Privacy Policy

1. Scope of this policy

This policy covers personal data we receive through this website and when you contact us, for example through the contact form, by email, by phone or on LINE.

Personal data we receive while providing consulting services to a client is handled under our agreement with that client, and we will give any further information the law requires.

This policy is published in Thai and English. If the two versions differ, the Thai version prevails.

2. The data we collect

• When you send the contact form: your name, email and what you'd like to discuss, plus your organization, phone number and service of interest if you give them.
• When you contact us by email, phone or LINE: your name, contact details and whatever you send us.
• When you or your organization becomes a client: your name, job title, contact details and the details needed for the contract and tax documents, such as address and taxpayer identification number.
• When you give us a testimonial: your name, job title, organization and the testimonial you allow us to publish.
• When you visit the website or send the form: the hosting, form and spam-protection services we use automatically record technical details such as your IP address, browser and device type, the pages you open and the time of your visit.

Please don't send sensitive personal data, such as health information, criminal records or religious beliefs, through the form or in messages. If a project needs this kind of data, we will always agree with you first on how it will be handled.

3. Why we use your data, and our legal basis

We use your personal data only for the following purposes, on the PDPA legal basis shown in brackets.

• To answer your enquiry, get back to you, arrange a consultation and prepare a proposal you ask for (our legitimate interest in responding to people who contact us, Section 24(5); or steps you ask us to take before entering into a contract, Section 24(3)).
• To enter into and carry out a contract with you or your organization, including coordinating the work, invoicing and receiving payment (performance of a contract you are a party to, Section 24(3); or our legitimate interest in performing our contract with your organization, Section 24(5)).
• To keep the website running and secure, including preventing spam and misuse (legitimate interests, Section 24(5)).
• To meet our legal obligations, such as those under accounting and tax laws if you or your organization becomes a client, and lawful orders from authorities or courts (legal obligation, Section 24(6)).
• To establish, exercise or defend legal claims if a dispute arises (legitimate interests, Section 24(5)).
• To publish a client testimonial on our website with your name, job title and organization (your consent, Section 19).

If we want to use your data for any other purpose, we will tell you first and ask for your consent where the law requires it.

4. If you don't give us your data

Giving us your data is voluntary. Without your name, email and what you'd like to discuss, though, we can't get back to you or advise you. If you or your organization becomes a client, we need some of your details to sign a contract and issue tax documents as the law requires. Without them, we may not be able to sign the contract or provide our services.

5. Who we share your data with

We share personal data only as far as necessary, with:

• outside consultants and specialists who work with us on your matter, under a duty of confidentiality;
• service providers that help us run our business (such as website hosting, form and email delivery, and spam protection), which use the data to provide their services to us under contract, and some of which may also use part of it, such as IP addresses, to secure and improve their own services under their own privacy policies;
• our auditors and legal advisers, when needed to comply with the law or protect our legal rights;
• government agencies, courts or other authorities, when the law requires it or under a lawful order.

We don't sell your personal data.

6. Transfers outside Thailand

Some of our service providers, such as our hosting, form, email and spam-protection providers, may store or process data on servers outside Thailand, for example in the United States or Singapore. We transfer personal data abroad only where the PDPA allows it, for example when our contract with the provider includes the safeguards the PDPA requires. You can ask us for details using the information under “Contact us”.

7. How long we keep your data

• Messages and contact details that don't lead to work with us: up to 2 years from our last contact, unless we need them longer to deal with a complaint or dispute.
• Client records, such as contracts and accounting documents: for the length of the contract and then as long as the law requires (accounting and tax records are generally kept for at least 5 years), or longer if needed to establish, exercise or defend a legal claim.
• Website visit records and technical data used to block spam: deleted automatically on our providers' schedules, generally within 90 days, unless we need them longer to investigate a security incident.
• Data we use with your consent, such as a client testimonial: until you withdraw your consent.
• Records of your requests to use your rights, and supporting documents such as proof of identity: 2 years from when we act on or refuse the request.

After that, we delete or destroy the data, or make it anonymous.

8. Keeping your data safe

We use appropriate organizational and technical security measures, such as limiting access to people who need the data, sending data over encrypted connections (HTTPS) and requiring our service providers to keep data secure and confidential. If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee and you, in the cases and within the time the law sets.

9. Cookies and links to other sites

This website doesn't use cookies, and it has no tracking or analytics tools such as Google Analytics or advertising pixels. If we add such tools in future, we will update this policy and ask for your consent first where the law requires it.

Links to other sites, such as Google Maps, take you off our website. Those services handle your data under their own privacy policies.

10. Your rights

Under the PDPA, you have the right to:

• access and get a copy of your personal data, and ask where we obtained any data you didn't consent to us collecting;
• receive your data in a commonly used electronic format, or ask us to send it directly to another organization where technically possible;
• object to our collection, use or disclosure of your personal data;
• ask us to delete or destroy your data, or make it anonymous;
• ask us to restrict the use of your data;
• ask us to correct your data so that it is accurate, up to date, complete and not misleading;
• withdraw your consent at any time where we rely on it. This doesn't affect what we lawfully did with your data before you withdrew it.

To use these rights, contact us using the details under “Contact us” below. We may ask you to confirm your identity first, and we will reply within 30 days of receiving your complete request. If the law allows us longer to carry out a request, our reply will tell you why and when to expect it to be done.

Using your rights is generally free of charge; if a request involves a cost, such as copying a large number of documents, we will tell you before we go ahead. In some cases the law allows us to refuse a request, for example when we must keep the data by law. If we refuse, we will tell you why.

If you believe we haven't complied with the PDPA, you can complain to the Office of the Personal Data Protection Committee (PDPC). Website: www.pdpc.or.th

11. Changes to this policy

We may update this policy from time to time and will change the date at the top each time. For important changes, such as using data for a new purpose, we will tell you on this website before the change takes effect and ask for your consent where the law requires it.

12. Contact us

If you have questions about this policy or want to use your rights, contact us online, by post or in person at our office (address below).