Privacy Policy

1. Introduction

Khemloft ("we", "us", "our") is a technology procurement advisory practice registered and operating in Bangkok, Thailand. We take the handling of personal information seriously and this policy explains what data we collect, how we use it, and the choices available to you.

This policy applies to personal data collected through our website at khemloftx.info and through the advisory services we provide to clients. If you have questions about this policy, please contact us at [email protected].

2. Data We Collect

We collect personal data in the following ways:

• Contact form submissions: name, email address, and phone number (optional) when you submit an enquiry through our website.
• Direct correspondence: email address and contact details when you correspond with us directly.
• Client engagements: information shared during advisory sessions, including organisational details and documents provided in the course of the engagement.
• Website analytics: anonymised usage data such as pages visited, browser type, and approximate location, collected via analytics cookies where you have consented.

We do not collect sensitive personal data (such as health, financial account, or government identity information) through our website. Any sensitive information shared during a client engagement is handled under the terms agreed with the client.

Legal basis for processing (Thailand PDPA)

We process personal data on the following bases under Thailand's Personal Data Protection Act B.E. 2562 (PDPA): your consent (for analytics cookies and marketing communications), the performance of a contract or pre-contractual steps (for enquiry responses and service delivery), and our legitimate interests (for maintaining business records and improving our services).

Retention periods

Enquiry records are retained for up to 24 months. Client engagement records are retained for up to five years after engagement close. Analytics data is retained for up to 14 months. Marketing consent records are retained until consent is withdrawn plus 12 months.

3. How We Use Your Data

• Responding to enquiries and providing the advisory services you have requested.
• Communicating about ongoing engagements, session scheduling, and deliverables.
• Sending occasional relevant updates or service information where you have consented.
• Improving our website and services through anonymised analytics data.
• Maintaining records required for legitimate business purposes.
• Complying with applicable legal obligations under Thai law.

We do not sell personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects.

4. Sharing Your Data

We share personal data only in the following limited circumstances:

• Service providers: third-party tools used to operate our website and deliver services (such as email hosting and analytics platforms), under contractual data processing agreements.
• Legal requirements: where disclosure is required by Thai law, court order, or regulatory authority.
• Business transfers: in the event of a merger or acquisition, subject to equivalent confidentiality obligations being maintained.

5. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or loss. These include encrypted data transmission (HTTPS), access controls limiting who can view client records, and regular review of third-party service provider security practices. In the event of a data breach affecting your personal data, we will notify you as required under the PDPA.

6. Cookies

Our website uses cookies. Essential cookies are required for the site to function and are always active. Analytics, marketing, and preference cookies are optional and used only with your consent. You can manage your cookie preferences at any time through our Cookie Policy page.

7. Your Rights

Under Thailand's PDPA, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your data where it is no longer necessary or where you withdraw consent.
• Data portability: request that your data be provided in a machine-readable format where technically feasible.
• Objection: object to processing based on legitimate interests.
• Withdrawal of consent: withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
• Complaint: lodge a complaint with Thailand's Personal Data Protection Committee (PDPC) if you believe your data has been mishandled.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites. We recommend reviewing the privacy policy of any external site you visit.

9. Children's Privacy

Our services are intended for business use by adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted data to us, please contact us at [email protected] and we will delete it promptly.

10. Policy Updates

We may update this policy from time to time. Changes will be posted on this page with an updated date at the top. For material changes, we will provide notice via email to clients or through a notice on our website. Continued use of our website or services after a change is posted constitutes acceptance of the updated policy.

11. Contact

For any questions about this policy or to exercise your data rights, please contact: