Privacy Policy

1. Personal Data We Collect

The Company collects only the personal data that is necessary and relevant to the purposes stated in this policy, in the following categories.

1.1 Data you give us directly

Data you enter in the contact form: first name, last name, email address, phone number and the content of your message, together with the date and time it was sent.

1.2 Data collected automatically when you use the website

Technical data: your IP address, used temporarily to prevent duplicate or unwanted (spam) messages, and website access records (server logs) kept by our hosting provider to deliver the service and keep the system secure.

The Company does not intend to collect sensitive personal data through the contact form, such as health information, religious beliefs or criminal records. Please do not include such data, or personal data about other people that is not needed for your enquiry.

If you do not provide the data needed to contact you or to act on your request before entering into a contract, the Company may be unable to answer your enquiry, prepare a proposal or fully act on your request.

2. Purposes of Collecting, Using and Disclosing Personal Data

The Company processes your personal data for the following purposes:

• To contact you, answer your enquiries and provide information about our services as you requested
• To prepare proposals or quotations and act on your requests before entering into a contract
• To operate and secure the website, including preventing abnormal use, duplicate submissions and spam
• To comply with legal obligations, including lawful orders from authorities

The Company will not use data from the contact form to send marketing or advertising messages unless you give separate consent. Declining to consent for that purpose will not affect how we answer your enquiry or act on your request.

3. Legal Bases for Processing

The Company relies on the legal basis appropriate to each activity, as follows:

• Contract: for actions needed to act on your request before entering into a contract to which you are a party, such as preparing a proposal or quotation
• Legitimate interest: for answering general enquiries, communicating with prospective clients or representatives of organisations, and keeping the website secure, taking into account necessity and the impact on your rights and freedoms
• Legal obligation: for retaining or disclosing data when the Company is required to by law
• Consent: for activities for which the Company asks for your specific consent, such as sending marketing communications; we will explain the purpose and relevant details before asking

4. Disclosure of Personal Data

The Company does not sell, rent or trade your personal data, and discloses it only as necessary to the following parties.

4.1 Service providers that support the website

• Google, for Google Sheets and Google Apps Script, used to receive and store contact form submissions
• Vercel, for website hosting and delivery

Where a service provider processes data as a data processor on the Company's behalf, the Company defines the scope of processing and the provider's security obligations through the agreements required by law.

4.2 Government agencies or legally authorised persons

The Company may disclose data when required to comply with the law, a court order or a lawful order from a competent authority, limited to the extent necessary.

5. Transfers of Personal Data Abroad

Using the service providers listed in Section 4 may involve sending, transferring, storing or processing personal data outside Thailand.

In such cases, the Company will ensure that the transfer complies with personal data protection law and related notifications, by considering the data protection standards of the destination country, putting in place appropriate safeguards recognised by law, or relying on an exception permitted by law, as applicable.

6. Data Retention

6.1 Contact form data

The Company keeps contact form data for no longer than [specify number of months or years] from the date you last contacted the Company.

If you enter into a contract with the Company, the related data will be kept as long as necessary to perform the contract and meet legal obligations, and the Company will provide further details on data processing for the services as appropriate.

6.2 IP addresses used to prevent spam

IP addresses used by the Company's spam-prevention mechanism are held temporarily in system memory and are not saved to the Company's contact form database. This is separate from the server logs kept by the hosting provider, which may also contain IP addresses.

6.3 Website access records

Server logs are kept for [specify the period confirmed in the hosting settings] to operate and secure the system, unless the law requires a longer period.

When the retention period ends or the data is no longer needed, and there is no lawful reason to keep it, the Company will delete, destroy or anonymise the data using appropriate methods.

7. Your Rights as a Data Subject

Subject to the conditions and exceptions set by law, you have the following rights regarding your personal data:

• Right of access: to access and obtain a copy of your personal data, and to ask us to disclose the source of data obtained without your consent
• Right to rectification: to have your data corrected so it is accurate, up to date, complete and not misleading
• Right to erasure: to have your data deleted, destroyed or anonymised where the legal conditions are met
• Right to restriction: to have the use of your data restricted in the cases provided by law
• Right to object: to object to the collection, use or disclosure of your data in the cases provided by law, including processing for direct marketing
• Right to data portability: to receive your data in a machine-readable format and to have it sent or transferred to another data controller where the legal conditions are met
• Right to withdraw consent: to withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing carried out before withdrawal
• Right to complain: to lodge a complaint with the expert committee under the law through the Office of the Personal Data Protection Committee if you believe your personal data has not been handled lawfully

You can submit a request through the channels in Section 11. The Company may ask for additional information as necessary to verify your identity and prevent disclosure to anyone not entitled to it.

The Company will act on your request without delay and within the period required by law. For requests for access or a copy of data that the Company cannot lawfully refuse, the Company will complete the request within 30 days of receiving it.

If the Company has a lawful reason to refuse all or part of a request, it will tell you why.

8. Cookies and Similar Technologies

The website uses cookies to support its operation and remember settings you choose, such as display language. It does not use cookies for analytics or advertising.

The Company will determine the legal basis for each type of cookie according to its purpose and function, and will ask for consent before using cookies where the law requires consent.

You can manage or delete cookies through your browser settings. Blocking some cookies may prevent the website from working properly or remembering your settings.

If the Company begins using cookies for other purposes, it will provide details, update the relevant policy, and offer ways to give and withdraw consent where consent is required.

9. Links to Third-Party Websites and Services

The website may contain links to third-party websites or services, such as Google Maps, Gmail, Facebook, Instagram, LINE and TikTok.

When you use those services, the collection, use or disclosure of data by the third-party provider is governed by that provider's privacy policy. We recommend that you read the relevant policies before using those services. This policy does not cover processing carried out by third-party providers as data controllers in their own right.

10. Security Measures

The Company maintains security measures appropriate to the nature of the data and the risks involved, including encrypting data in transit via HTTPS and limiting access to staff who need the data to do their work.

These measures aim to prevent loss and unauthorised or unlawful access, use, alteration, modification or disclosure of data. The Company reviews its measures as necessary and handles personal data breaches, including notifying the relevant authority and data subjects, in accordance with the law.

11. Contact Us

If you have any questions about this policy or wish to exercise your rights as a data subject, please contact the Company:

12. Changes to This Policy

The Company may update this policy to reflect changes in its operations, services or legal requirements, and will publish the updated version on the website with the date of the latest update.

If a change materially affects how your personal data is processed or your rights, the Company will notify you through the website or another appropriate channel, and will ask for your consent again before proceeding where the law requires consent. Continued use of the website does not by itself constitute consent.