Data Protection & Privacy Governance (PDPA)
Privacy Policy & Data Notice
Personal data protection notice for clients, website visitors, and digital users of Tiao Phanit under Thailand PDPA B.E. 2562 (2019).
Effective Date & Last Updated: 21 October 2026
1Introduction and Governance Scope
Tiao Phanit (acting as the Data Controller under the Personal Data Protection Act B.E. 2562) recognizes the fundamental importance of your personal data protection and privacy rights. This notice establishes our transparent commitment to safeguarding personal data in compliance with Thailand PDPA and international security standards, delineating the lawful bases, collection categories, usage purposes, and mechanisms for exercising Data Subject Rights.
2Data Categories and Lawful Processing Bases
We collect and process your personal data strictly under valid lawful grounds as specified below:
Contractual Necessity
Full name, phone number, email, and corporate entity credentials to evaluate advisory inquiries, formulate tax optimization models, insurance coverage proposals, or PEAK cloud accounting integrations.
Explicit Consent
Analytical cookies (Google Analytics 4) and targeted conversion tags (Meta Pixel). User consent preferences are recorded locally and can be modified or revoked at any time.
Legitimate Interest
Web server access logs, IP addresses, and device metadata strictly necessary to protect infrastructure integrity, prevent DDoS attacks, and enforce cybersecurity defense.
Legal & Regulatory Obligation
Compliance with regulatory mandates governed by the Office of Insurance Commission (OIC), Revenue Department, and electronic transaction laws.
3Data Retention Schedule
- Consultation & Advisory Inquiries: Retained for the duration of the engagement and up to 2 years post-completion for seamless continuity.
- System & Access Logs: Retained for at least 90 days and up to 1 year pursuant to the Computer Crime Act and cybersecurity guidelines.
- Cookie Consent Preferences: Stored on your device for up to 12 months from the date of confirmation.
4Data Transfers & Third-Party Processing
We never monetize or sell personal data. Data is shared exclusively with accredited entities under binding Data Processing Agreements (DPA):
- Infrastructure & Analytics: Google LLC (Analytics/Firebase), HubSpot, Inc. (contact-request form) and PEAK Cloud Accounting, adhering to ISO/IEC 27001 or equivalent international standards. Encrypted transit via global CDNs does not constitute cross-border data transfer under PDPC announcements.
- Legal Mandates: Disclosed only pursuant to formal court orders or lawful directives issued by authorized public authorities.
5Data Subject Rights (DSR) & Section 30 Compliance
Under the PDPA, you are entitled to exercise the following statutory rights:
1. Right to Access & Copy (Section 30)Inspect and request copies of your personal data, including the right to request our Record of Processing Activities (RoPA).
2. Right to Withdraw ConsentRevoke previously granted consent at any time without impacting prior lawful processing.
3. Right to RectificationRequest corrections to ensure personal data remains accurate, complete, and up to date.
4. Right to Erasure / DeletionRequest deletion or anonymization when data is no longer necessary for original purposes.
5. Right to RestrictionSuspend processing during dispute reviews or rectification assessments.
6. Right to Data PortabilityReceive your structured electronic data in machine-readable format (JSON/CSV).
7. Right to ObjectObject to processing grounded in legitimate interests or direct marketing campaigns.
DSR Submission Protocol & Verification
Dual Request Channels: Submit DSR requests electronically to hello@tiaophanit.com or via postal dispatch to 121 M.8, Kang Aen, Prasat, Surin 32140 Thailand.
Identity Verification: Reasonable identity verification is conducted (e.g. email confirmation) without excessive friction.
Zero Fee Policy: Basic statutory requests and copies are delivered entirely free of charge.
Response Timeline: We review and resolve verified requests within 30 days of receipt.
6Security Controls & 72-Hour Breach Notification
We implement robust technical and organizational safeguards: end-to-end TLS 1.3 cryptographic transit, role-based access privileges (RBAC), and multi-factor authentication (MFA).
Breach Protocol: In the event of a verified security incident posing risks to individuals, regulatory authorities will be notified within 72 hours, followed by immediate mitigation disclosures to affected data subjects if high risk is established.
7Data Protection Officer & Contact Channels
Data Controller:Tiao Phanit Advisory
121 M.8, Kang Aen, Prasat, Surin 32140 Thailand