Privacy Policy

1. Introduction

Oakvault ("we", "us", "our") is committed to handling your personal data with care and transparency. This Privacy Policy explains what information we collect, why we collect it, how we use it, and what rights you have in relation to it.

We operate in Chiang Mai, Thailand, and comply with the Thailand Personal Data Protection Act B.E. 2562 (PDPA), which governs the collection and use of personal data. This policy applies to all individuals who contact us, use our website, or engage our services.

If you have any questions about this policy, please contact us at [email protected].

2. What Personal Data We Collect

We collect only the personal data necessary to respond to enquiries and deliver our services. This may include:

• Full name
• Email address
• Phone number (if provided)
• Physical address (if relevant to a service booking)
• General notes on the type of support you are seeking
• Usage data collected automatically via cookies and analytics (see Section 5)

We do not collect sensitive personal data (such as financial records, health information, or identification documents) through our website or contact forms.

3. How We Collect Data

Personal data is collected through the following means:

• Contact forms submitted on our website
• Telephone enquiries made to our office number
• Email correspondence initiated by you
• Automatic collection of technical data through cookies and website analytics tools (see Section 5)

4. Legal Basis and Purpose of Processing

Under the PDPA, we process personal data on the following legal bases:

• Consent: When you submit a contact form or opt in to receiving information from us, your consent forms the legal basis for processing.
• Legitimate interest: We may process data to respond to general enquiries, manage bookings, and maintain records of service delivery.
• Contract: If you have engaged our services, processing is necessary to fulfil the service agreement.

We use your data to respond to enquiries, arrange and deliver service visits and workshops, send relevant service information (only with your consent), and improve our website and services.

We retain personal data for a period of no more than 24 months from the date of last contact, after which it is securely deleted unless retention is required by applicable law.

5. Cookies and Analytics

Our website uses cookies to support basic functionality and, where consent is given, to understand how the site is used. See our Cookie Policy for full details.

Analytics data (such as page views and session duration) may be collected via third-party tools including Google Analytics. This data is aggregated and does not identify individuals. You may opt out of analytics cookies via the cookie preferences panel.

6. Data Sharing and Third Parties

We do not sell personal data to third parties. We may share data in limited circumstances:

• With service providers who support our operations (e.g. email hosting, scheduling tools), under appropriate data processing agreements
• With analytics providers where consent to analytics cookies has been given
• Where required by law or by order of a Thai regulatory authority

Any third-party service provider is selected carefully and required to handle data in a manner consistent with this policy.

7. Data Security

We take reasonable steps to protect personal data from unauthorised access, loss, or misuse. Measures in place include:

• Secure, access-controlled storage of digital records
• Restricted staff access to personal data on a need-to-know basis
• HTTPS encryption on our website
• Paper records stored securely and disposed of by shredding when no longer needed

In the event of a personal data breach that poses a risk to affected individuals, we will notify the relevant authorities and, where appropriate, affected individuals in accordance with PDPA requirements.

8. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their own privacy policies before providing personal data to them.

9. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently received data from a minor, we will delete it promptly.

10. Your Rights Under PDPA

Under the Thailand Personal Data Protection Act, you have the following rights in relation to your personal data:

• Right to be informed: You have the right to know how your data is used, as described in this policy.
• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may ask us to correct inaccurate or incomplete data.
• Right to erasure: You may request that we delete your data, subject to any legal retention requirements.
• Right to data portability: Where applicable, you may request your data in a commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

If you have concerns about how we handle your data, you may also lodge a complaint with the Personal Data Protection Committee (PDPC), Thailand's supervisory authority for data protection matters.

11. Changes to This Policy

We may update this policy from time to time. When we do, the "Last updated" date at the top of this page will be revised. Continued use of our website or services following any update constitutes acceptance of the revised policy. We encourage you to review this page periodically.