PDPA Notice (Thailand)
Privacy notice under Thailand's PDPA
Last updated: 10 June 2026
This page restates the same notice with the PDPA in view. For data subjects in Thailand, the Thai-language version is the legally operative one.
This notice is issued under the Personal Data Protection Act B.E. 2562 (2019). It tells you what personal data I collect through prom.work, the lawful basis I rely on, how long I keep it, where it may travel, and the rights you can exercise. I am the data controller and the single point of contact for all of it.
1. Data controller
Prom (พรหม), operating prom.work as a sole practitioner, Bangkok, Thailand. Contact for all data matters: hi@prom.work. There is no separate Data Protection Officer; I handle requests personally.
2. Personal data collected
Through the contact form: your name, your email address, the category of work you select from a short list, and the free-text message you write describing the project. Plus minimal delivery metadata generated when your message is submitted. No special-category data is requested, and you are asked not to send any.
3. Purpose and lawful basis
I process your data to respond to your enquiry, to scope and prepare a proposal, and to keep a light record of contact. Lawful bases relied on: your consent in submitting the form; steps necessary to enter into and perform a contract at your request; and my legitimate interest in operating the studio, balanced against your rights.
4. Retention
Enquiry data is retained for twelve (12) months from your last contact, then purged automatically. Data tied to an active or completed engagement is kept only for as long as the law requires for tax and accounting, then deleted. You may request earlier deletion at any time.
5. Cross-border transfer
Some processors operate outside Thailand, including in the United States: Resend (email delivery), Vercel (hosting and serverless functions), and Upstash (storage). Your data may be transferred to and processed in those jurisdictions under recognised data-protection safeguards. If you prefer to keep the conversation in Thailand, contact me on LINE instead of the form.
6. Your rights as a data subject
Under the PDPA you may request access to your data, correction, deletion or destruction, restriction or suspension of processing, data portability, and you may object to processing or withdraw consent at any time (withdrawal does not affect lawful processing already carried out). To exercise any right, email hi@prom.work; I will verify your identity and respond within the period the law allows. You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.
7. Cookies and tracking
No advertising or third-party tracking cookies are used, and no consent banner is required. Analytics, if any, are cookieless and aggregate. The only state stored is your chosen language preference.
8. Security
Data is transmitted over encrypted connections and held by reputable processors. As a studio of one, I keep the data footprint small on purpose: less collected, less to protect, less to leak.
9. Updates
This notice may be updated as practices change. The current version, with its effective date, always lives on this page.
This notice is written in plain language and provided in good faith. It is not legal advice. Please confirm with a qualified professional before relying on it for anything formal.