Privacy notice

2. What we collect

Only what you type into a form on this site. We do not buy data, and we do not build a profile of you from other sources.

Enquiry form

Your name
Your business name, if you give one
Your email address
Your phone number or LINE ID, if you give one
Your preferred language and the project type you select
Your current website address, if you give one
Whatever you write in the message field

Scoping questions

The same contact details, plus your six answers about the product you want, what exists today, what it must do, who supplies the content, and your timing.

Server logs

Our hosting provider records the standard technical information every web server records: IP address, timestamp, the page requested, and browser type. We do not combine these logs with form submissions, and we do not use them to identify individual visitors.

What we never ask for

We do not request, and you should not send us, national ID numbers, payment card details, health information, or any of the categories the PDPA treats as sensitive personal data. If you send such information anyway, we will delete it rather than store it.

3. Why we collect it, and on what basis

The PDPA requires a lawful basis for each purpose, identified before collection. Ours:

Replying to your enquiry: Necessary to take steps at your request before entering a contract, under s.24(3). You contacted us asking for a reply; the reply needs your contact details.
Preparing a scope or estimate: Also pre-contractual steps at your request, under s.24(3).
Keeping the site available and secure: Our legitimate interest under s.24(5) in running a working website and preventing abuse of the forms. We have weighed this against your rights and consider it proportionate, because the data involved is technical and short-lived.
Keeping business records: Where a project proceeds, compliance with Thai accounting and tax obligations, under s.24(6).

We do not use your details for marketing. If that ever changes, we will ask for your consent separately first, and you will be able to withdraw it at any time without affecting anything else.

We do not use your enquiry to train any machine-learning model, and we do not send the contents of your message to any third-party AI service.

4. Who else sees it

We do not sell personal data, and we do not share it for anyone else's marketing. It is handled by these processors, each under a written agreement limiting them to our instructions:

Website hosting — [hosting provider and country]. Serves the pages and keeps the server logs described in section 2.
Email delivery and inbox — [email provider and country]. Carries your enquiry to us and stores it in our inbox.

There is no analytics provider, no advertising network, no chat widget, no embedded map, no social media tracking pixel, and no content delivery network on this site. Every font, style, script and image is served from this domain. That is a design decision, and it is why this section is short.

We will also disclose personal data where we are legally required to, for example in response to a lawful order from a Thai authority or a court.

5. Transfers outside Thailand

[Confirm whether the hosting and email providers store data outside Thailand, name the destination countries, and state the transfer mechanism relied on under PDPA s.28 or s.29.]

The PDPA restricts sending personal data to a destination without adequate protection. Where a transfer happens, we rely on the safeguards required by those sections rather than on the vendor's location alone.

6. How long we keep it

Enquiries that go nowhere: [retention period — proposed: 12 months from last contact], then deleted.
Enquiries that become projects: Kept for the life of the engagement, then for [period required by Thai accounting and tax law — confirm with your accountant].
Server logs: [log retention period set by the hosting provider].

When a retention period ends, the data is deleted. We do not keep it indefinitely on the basis that it might be useful one day.

7. Your rights

The PDPA gives you the following rights over your personal data. They are free to exercise, and using one will never affect how we deal with you.

Access — s.30: Ask what we hold about you and get a copy.
Portability — s.31: Receive it in a machine-readable form, or have it sent to someone else where that is technically possible.
Object — s.32: Object to us handling it, including where we rely on legitimate interest.
Erasure — s.33: Have it deleted or anonymised, where we have no overriding legal reason to keep it.
Restriction — s.34: Have us pause using it while something is being checked or disputed.
Rectification — s.35, s.36: Have it corrected if it is wrong, out of date, incomplete or misleading.
Withdraw consent: Where we ever rely on consent, withdraw it at any time. Withdrawal does not undo processing already carried out lawfully.

To use any of these, email info@jomtien.net and say which right you are exercising. We may need to confirm who you are before we act, so that we do not hand your data to someone else. We will respond within [response window — proposed: 30 days], and tell you if we need longer and why.

8. How it is protected

Measures actually in place on this site:

The whole site is served over HTTPS.
A strict Content Security Policy limits the page to resources from this domain only.
Form input is length-limited and validated before anything is sent.
Form contents are never written to browser console output, analytics, or application logs.
Access to the enquiry inbox is limited to people who need it to reply to you.

No system is perfectly secure, and we will not claim otherwise. If a breach occurs that risks your rights and freedoms, we will notify the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.

9. Cookies and tracking

This site sets no cookies. There is no analytics, no advertising tag, no tracking pixel and no cross-site identifier. There is no cookie banner because there is nothing to consent to.

If analytics is ever added, this notice will be updated first, the provider will be named in section 4, and non-essential tracking will not load until you have agreed to it.

10. If you want to complain

Tell us first — info@jomtien.net — and we will try to put it right.

You also have the right to complain directly to the Personal Data Protection Committee, the regulator for the PDPA in Thailand, at pdpc.or.th. You do not need our permission, and you do not need to come to us first.

11. Changes to this notice

When this notice changes, the version number and effective date at the top change with it. Where a change materially affects how we handle data you have already given us, we will contact you rather than rely on you noticing.

12. Contact

For anything in this notice, including exercising a right under section 7:

info@jomtien.net

[registered legal entity name]
[registered address]
Jomtien Beach, Pattaya, Chonburi, Thailand

1. Who is responsible for your data