Privacy Policy
1. Introduction
Whimbrel ("we", "us", "our") is committed to protecting the personal information of individuals who use our services or interact with our website. This Privacy Policy describes what data we collect, how we use it, and the rights you hold in relation to it. Whimbrel is the data controller for the purposes of the Personal Data Protection Act B.E. 2562 (PDPA) of Thailand.
If you have any questions about this policy, please contact us at [email protected].
2. Data We Collect
We collect personal data in the following ways:
- Contact form submissions: name, email address, phone number (optional), and message content
- Program registration: name, contact details, and session scheduling information
- Website analytics: pages visited, time on site, device type — collected via analytics cookies where consented
- Communications: emails and messages you send to us
We do not collect sensitive financial details (such as bank account numbers or tax identification numbers) through any online form.
3. Legal Basis for Processing
We process personal data on the following legal bases under the PDPA:
- Consent: For marketing communications and analytics cookies, where you have given explicit consent
- Contract: To fulfil our obligations when you enrol in a program
- Legitimate interest: To respond to enquiries and improve our services
- Legal obligation: Where required by Thai law
4. How We Use Your Data
- To respond to enquiries submitted via the contact form
- To schedule and deliver educational program sessions
- To send program-related communications (session reminders, materials)
- To improve our website and services through analytics
- To comply with applicable Thai legal requirements
We do not use your data for automated decision-making or profiling.
5. Data Sharing
We do not sell, rent, or trade your personal data to third parties. Data may be shared in the following limited circumstances:
- Service providers: Third-party tools that support our operations (email hosting, analytics), under data processing agreements
- Legal requirements: Where disclosure is required by Thai law or a valid legal order
- Google Analytics: If analytics cookies are consented to, anonymised usage data is shared with Google LLC. See Google's Privacy Policy at google.com/privacy for details.
6. Data Retention
Contact enquiries and session records are retained for a period of three years following the last interaction, after which they are securely deleted. Analytics data is retained for a maximum of 26 months. You may request deletion at any time (see Section 8).
7. Cookies
Our website uses cookies. Essential cookies are required for basic site functionality. Analytics and preference cookies are only used where you have given consent via the cookie notice. For full details, see our Cookie Policy.
8. Your Rights Under the PDPA
As a data subject under Thai law, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you
- Right to rectification: Request correction of inaccurate data
- Right to erasure: Request deletion of your personal data (subject to legal obligations)
- Right to data portability: Request your data in a structured, machine-readable format
- Right to object: Object to processing based on legitimate interest
- Right to withdraw consent: Withdraw any previously given consent at any time
To exercise any of these rights, contact [email protected]. We will respond within 30 days.
9. Data Security
We apply reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, or loss. These include access controls, encrypted email communications, and restricted access to session records. In the event of a data breach that poses risk to individuals, we will notify the Personal Data Protection Committee of Thailand and affected individuals in accordance with the PDPA.
10. Third-Party Links
Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their policies independently.
11. Children's Privacy
Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact [email protected] and we will delete it promptly.
12. International Data Transfers
Some third-party services we use (such as Google Analytics) may process data outside Thailand. Where this occurs, we rely on appropriate safeguards, including standard contractual clauses, to ensure your data remains protected.
13. Supervisory Authority
If you have an unresolved concern about how we handle your data, you may lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand at www.pdpc.or.th.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will post a notice on the website. Continued use of our services following any update constitutes acceptance of the revised policy.
15. Contact
For privacy-related questions, data subject requests, or complaints:
- Email: [email protected]
- Address: Whimbrel, 12/8 Nang Linchi Road, Chong Nonsi, Yan Nawa, Bangkok 10120, Thailand
- Phone: +66 2 287 6245