Privacy Policy
Last updated:
Draft for legal review. This policy is a starting template written with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) in mind. Please have it reviewed by a qualified Thai lawyer before publishing.
1. Who we are
Securegenix Co., Ltd. (“Securegenix”, “we”, “us”) is the data controller for personal data collected through this website, securegenix.com.
- Registered address: 000 Example Road, Bangkok 10000, Thailand
- Company registration number: [Placeholder: company registration number]
- Email: privacy@securegenix.com
2. Data protection officer
[Placeholder: If you have appointed a Data Protection Officer (DPO), add their name or title and contact details here. If not, state that privacy enquiries should be sent to the email above.]
3. Personal data we collect
Information you give us. When you contact us by email, phone, LINE or the contact form, we collect the information you choose to provide, such as your name, company, job title, work email address, phone number, the service you are interested in, and the content of your message.
Information collected automatically. This website does not use cookies, analytics, advertising trackers or third-party scripts. Like all web servers, our hosting provider (Google Firebase Hosting) processes technical data such as your IP address, browser user agent, the page requested and the time of the request, in order to deliver the site and protect it from abuse.
Contact form. Messages sent through the contact form are processed by a service we run on Google Cloud (Cloud Run, Singapore region) and delivered by email to our Microsoft 365 mailbox. We do not keep a separate database of form submissions. To protect the form from spam and abuse, we record a one-way cryptographic hash of your IP address and email address, together with a counter, for about one hour. These records cannot be turned back into your IP or email address and are deleted automatically, normally within 24 hours. The form also contains a hidden field that only automated bots fill in; messages that fill it in are discarded.
We do not knowingly collect sensitive personal data as defined in Section 26 of the PDPA. Please do not send us such data through this website.
4. Why we use your data and our legal basis
| Purpose | Legal basis under the PDPA |
|---|---|
| Responding to your enquiry and preparing a proposal | Steps taken at your request before entering into a contract (Section 24(3)) and your consent (Section 19) |
| Managing our relationship with you as a client or prospective client | Performance of a contract (Section 24(3)) and our legitimate interests (Section 24(5)) |
| Operating, securing and troubleshooting this website | Our legitimate interests in running a secure website (Section 24(5)) |
| Protecting the contact form from spam and abuse (hashed rate-limit records) | Our legitimate interests in preventing abuse (Section 24(5)) |
| Complying with legal obligations, such as accounting and tax records | Legal obligation (Section 24(6)) |
We do not sell your personal data and we do not use it for automated decision-making or profiling.
5. Who we share it with
We share personal data only where necessary, with:
- Service providers acting on our behalf, such as our website hosting and contact form provider (Google Cloud / Firebase) and our email provider (Microsoft 365), under contracts that require them to protect your data.
- Professional advisers such as lawyers, auditors and accountants, where needed.
- Authorities where we are required to by law.
6. International transfers
Some of our service providers may store or process data outside Thailand. Where this happens, we take the steps required by Sections 28 and 29 of the PDPA, such as relying on the provider’s appropriate safeguards or standard contractual terms.
7. How long we keep it
We keep enquiry data for as long as needed to respond and follow up, and for no longer than [Placeholder: retention period, e.g. 2 years] after our last contact unless you become a client. Client records are kept for as long as required by our contracts and Thai law. Hashed rate-limit records for the contact form are deleted automatically, normally within 24 hours. Web server logs are kept by our hosting provider for a limited period in line with its own retention policy.
8. Your rights
Under the PDPA you have the right to:
- withdraw your consent at any time, without affecting processing that took place before you withdrew it;
- access and obtain a copy of your personal data;
- receive your data in a commonly used electronic format and have it transferred (data portability);
- object to the processing of your data;
- ask us to delete, destroy or anonymise your data;
- ask us to restrict the use of your data;
- ask us to correct data that is inaccurate, out of date or incomplete; and
- complain to the Personal Data Protection Committee (PDPC) of Thailand.
To exercise any of these rights, email privacy@securegenix.com. We will respond within the time required by the PDPA, normally within 30 days.
9. How we protect your data
We apply technical and organisational security measures appropriate to the risk, including encryption in transit (HTTPS with HSTS), access control and least-privilege access to systems that hold personal data.
10. Cookies
This website does not set cookies. If that changes, we will update this policy and, where required, ask for your consent first.
11. Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last changed.
12. Contact
Questions about this policy or your personal data: privacy@securegenix.com.