Privacy Policy

1. Data Controller

The data controller responsible for your personal information is:

2. Information We Collect

We collect personal information in the following ways:

Information you give us directly

• Your name and contact details (email address, phone number) when you use our enquiry form or contact us by email or telephone.
• The nature of your enquiry, so we can respond helpfully.
• Any additional information you choose to share with us in correspondence.

Information collected automatically

• Website usage data such as pages viewed, time on site, and referring pages, collected via analytics cookies (with your consent).
• Technical data including your browser type, device type, and approximate location based on IP address.
• Cookie preference choices, stored locally in your browser.

Legal basis for processing (PDPA, Thailand)

We process your personal data under Thailand's Personal Data Protection Act B.E. 2562 (PDPA). Our legal bases are: your consent (for optional cookies and marketing messages), the need to perform a contract or take steps at your request before entering one (for service enquiries and bookings), and our legitimate interests in operating a secure and functional website.

3. How We Use Your Information

• To respond to your enquiries and arrange service sessions.
• To send you service-related communications (appointment confirmations, session reminders).
• To send you general information about our services, where you have given consent and may withdraw it at any time.
• To improve our website and understand how visitors use it, using anonymised analytics data.
• To comply with our legal and regulatory obligations under Thai law.

We do not use your personal data for automated decision-making or profiling that has a significant effect on you.

4. Sharing Your Information

We do not sell or rent your personal data to third parties. We may share it in limited circumstances:

• Service providers — companies that help us operate our website and deliver our services (such as web hosting and email delivery), acting under our instructions and bound by data processing agreements.
• Analytics providers — with your consent, anonymised usage data may be shared with analytics services such as Google Analytics.
• Legal requirements — where we are required to do so by applicable Thai law or a court order.

5. Data Retention

We keep your personal data only for as long as is necessary:

• Enquiry and contact records — up to 2 years after last contact, unless you ask us to delete them sooner.
• Service booking records — up to 5 years for financial and administrative purposes.
• Website analytics data — in anonymised form, up to 26 months per our analytics provider's standard retention.
• Cookie consent records — 12 months, stored locally in your browser.

6. How We Protect Your Information

• Our website is served over HTTPS (TLS encryption) to protect data in transit.
• Access to personal data is restricted to Hearthward staff who need it to carry out their work.
• We review our security practices regularly and update them when needed.
• In the event of a personal data breach, we will notify affected individuals and the Office of the Personal Data Protection Committee (PDPC) in accordance with the PDPA.

7. Cookies

We use cookies to help our website function and to understand how visitors use it. Essential cookies are always active. Optional cookies (analytics, marketing, preference) are only placed with your consent. You can update your cookie choices at any time on our Cookie Policy page.

8. Your Rights

Under the PDPA, you have the following rights regarding your personal data. You may exercise them at no charge by writing to [email protected].

If you feel your rights have not been respected, you may lodge a complaint with Thailand's Office of the Personal Data Protection Committee (PDPC) at pdpc.or.th.

9. Links to Other Websites

Our website may occasionally contain links to external sites (such as government information resources). We are not responsible for the privacy practices of those sites and encourage you to read their privacy notices before providing any personal data.

10. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor's data has been submitted to us, please contact us at [email protected] and we will remove it promptly.

11. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of the page. We encourage you to review this page periodically. Continued use of our website after any changes constitutes acceptance of the updated policy.