Legal
Privacy notice
This notice explains what personal data Jomtien Network collects through this website, why we collect it, how long we keep it, and the rights you hold over it under the Personal Data Protection Act B.E. 2562 (2019).
Version 1.0 · effective
PENDING LEGAL REVIEW — four values still to supply.
Drafted against PDPA s.23, s.24 and ss.30–36, and reviewed for accuracy against what the site actually does. Hosting, email, cross-border transfer, retention and response times are now stated as fact. What remains is the company registration — legal name, registration number, registered address, and whether a Data Protection Officer is appointed — plus a read-through by a qualified Thai practitioner. See docs/PRIVACY-FILL.md.
1. Who is responsible for your data
The data controller is [registered legal entity name], registered in Thailand under company number [registration number], with its registered office at [registered address], trading as Jomtien Network.
“Data controller” is the term the PDPA uses for the party that decides why and how personal data is handled. That is us. If you have a question about anything in this notice, section 12 tells you how to reach a person about it.
[We have / have not] appointed a Data Protection Officer.
2. What we collect
Only what you type into a form on this site. We do not buy data, and we do not build a profile of you from other sources.
Enquiry form
- Your name
- Your business name, if you give one
- Your email address
- Your phone number or LINE ID, if you give one
- Your preferred language and the project type you select
- Your current website address, if you give one
- Whatever you write in the message field
Scoping questions
The same contact details, plus your six answers about the product you want, what exists today, what it must do, who supplies the content, and your timing.
Server logs
Our hosting provider records the standard technical information every web server records: IP address, timestamp, the page requested, and browser type. We do not combine these logs with form submissions, and we do not use them to identify individual visitors.
What we never ask for
We do not request, and you should not send us, national ID numbers, payment card details, health information, or any of the categories the PDPA treats as sensitive personal data. If you send such information anyway, we will delete it rather than store it.
3. Why we collect it, and on what basis
The PDPA requires a lawful basis for each purpose, identified before collection. Ours:
- Replying to your enquiry
- Necessary to take steps at your request before entering a contract, under s.24(3). You contacted us asking for a reply; the reply needs your contact details.
- Preparing a scope or estimate
- Also pre-contractual steps at your request, under s.24(3).
- Keeping the site available and secure
- Our legitimate interest under s.24(5) in running a working website and preventing abuse of the forms. We have weighed this against your rights and consider it proportionate, because the data involved is technical and short-lived.
- Keeping business records
- Where a project proceeds, compliance with Thai accounting and tax obligations, under s.24(6).
We do not use your details for marketing. If that ever changes, we will ask for your consent separately first, and you will be able to withdraw it at any time without affecting anything else.
We do not use your enquiry to train any machine-learning model, and we do not send the contents of your message to any third-party AI service.
5. Transfers outside Thailand
Yes. This website and its email are hosted by Hostinger on servers in Singapore, so anything you send through a form is stored outside Thailand. We rely on the appropriate-safeguards route under s.28, through the data processing terms Hostinger applies to every account, rather than on the provider's location alone.
The PDPA restricts sending personal data to a destination without adequate protection. Where a transfer happens, we rely on the safeguards required by those sections rather than on the vendor's location alone.
6. How long we keep it
- Enquiries that go nowhere
- 12 months from our last contact with you, then deleted.
- Enquiries that become projects
- Kept for the life of the engagement, then for 5 years, the retention period Thai accounting law applies to business records.
- Server logs
- Kept by Hostinger under their own retention policy. We do not extend it and we do not copy them.
When a retention period ends, the data is deleted. We do not keep it indefinitely on the basis that it might be useful one day.
7. Your rights
The PDPA gives you the following rights over your personal data. They are free to exercise, and using one will never affect how we deal with you.
- Access — s.30
- Ask what we hold about you and get a copy.
- Portability — s.31
- Receive it in a machine-readable form, or have it sent to someone else where that is technically possible.
- Object — s.32
- Object to us handling it, including where we rely on legitimate interest.
- Erasure — s.33
- Have it deleted or anonymised, where we have no overriding legal reason to keep it.
- Restriction — s.34
- Have us pause using it while something is being checked or disputed.
- Rectification — s.35, s.36
- Have it corrected if it is wrong, out of date, incomplete or misleading.
- Withdraw consent
- Where we ever rely on consent, withdraw it at any time. Withdrawal does not undo processing already carried out lawfully.
To use any of these, email info@jomtien.net and say which right you are exercising. We may need to confirm who you are before we act, so that we do not hand your data to someone else. We will respond within 30 days, and tell you if we need longer and why.
8. How it is protected
Measures actually in place on this site:
- The whole site is served over HTTPS.
- A strict Content Security Policy limits the page to resources from this domain only.
- Form input is length-limited and validated before anything is sent.
- Form contents are never written to browser console output, analytics, or application logs.
- Access to the enquiry inbox is limited to people who need it to reply to you.
No system is perfectly secure, and we will not claim otherwise. If a breach occurs that risks your rights and freedoms, we will notify the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.
10. If you want to complain
Tell us first — info@jomtien.net — and we will try to put it right.
You also have the right to complain directly to the Personal Data Protection Committee, the regulator for the PDPA in Thailand, at pdpc.or.th. You do not need our permission, and you do not need to come to us first.
11. Changes to this notice
When this notice changes, the version number and effective date at the top change with it. Where a change materially affects how we handle data you have already given us, we will contact you rather than rely on you noticing.
12. Contact
For anything in this notice, including exercising a right under section 7:
[registered legal entity name][registered address]
Jomtien Beach, Pattaya, Chonburi, Thailand