Privacy Policy

Data Controller

Rattana Works Co., Ltd. is the data controller for personal data collected through this website and through engagement with our services. Our registered address is 214 Phra Ram IV Road, Khlong Toei, Khlong Toei, Bangkok 10110, Thailand.

Data We Collect

Information you provide directly

• Name and contact details (email, phone) submitted through our enquiry form
• Organisation name and role, if provided
• Message content submitted through the contact form
• Correspondence by email or other written channels

Information collected automatically

• Browser type, operating system, and device type
• Pages visited and time spent on each page
• Referral source (how you arrived at the site)
• IP address (anonymised where analytics tools permit)
• Cookie data, as described in our Cookie Policy

How We Use Personal Data

We use personal data for the following purposes:

• Responding to enquiries — to answer questions submitted through the contact form or by email (legal basis: legitimate interest / consent)
• Providing services — to conduct engagement work with clients under contract (legal basis: performance of contract)
• Service communications — to send session summaries, draft documents, and engagement correspondence (legal basis: contract / legitimate interest)
• Website improvement — to understand how visitors use the site and identify areas for improvement (legal basis: legitimate interest, where analytics cookies accepted)
• Legal compliance — to meet obligations under Thai law, including PDPA and tax regulations (legal basis: legal obligation)

We do not use personal data for unsolicited marketing without explicit consent. We do not sell personal data to third parties.

Data Retention

• Enquiry form submissions: retained for up to 24 months from submission date
• Engagement correspondence and deliverables: retained for 5 years following engagement completion, in accordance with Thai accounting and commercial record requirements
• Website analytics data: retained for up to 26 months (standard analytics tool retention)
• Cookie consent records: retained for 12 months

After retention periods expire, data is deleted or anonymised in a manner that makes re-identification not reasonably possible.

Data Sharing

We share personal data only in the following circumstances:

• Service providers — third-party tools used to operate the website (email service, website hosting, analytics). These processors are contractually bound to handle data only as directed.
• Legal requirements — when required by law, court order, or regulatory authority in Thailand.
• Engagement associates — if additional expertise is brought into an engagement, this is disclosed to the client before any personal data is shared with the associate.

We do not transfer personal data outside Thailand except where a client engagement explicitly requires it, and only with appropriate safeguards in place.

Data Security

We maintain technical and organisational measures to protect personal data, including:

• HTTPS encryption for all data transmitted through the website
• Password-protected access controls for systems holding personal data
• Restricted access to personal data on a need-to-know basis within the practice
• Regular review of data handling practices

In the event of a personal data breach that may result in risk to data subjects, we will notify the Office of the Personal Data Protection Committee (PDPC) within 72 hours of becoming aware of the breach, and affected individuals where the risk is high.

Cookies

We use cookies on this website. For a full explanation of the cookies we use and how to manage them, please see our Cookie Policy.

Your Rights Under PDPA

Under Thailand's Personal Data Protection Act, you have the following rights with respect to personal data we hold about you:

• Right of access — to request a copy of personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of your personal data, subject to legal retention obligations
• Right to portability — to receive your data in a structured, commonly used format
• Right to object — to object to processing based on legitimate interest
• Right to withdraw consent — where processing is based on consent, to withdraw it at any time
• Right to lodge a complaint — with the Office of the PDPC if you believe we have processed your data unlawfully

To exercise any of these rights, please contact [email protected]. We will respond within 30 days.

Third-Party Links

This website may contain links to external websites. We are not responsible for the privacy practices of those sites. We recommend reviewing the privacy policy of any external site before providing personal data.

Children's Privacy

Our services are directed at business organisations and professionals. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that personal data has been collected from a minor, we will delete it promptly.

Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. We will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after any update constitutes acceptance of the revised policy.

Contact

For questions about this policy or to exercise your data rights:

• Email: [email protected]
• Post: Rattana Works Co., Ltd., 214 Phra Ram IV Road, Khlong Toei, Khlong Toei, Bangkok 10110, Thailand