Privacy Policy

01

Introduction

Loomwright is committed to handling personal data with care. This Privacy Policy sets out what personal information we collect, how we use it, and what choices you have in relation to it. It applies to information collected through this website and through the course of our consulting engagements.

If you have questions about this policy, you may contact us at [email protected].

02

Personal Data We Collect

Information you provide

• Name, email address, and telephone number — when you submit a contact enquiry through our website
• Business name and role — when provided in the context of a consulting enquiry
• Communication records — emails, messages, and notes from working sessions during an engagement

Information collected automatically

• Technical data including IP address, browser type, and pages visited — via website analytics tools, where consent has been given
• Cookie preferences — stored in your browser's local storage

Legal basis for processing (PDPA, Thailand)

We process personal data under the Personal Data Protection Act B.E. 2562 (2019) (PDPA) on the following grounds: your consent (for website analytics and marketing communications), the performance of a contract or pre-contractual steps (for enquiries and engagements), and our legitimate interests in operating the practice.

Data retention

• Contact enquiry data: retained for up to 12 months after the last communication
• Engagement records: retained for up to 24 months after the engagement closes, then securely deleted
• Analytics data: retained in accordance with the analytics provider's standard retention settings

03

How We Use Personal Data

• To respond to enquiries received through the website
• To deliver consulting engagements and produce the agreed documents
• To send engagement-related communications (scheduling, draft sharing, invoicing)
• To understand how the website is used, where consent has been provided
• To comply with legal obligations

We do not sell personal data to third parties. We do not use personal data for automated decision-making or profiling. We do not send marketing communications without explicit consent.

04

Data Sharing

We share personal data only in the following limited circumstances:

• Service providers: We use third-party tools for email communication (such as Google Workspace) and website analytics (such as Google Analytics, where enabled). These providers process data as data processors on our behalf.
• Legal requirements: We may disclose personal data where required by Thai law or by a competent authority.

We do not transfer personal data outside Thailand except where the tools listed above involve international data transfers in accordance with PDPA requirements.

05

Data Protection Measures

• Communications are conducted over encrypted channels (TLS/HTTPS)
• Documents are stored in access-controlled cloud environments with strong authentication
• Access to engagement data is limited to the persons directly involved in that engagement
• In the event of a data breach affecting your personal data, we will notify you and the relevant authority within the timeframes required by the PDPA

06

Cookies

This website uses cookies for basic functionality and, where consent is given, for analytics. You can manage your cookie preferences using the cookie banner displayed on the site, or via our Cookie Policy page.

07

Your Rights

Under the PDPA, you have the following rights in relation to your personal data:

• Access: to request a copy of the personal data we hold about you
• Rectification: to request correction of inaccurate personal data
• Erasure: to request deletion of your personal data, subject to our legitimate interests and legal obligations
• Portability: to receive personal data in a structured, commonly used format
• Objection: to object to processing based on legitimate interests
• Withdrawal of consent: to withdraw consent at any time where processing is based on consent
• Complaint: to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

08

Third-Party Links

This website may contain links to external websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policy of any site you visit.

09

Children's Privacy

Our services are directed at organisations and business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you become aware that a minor has submitted personal data to us, please contact us so we can take appropriate steps.

10

Policy Updates

We may update this policy from time to time. When we do, we will revise the Last Updated date at the top of this page. Continued use of the website following any update constitutes acceptance of the revised policy. For material changes, we will take reasonable steps to inform users directly where we hold contact information.