Privacy Policy

1. Introduction

Thanya Advisory Co., Ltd. ("we," "us," or "the Firm") is committed to handling personal data responsibly and transparently. This policy describes the personal data we collect, the purposes for which we use it, and the rights available to individuals whose data we hold.

This policy applies to personal data collected through our website at thanyaad.info, through direct enquiries submitted via our contact form, and through the course of client engagements. It is intended to comply with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and, where applicable, other data protection frameworks that may apply to our international clients.

If you have questions about this policy or our data practices, please contact us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact information: Name, email address, telephone number, and organisation name, where voluntarily provided via the website contact form or direct correspondence.
• Enquiry content: The content of messages submitted through our contact form.
• Engagement data: Information shared by clients in the course of advisory engagements, including business information, financial data, and operational details relevant to the work.
• Website usage data: Technical data such as IP address, browser type, and pages visited, collected via analytics cookies where consent has been given.

Legal basis: Data submitted via the contact form is processed on the basis of legitimate interest and/or consent. Engagement data is processed on the basis of contractual necessity. Analytics data is processed on the basis of consent, obtained through our cookie consent mechanism.

3. How We Use Your Data

We use personal data collected through this website for the following purposes:

• Responding to enquiries submitted via the contact form
• Scoping, proposing, and delivering advisory engagements
• Maintaining records necessary for engagement administration and invoicing
• Improving the content and functionality of our website (analytics, where consented)
• Complying with applicable legal and regulatory obligations

We do not use personal data for direct marketing without prior consent. We do not sell or share personal data with third parties for their marketing purposes.

4. Data Sharing

We do not share personal data with third parties except in the following circumstances:

• With specialist consultants: Where a client has requested or agreed to the engagement of a specialist (legal, financial, or regulatory), relevant information may be shared with that specialist under confidentiality terms.
• With service providers: We may use third-party tools for email delivery and website analytics. These providers process data only as instructed by us and are subject to data processing agreements.
• When legally required: We may disclose data in response to lawful requests from Thai regulatory authorities or courts.

Personal data is not transferred internationally without appropriate safeguards in place, and only where necessary for the provision of services explicitly agreed with the client.

5. Data Protection Measures

We maintain appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction. These include:

• TLS/HTTPS encryption for all data transmitted through the website
• Access controls limiting data access to authorised personnel only
• Secure storage for engagement documents and client correspondence
• Regular review of data handling practices

In the event of a data breach that may affect individuals' rights, we will notify affected parties and, where required, the relevant supervisory authority within the timeframe required by applicable law.

6. Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Enquiry data: Retained for up to 12 months from the date of the enquiry, or until a formal engagement is agreed, at which point it becomes part of the engagement record.
• Engagement records: Retained for 7 years from the close of the engagement, in line with Thai accounting and commercial record requirements.
• Analytics data: Aggregated and anonymised data may be retained indefinitely; individual-level analytics data is retained for no longer than 26 months.

7. Cookies

This website uses cookies. A full description of the cookies we use and the choices available to you can be found in our Cookie Policy. Cookies used for analytics purposes are only set with your consent, which you can provide or withdraw at any time through our cookie preference controls.

8. Your Rights

Under Thailand's Personal Data Protection Act and, where applicable, other data protection frameworks, you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data, subject to legal and contractual retention obligations.
• Right to data portability: Request your data in a portable format where technically feasible.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you believe your rights have not been respected, you may lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices or content of those sites. We recommend reviewing their privacy policies before providing any personal data.

10. Children's Privacy

Our services are intended for business clients and are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected such data, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. Significant changes will be noted on this page with an updated "Last Updated" date. Continued use of the website after such changes constitutes acceptance of the revised policy.

12. Contact

For any privacy-related questions or to exercise your rights, please contact: