Privacy Policy

1. Data Controller

Doi Spark operates as the data controller for personal data collected through our website and programme engagements. Our registered address is 32 Chang Klan Road, Hai Ya, Mueang Chiang Mai, Chiang Mai 50100, Thailand. For data-related enquiries, please contact: [email protected].

2. Personal Data We Collect

We collect the following categories of personal data:

• Contact information: Name, email address, and phone number submitted via our contact form or during programme registration.
• Professional information: Job title, company name, and industry, provided voluntarily during programme scoping or enquiries.
• Usage data: IP address, browser type, pages visited, and session duration, collected automatically via cookies and analytics tools when you use our website.
• Programme participation data: Responses, outputs, and feedback collected during workshops or briefings as part of the engagement deliverables.

3. Legal Basis for Processing

• Consent: Where you have provided explicit consent, for example when subscribing to updates or accepting optional cookies.
• Contractual necessity: Where processing is required to deliver a programme or respond to an enquiry you have made.
• Legitimate interests: Where we have a legitimate interest in improving our services, such as analysing how our website is used.
• Legal obligation: Where processing is required to comply with applicable Thai law.

4. How We Use Your Data

• Responding to enquiries and scheduling initial consultations
• Delivering programme materials and communications during an engagement
• Sending programme updates, closing documentation, and follow-up materials
• Improving the design and content of our programmes based on aggregate feedback
• Fulfilling any legal obligations applicable under Thai law

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Data Retention

We retain contact and enquiry data for a maximum of 24 months from the date of last contact. Programme participation records are retained for 36 months following programme completion. Usage data collected via analytics is aggregated and anonymised after 14 months. You may request deletion of your data at any time by contacting us at [email protected].

6. Data Sharing

We may share personal data with the following categories of third parties, only to the extent necessary:

• Analytics providers: We use Google Analytics to understand website usage. Data is processed under Google's terms and anonymised where possible.
• Email service providers: We use a third-party email platform to send programme communications. Email addresses are processed under data processing agreements.
• Legal authorities: We may disclose data if required to do so by Thai law or in response to a lawful request by public authorities.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These measures include encrypted data transmission (HTTPS), access controls, and regular review of data handling practices. In the event of a data breach that is likely to result in risk to your rights, we will notify you and the relevant supervisory authority in accordance with PDPA requirements.

8. Cookies

We use cookies to support website functionality and understand usage patterns. You can manage your cookie preferences via the cookie consent tool on our website or through your browser settings. For full details, please see our Cookie Policy.

9. Your Rights Under PDPA

Under Thailand's Personal Data Protection Act, you have the following rights:

• Right to access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your data where we no longer have a lawful basis for retention.
• Right to data portability: Where applicable, you may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Right to lodge a complaint: You have the right to contact Thailand's Personal Data Protection Committee (PDPC) if you believe your rights have been infringed.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend you review their policies independently.

11. Children's Privacy

Our services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has submitted personal data to us, please contact us immediately at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The revised version will be posted on our website with an updated effective date. We encourage you to review this page periodically.