PRIVACY POLICY

PRIVACY POLICY (PDPA COMPLIANCE)

Last Updated:

This Privacy Policy describes how we collect, use, and disclose your personal data in full accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand (PDPA). We are committed to protecting your privacy and ensuring your personal data is handled securely.

1. DEFINITIONS

  • "Personal Data": Any information relating to a Person, which enables the identification of such Person, whether directly or indirectly.
  • "Data Controller": The person or legal entity who has the power and duty to make decisions regarding the collection, use, or disclosure of Personal Data.
  • "Data Processor": The person or legal entity who operates in relation to the collection, use, or disclosure of the Personal Data pursuant to the orders given by or on behalf of a Data Controller.

2. COLLECTION OF PERSONAL DATA

We collect personal data that is necessary for the purposes of our services. This includes:

  • Direct identification data (e.g., Name, Social Media Handles).
  • Communication data (e.g., contents of messages sent to us via social media).
  • Technical data (e.g., IP address, browser type via standard web server logs).

We do not collect "Sensitive Personal Data" (as defined in Section 26 of the PDPA) unless explicit consent is provided or as required by law.

3. LEGAL BASES FOR PROCESSING

In accordance with Section 24 and Section 27 of the PDPA, we process your data based on:

  • Consent: Where you have given clear consent for us to process your data for a specific purpose.
  • Contractual Basis: Processing is necessary for the performance of a contract to which you are a party.
  • Legitimate Interests: Processing is necessary for our legitimate interests (e.g., improving our website, security).
  • Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject.

4. PURPOSE OF PROCESSING

Your personal data is collected and processed for the following purposes:

  • To respond to your inquiries via social media.
  • To maintain and improve the security and performance of this website.
  • To comply with applicable laws and regulations in Thailand.

5. DATA RETENTION

Pursuant to the PDPA, we retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or for the duration required by law. Once the retention period expires, your data will be securely deleted or anonymized.

6. RIGHTS OF THE DATA SUBJECT

Under Chapter 3 of the PDPA, you have the following rights:

  • Right to be informed: You have the right to know how your data is being used.
  • Right of Access: You can request a copy of your personal data.
  • Right to Data Portability: You can request your data in a machine-readable format.
  • Right to Object: You can object to the processing of your data in certain circumstances.
  • Right to Erasure (Right to be Forgotten): You can request the deletion of your data.
  • Right to Restrict Processing: You can request that we stop processing your data temporarily.
  • Right to Rectification: You can request that inaccurate data be corrected.
  • Right to Withdraw Consent: You can withdraw your consent at any time.

7. INTERNATIONAL PRIVACY LAWS (GDPR & CCPA)

While our primary focus is PDPA compliance, we also respect international data protection standards for our global visitors:

  • GDPR (European Union): For residents of the EU, we adhere to the principles of lawfulness, fairness, and transparency. You have the right to object to processing and the "Right to be Forgotten" (Erasure).
  • CCPA/CPRA (California): For California residents, we respect your "Right to Know" what data is collected and your "Right to Opt-Out" of the sale of personal information (though we do not sell data).

Regardless of your location, we apply the principles of Data Minimization and Purpose Limitation to all personal data we handle.

8. DATA SECURITY

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, preventing unauthorized access, alteration, or disclosure of your personal data.