Privacy Policy

1. Introduction

Thepa Tech Company Limited ("Thepa Tech", "we", "us", "our") is committed to handling personal data responsibly and in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). This policy describes what personal data we collect, how we use it, and the rights you have in relation to it.

This policy applies to personal data collected through our website at {{DOMAIN}}, through our contact forms, and in the course of providing our AI integration services to clients.

If you have questions about this policy or our data practices, please contact us at privacy@{{DOMAIN}}.

2. Personal Data We Collect

We collect personal data in the following ways and categories:

2.1 Data You Provide Directly

• Full name, business email address, and telephone number — collected via our contact form
• Company name and business description — provided during initial consultations
• Operational information — shared during Foundation Tier Review sessions for the purpose of workflow mapping

2.2 Data Collected Automatically

• IP address, browser type, and referring URLs — collected via standard server logs
• Pages visited and time spent on site — collected via analytics cookies (where consent is given)

2.3 Legal Basis for Processing

• Consent — for analytics cookies and marketing communications
• Legitimate interests — for responding to enquiries and service delivery
• Contract performance — for data processed in the course of a signed engagement

2.4 Data Retention

Enquiry data is retained for up to 24 months after last contact. Client engagement data is retained for 7 years in accordance with Thai commercial record-keeping obligations. Analytics data is retained for 13 months.

3. How We Use Your Data

• To respond to enquiries and schedule initial consultations
• To conduct Foundation Tier Reviews and deliver integration services under contract
• To send service-related communications (invoices, review summaries, updates)
• To improve our website and understand how it is used (with consent)
• To comply with legal obligations under Thai law

We do not sell personal data to third parties. We do not use personal data for automated decision-making that produces legal or similarly significant effects without human review.

4. Data Protection Measures

• Data transmitted via our website is encrypted using TLS/HTTPS
• Access to personal data is restricted to staff members who require it for their role
• Client operational data shared during engagements is stored under confidentiality agreements and deleted upon engagement closure
• In the event of a data breach affecting your personal data, we will notify you and the relevant Thai supervisory authority within 72 hours of becoming aware of it

5. Cookie Use

We use essential cookies necessary for basic site operation, and optional analytics and preference cookies that require your consent. You can manage your cookie preferences at any time via our Cookie Policy page.

6. Your Rights Under the PDPA

Under Thailand's Personal Data Protection Act, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure — to request deletion of personal data where there is no lawful basis for its continued retention
• Right to data portability — to receive your data in a structured, commonly used format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — at any time, without affecting the lawfulness of processing prior to withdrawal

To exercise any of these rights, contact us at privacy@{{DOMAIN}}. We will respond within 30 days. You may also lodge a complaint with the Personal Data Protection Committee of Thailand.

7. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing any personal data.

8. Children's Privacy

Our services are directed at businesses and individuals aged 18 and over. We do not knowingly collect personal data from persons under 18. If you become aware that a minor has submitted personal data to us, please contact us so that we can delete it.

9. Policy Updates

We may update this policy from time to time. Significant changes will be communicated to active clients by email. The updated date at the top of this page reflects the most recent revision. Continued use of our website after changes are posted constitutes acceptance of the revised policy.

10. Contact Details