Privacy Policy

1. Introduction

Kinvault ("we", "us", "our") is committed to protecting the personal information of everyone who engages with our services or visits this website. This policy explains what data we collect, how we use it, and the rights you hold over that data.

This policy applies to all personal data collected through our website, contact forms, in-person sessions, and any other interaction with Kinvault. Kinvault operates as a data controller under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

If you have any questions about this policy, please contact us at [email protected].

2. What Personal Data We Collect

We collect only the data needed to provide our services and communicate with you effectively. This includes:

• Contact information: Full name, email address, phone number — provided when you submit a contact form or book a session.
• Session-related information: Notes from organisational sessions, document inventories, and records you share with us during the course of a service engagement.
• Website usage data: Anonymised analytics data collected through cookies, including pages visited, session duration, and device type.
• Communication records: Emails and messages sent to us, retained for up to 24 months.

The legal bases for processing your data are: (a) your consent, (b) the performance of a service agreement, and (c) our legitimate interest in improving our services.

Personal data is retained for as long as necessary to deliver the relevant service and for up to three years following the end of an engagement, unless a shorter period is required or you request earlier deletion.

3. How We Use Your Data

• To respond to your enquiries and schedule appointments.
• To deliver the organisational and facilitation services you have requested.
• To send you session summaries, checklists, and follow-up notes.
• To send occasional service updates or information about related offerings — only if you have opted in.
• To improve our website and services using anonymised analytics data.
• To comply with applicable laws and regulatory requirements in Thailand.

We do not sell, rent, or share your personal data with third parties for commercial purposes. We may share data with service providers who assist our operations (such as cloud storage and email providers) who are bound by appropriate data processing agreements.

You may withdraw consent for marketing communications at any time by contacting us at [email protected].

4. Data Protection Measures

• All digital data is stored on password-protected systems with access restricted to authorised staff.
• Physical session notes are stored in locked filing systems on our premises.
• Staff handle client information under written confidentiality agreements.
• In the event of a data breach that poses a risk to individuals, we will notify affected persons and the relevant authority within 72 hours of becoming aware of the breach, in accordance with Thai PDPA requirements.
• We conduct periodic internal reviews of our data handling practices.

5. Cookies

This website uses cookies to function correctly and to understand how visitors use it. Essential cookies are always active. Analytics and preference cookies are only placed with your consent.

For full details of the cookies we use, how to manage your preferences, and how to adjust browser settings, please read our Cookie Policy.

6. Your Rights Under Thai PDPA

Under Thailand's Personal Data Protection Act, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data, subject to legal retention obligations.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: Submit a complaint to Thailand's Personal Data Protection Committee (PDPC) at pdpc.or.th.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Third-Party Links

Our website may contain links to external websites. Kinvault is not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

8. Children's Privacy

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe a minor has submitted data to us, please contact us immediately and we will delete it promptly.

9. Policy Updates

We may update this policy from time to time. Material changes will be communicated via a notice on our website. Continued use of our website or services following notification of a change constitutes acceptance of the updated policy. The "Last Updated" date at the top of this page indicates when the policy was most recently revised.