for example, the name you gave and the contact account you used). To stop someone else claiming your information, we may need to carry out proportionate identity verification.
How quickly: normally within 15 working days. Where applicable law sets a shorter deadline, that deadline governs. If we cannot fully meet a request, we will explain why and tell you how to complain.
12. Children
This website is intended for adults. We do not request, and do not knowingly collect, personal information from children under 14 (or the higher age threshold set by the law where you are, if that is higher).
The “number of passengers” field is used only to estimate the size of vehicle needed. It is not used, and will not be used, to identify whether children are travelling.
If we discover that we have inadvertently received children’s information, identity documents, financial account details or health information, we will delete or mask it as soon as possible. You can also tell us at yrdvipcarservice@gmail.com at any time.
13. Changes and complaints
We may update this policy when our company details, technology, providers or the applicable law change. New versions are published on this page with the date and version number.
If we ever add marketing subscriptions, collect sensitive information, run profiled advertising, introduce significant automated decisions, or reuse information for a purpose unrelated to your original enquiry, we will update this policy and the relevant interface before we begin.
Contact us
YRD AGENT Registered address: Phnom Penh, Cambodia Email: yrdvipcarservice@gmail.com Telephone: +855 17 212 213
If you are not satisfied with our response, you may complain to a competent authority:
- Mainland China: the national or local cyberspace administration, or another department charged with personal information protection duties.
- Kingdom of Cambodia: see the General Directorate of Consumer Protection, Competition and Fraud Repression.
- European Economic Area: the data protection supervisory authority in your member state.
This policy is published in Chinese and English. Both versions express the same content. Where mandatory law provides otherwise, that law prevails.