Privacy Notice | Thailux Terminal

1. Who we are

Thailux Terminal Co., Ltd. ("Thailux", "we") is the data controller for personal data collected through this website. Company registration no. 0105562023058. Head office: 146/71 Sukhumvit 71 Road, Phra Khanong Nuea, Watthana, Bangkok 10110, Thailand.

Contact for privacy matters: [TODO: privacy contact email, for example an @thailuxter.com address once email is set up].

2. What this notice covers

This notice explains how we handle personal data of business contacts, such as hospital and clinic owners, executives and managers, who visit this website or send us an inquiry. It follows Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").

This website is for business inquiries only. We do not ask for, and you should not send, any patient information through this website.

3. Personal data we collect

Inquiry form: your name, job title, work email, phone, WhatsApp or LINE contact (optional), organisation name and type, city or country, information about your organisation's international patient activities and interests, your message, and your preferred way to be contacted.
Technical data: information needed to deliver and protect the website, such as IP address and browser details, processed by our hosting and security provider. [TODO: add website analytics details if analytics are switched on.]

4. Why we use it and our legal basis

To reply to your inquiry and arrange a discussion: steps you ask us to take before a possible contract, and our legitimate interest in responding to business inquiries.
To manage our business relationship with your organisation if we work together: performance of a contract and legitimate interest.
To keep the website secure and prevent spam or abuse: legitimate interest.
To meet legal obligations, such as accounting or tax rules: legal obligation.

We do not use your data to send marketing or newsletters.

5. Who we share it with

We do not sell personal data. We share it only with service providers that help us run this website and handle inquiries, under contract and for our purposes:

Cloudflare: website hosting, security and spam protection.
[TODO: confirm] An automation service (n8n) that passes form submissions to our systems.
[TODO: confirm] Airtable: secure storage of inquiries.
[TODO: confirm] Google Workspace: business email.

We may also disclose data where required by law or to protect our legal rights.

6. Transfers outside Thailand

Some of these providers store or process data outside Thailand, for example in the United States, Singapore or the European Union. Where this happens, we rely on the safeguards allowed under the PDPA, such as the provider's contractual data protection commitments. [TODO: lawyer to confirm wording and list.]

7. How long we keep it

We keep inquiry data for 24 months after our last contact with you, unless we enter a business relationship or the law requires us to keep it longer. We then delete or anonymise it.

8. Your rights

Under the PDPA you may ask to access, correct, delete or receive a copy of your personal data, object to or restrict its use, and withdraw consent where we rely on consent. You may also complain to Thailand's Personal Data Protection Committee. To use your rights, contact us at the address in section 1.

9. Security

We use reasonable technical and organisational measures to protect personal data, including encrypted connections, access limited to the people who need it, and separate accounts and keys for each of our systems.

10. Changes to this notice

We may update this notice. The current version and its date will always be shown on this page.