Privacy Policy

1. Introduction

Kintara Co., Ltd. ("Kintara", "we", "us") operates a professional advisory business focused on operations and process improvement. We are committed to handling personal data responsibly and transparently.

This policy explains what personal data we collect through our website and in the course of delivering our advisory services, how we use it, and what rights you have. It applies to all visitors to our website and to individuals whose data we process in connection with our work.

This policy is governed by Thai law, including the Personal Data Protection Act B.E. 2562 (PDPA) which came into full effect in June 2022. If you have questions about this policy, contact us at [email protected].

2. What Personal Data We Collect

We collect personal data in the following ways:

Via our website contact form:

• Full name (required)
• Email address (required)
• Phone number (optional)
• Message content (optional)

Via cookies and analytics tools:

• Pages visited and time on site
• Browser type and device category
• Referring website or search term

In the course of advisory engagements:

• Names and roles of staff who participate in observation sessions or interviews
• Contact information of client representatives

Legal basis: Contact form submissions are processed on the basis of your consent. Engagement-related data is processed on the basis of contractual necessity. Analytics data is processed on the basis of our legitimate interest in understanding website performance, subject to your cookie consent.

Retention: Website enquiry data is retained for up to 24 months. Engagement data is retained for up to 5 years for professional record-keeping purposes.

3. How We Use Personal Data

We use the personal data we collect for the following purposes:

• Responding to enquiries submitted through our website contact form
• Providing scoping consultations and delivering advisory engagements
• Communicating with client contacts about engagement progress and deliverables
• Sending occasional updates about our services, if you have opted in
• Improving our website and understanding how visitors use it (analytics only)
• Complying with legal obligations

We do not sell personal data to third parties. We do not use personal data for automated decision-making.

4. Data Protection Measures

• Our website is served over HTTPS (TLS encryption in transit)
• Access to contact form submissions is limited to authorised staff
• Engagement documents and notes are stored on password-protected systems with access controls
• We review our data handling practices regularly
• In the event of a data breach affecting your personal data, we will notify you and the relevant authority as required by the PDPA

5. Cookies

Our website uses cookies. Essential cookies are required for the site to function. Analytics and preference cookies are optional and are only placed with your consent.

For full details on the types of cookies we use and how to manage your preferences, see our Cookie Policy.

6. Third-Party Services and Sharing

We may share data with the following categories of third parties where necessary:

• Analytics providers (e.g. Google Analytics) — website usage data, subject to your cookie consent
• Email service providers — used to deliver email communications
• Advertising platforms (e.g. Google, Meta) — only if you have given cookie consent for marketing cookies

We do not transfer personal data outside Thailand or to international recipients except where required by the above services, in which case appropriate safeguards are in place.

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend you review their policies independently.

7. Your Rights Under the PDPA

Under Thailand's Personal Data Protection Act, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data, subject to legal retention requirements
• Right to portability — request your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time where processing is based on consent
• Right to lodge a complaint — with the Office of the Personal Data Protection Committee (PDPC), Thailand

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Children's Privacy

Our services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us and we will remove it promptly.

9. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Where changes are material, we will take reasonable steps to notify users. Continued use of our website after a policy update constitutes acceptance of the revised terms.