Privacy Policy

This Privacy Policy is issued by SYB Web Solution (“Company”, “we”, “our”, or “us”), the data controller responsible for personal data collected through this website and our related services.

We process personal data in compliance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the Notification of the Personal Data Protection Committee, and other applicable Thai laws and regulations governing personal data and electronic transactions.

This policy applies to all personal data we collect from website visitors, prospective clients, existing clients, and any individuals who interact with our services. By using this website, you acknowledge that you have read and understood this Privacy Policy.

We collect personal data that you voluntarily provide to us, including: full name, email address, telephone number, company name, job title, and project details submitted via contact or inquiry forms on this website.

We also collect technical and usage data automatically when you visit our website, including: IP address, browser type and version, operating system, referring URLs, pages visited, time and duration of visits, and device identifiers. This data is collected through cookies and similar tracking technologies.

We do not knowingly collect sensitive personal data (as defined under Section 26 of the PDPA), such as health information, financial account data, biometric data, or religious beliefs, unless explicitly required and with your prior consent.

We do not collect personal data from individuals under the age of 20 without the consent of a parent or legal guardian, as required under Section 20 of the PDPA.

We process your personal data for the following purposes, each with a corresponding legal basis under the PDPA: (1) To respond to your inquiries and provide our services — based on the performance of a contract or pre-contractual steps at your request (Section 24(3)); (2) To send service-related communications, proposals, and updates — based on our legitimate interests (Section 24(5)); (3) To improve our website and services through analytics — based on our legitimate interests (Section 24(5)).

Where we rely on your consent as the legal basis (Section 24(1)), we will request it separately and clearly before processing. You have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We will not use your personal data for purposes incompatible with those stated above without your prior consent or another lawful basis under the PDPA.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Thai law, whichever is longer.

Contact and inquiry data is retained for a maximum of 3 years from the date of last interaction. Client project data is retained for 5 years from project completion to meet potential legal, tax, and audit requirements under Thai law.

Technical and analytics data collected via cookies is retained for up to 12 months. After the applicable retention period, personal data is securely deleted or anonymised.

Under the PDPA, you have the following rights with respect to your personal data: (1) Right of Access (Section 30) — to request a copy of personal data we hold about you; (2) Right to Rectification (Section 35) — to request correction of inaccurate or incomplete data; (3) Right to Erasure (Section 33) — to request deletion of your data when no longer necessary or where processing lacks a lawful basis.

(4) Right to Restriction of Processing (Section 34) — to request that we limit processing of your data in certain circumstances; (5) Right to Data Portability (Section 31) — to receive your data in a structured, machine-readable format; (6) Right to Object (Section 32) — to object to processing based on legitimate interests; (7) Right to Withdraw Consent (Section 19) — to withdraw consent at any time where processing is consent-based.

To exercise any of these rights, please submit a written request through the contact details provided in Section 11. We will respond within 30 days of receiving your request, as required by the PDPA. We may need to verify your identity before processing your request.

We do not sell, rent, or trade your personal data to third parties. We may share your data with trusted service providers who assist us in operating our website or delivering our services (e.g., cloud hosting providers, email service providers, analytics platforms), solely to the extent necessary and under binding data processing agreements.

We may disclose personal data where required by Thai law, a court order, a government authority, or regulatory body, including the Office of the Personal Data Protection Committee (PDPC).

All third parties with whom we share personal data are required to maintain appropriate security measures and to use the data only for the specified purposes in accordance with applicable law.

Our primary operations are based in Thailand. If personal data is transferred to or processed in a country outside Thailand, we will ensure such transfer complies with Section 28 of the PDPA, which requires that the destination country has adequate personal data protection standards.

Where no adequacy decision exists, we implement appropriate safeguards such as standard contractual clauses approved by the PDPC, or obtain your explicit consent before transferring your data internationally.

You may request information about the safeguards in place for international data transfers by contacting us at the details provided in Section 11.

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction, in accordance with Section 37 of the PDPA.

Security measures include: SSL/TLS encryption for data transmitted via this website, access controls limiting data access to authorized personnel only, regular security assessments and vulnerability testing, and secure data storage with access logging.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the PDPC within 72 hours as required by Section 37(3) of the PDPA and will inform affected individuals without undue delay where the breach poses a high risk.

Our website uses cookies and similar tracking technologies to enhance user experience, analyse website performance, and support marketing activities. Cookies are small text files stored on your device when you visit our website.

We use the following categories of cookies: (1) Strictly Necessary Cookies — required for the website to function and cannot be disabled; (2) Analytics Cookies — collect anonymised data about how visitors use our website (e.g., Google Analytics); (3) Marketing Cookies — used to deliver relevant content; these are only set with your prior consent.

You may manage or disable non-essential cookies through your browser settings or our cookie consent tool. Please note that disabling certain cookies may affect the functionality of this website. Your cookie preferences will be stored for up to 12 months.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. The “Last Updated” date at the top of this page will reflect the most recent revision.

Where changes are material, we will provide a more prominent notice, such as a notification on our website homepage or via email to affected individuals. Your continued use of this website after the changes take effect constitutes your acceptance of the updated policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.