Privacy Policy

1. Overview & Data Controller

Toolkit Work Co., Ltd. (“we”, “us”, or “our”) values the privacy of every visitor and client. This Privacy Policy explains how we collect, process, store, and protect personal data collected through toolkitwork.digital and during our professional advisory communications.

For the purposes of applicable data protection legislation—including the Thailand Personal Data Protection Act B.E. 2562 (2019) (PDPA) and international data protection standards—the Data Controller is:

Entity Name: Toolkit Work Co., Ltd.
Registered Office: Office 7, 51 Placeholder Street, Nakhon Ratchasima 00000, Thailand
Data Protection Officer / Privacy Contact: hello@toolkitwork.digital
Telephone: +66 44 000 852

2. Information We Collect

We collect only data necessary to communicate with prospective clients and conduct our diagnostic advisory services:

Inquiry Information: When you submit an inquiry form on our website, we collect your name, business email address, company or project name, preferred advisory service, application client platform, and message details.
Advisory Engagement Data: In the course of executing an audit statement of work, we may receive sandbox test credentials, schema files, and aggregate funnel reports. We require clients to exclude end-user Personally Identifiable Information (PII) from any shared telemetry datasets.
Technical & Browsing Data: We collect standard, non-identifying server log data (IP address, browser type, timestamp, page navigation paths) and anonymous aggregate analytics cookies where consent has been granted.

3. Lawful Bases for Processing

Under Thailand PDPA, we process personal data under the following legal bases:

Contractual Necessity: Processing inquiry and engagement data necessary to prepare quotes, schedule audits, and fulfill advisory contracts.
Legitimate Interests: Operating, securing, and maintaining the stability and performance of toolkitwork.digital.
Consent: Storing optional non-essential analytics cookies, which you can grant or decline via our cookie consent banner.

4. Data Retention Periods

Inquiry Communications: Kept for up to 24 months from the date of last correspondence for prospective client records.
Client Engagement Documentation: Kept for 5 years following completion of an advisory project to comply with Thai corporate tax, legal, and accounting obligations.
Server Logs: Retained for a rolling period of 90 days for network security and diagnostic purposes.

5. International Data Transfers

As an advisory practice operating in Thailand, our primary data processing takes place in Thailand. Where cloud services (e.g., secure encrypted email hosting or static CDN delivery) store data internationally, we ensure adequate security safeguards, encryption in transit and at rest, and compliance with cross-border transfer standards.

Subject to applicable legal constraints, you hold the following rights regarding your personal data:

Right to Access: Request a copy of the personal information we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete personal records.
Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where retention is no longer legally mandated.
Right to Restrict or Object: Restrict or object to processing under specific legitimate interest grounds.
Right to Withdraw Consent: Withdraw consent for analytics cookies at any time via our Cookie Settings.

To exercise any of these rights, email your request to hello@toolkitwork.digital. We respond to all verified requests within 30 calendar days.

7. Cookies & Tracking