Privacy Policy

Who we are and what this covers

Knowledge Discovery Co., Ltd. (Tax ID 0125560027536), 25 Alma Link Building, 17th Floor, Room 73, Soi Chidlom, Ploenchit Road, Lumpini, Pathumwan, Bangkok 10330, is the data controller for the personal data described in this policy.

This policy covers visitors to our website, people who contact us, job applicants, and contacts at our clients, prospective clients and partners. When we build or run systems for a client and process personal data inside them, we act on the client’s instructions under our contract with them; the client’s own privacy notice applies to that data.

Personal data we collect

• Contact and identity details: your name, job title, organisation, work email address and telephone number.
• Enquiry details: the content of your messages and our correspondence with you.
• Recruitment details: your CV, education, work history, portfolio and any other information you send when you apply for a role.
• Technical details: your IP address, browser and device type, the pages you request and the date and time, processed by our hosting and security provider when you visit the website.
• Preferences kept on your device: your colour mode, language and cookie choices, stored in your browser’s local storage. They stay on your device and are not sent to us.

We do not ask for sensitive personal data, such as health, religious or biometric information or criminal records. Please do not send it to us unless we specifically ask for it, with your explicit consent, for a lawful reason.

Where we get it

Most personal data comes directly from you, when you email us, use the contact form (which prepares a message that you send from your own email program) or apply for a role. We may also receive your work contact details from your employer or colleagues when they engage us, from people who refer you, or from professional sources you have made public, such as your company’s website or professional networking profiles.

Why we use it and our legal basis

We use personal data only for the following purposes, each on the legal basis shown under section 24 of the PDPA (and article 6 of the GDPR where it applies):

• Replying to your enquiries and preparing proposals: steps you ask us to take before entering into a contract, or our legitimate interest in responding to business enquiries.
• Delivering and supporting services under a contract with you or your organisation: performance of a contract, or our legitimate interest in managing the relationship with your organisation.
• Assessing job applications: steps you ask us to take before entering into an employment contract.
• Operating, securing and improving the website, and preventing abuse: our legitimate interest in running a secure, working website.
• Sending you news about our services, only if you have asked us to: your consent, which you can withdraw at any time.
• Meeting accounting, tax and other legal obligations, and establishing or defending legal claims: legal obligation, or our legitimate interest.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

If you do not provide it

You do not have to give us personal data. If you do not, we may not be able to reply to your enquiry, enter into or perform a contract with you or your organisation, or consider your job application.

Cookies and similar technologies

The website uses only browser storage that is strictly necessary to remember your colour mode, language and cookie choices. Our hosting provider may measure visits in aggregate, without cookies and without identifying you. If we add cookies that are not strictly necessary, such as for analytics or advertising, we will not set them until you consent through Cookie Settings, and you can change your choice at any time. See our Cookies Policy for details.

Who we share it with

We do not sell your personal data, and we do not share it for advertising across other websites. We disclose it only to the following, and only as much as they need:

• service providers that host and secure the website, provide email and office software, or support our operations, acting on our instructions under agreements that require them to protect it;
• professional advisers, such as auditors, accountants and lawyers;
• government agencies, regulators, courts or police, where the law requires it or to protect our legal rights;
• a buyer or successor of our business, if it is reorganised, merged or sold, subject to the same protections.

Transfers outside Thailand

Some of our service providers store or process data in other countries. We transfer personal data outside Thailand only as sections 28 and 29 of the PDPA and the Personal Data Protection Committee’s notifications allow: to a country with adequate data protection standards, under appropriate safeguards such as standard contractual clauses (for example the ASEAN Model Contractual Clauses or the EU Standard Contractual Clauses), or where another legal exception applies, such as your consent or the performance of a contract with you. You can ask us for more information about these safeguards.

How long we keep it

We keep personal data only as long as needed for the purpose we collected it for, and then for as long as the law requires or allows, for example to meet accounting and tax record-keeping rules or until the limitation period for legal claims has passed. When it is no longer needed, we delete or destroy it, or make it anonymous so it can no longer identify you.

• Enquiries that do not lead to a contract: for as long as needed to handle and follow up on the enquiry.
• Client and contract records: for the duration of the relationship, and afterwards for the periods required by accounting, tax and other laws.
• Unsuccessful job applications: for as long as needed to complete the recruitment process, and longer only with your consent, so we can consider you for future roles.

Security and data breaches

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including encrypted connections (HTTPS) and access limited to staff and providers who need it. No method of transmission over the internet is completely secure. If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it where the law requires, and we will tell you without undue delay if the breach is likely to pose a high risk to your rights and freedoms.

Your rights

Under the PDPA you have the right to:

• withdraw your consent at any time, as easily as you gave it, without affecting processing that took place before;
• access your personal data and obtain a copy of it, and ask us how we obtained data that you did not consent to us collecting;
• receive your data in a structured, commonly used, machine-readable format, or have it sent to another controller where technically possible;
• object to the processing of your data, including at any time to its use for direct marketing;
• have your data deleted, destroyed or made anonymous;
• restrict the use of your data;
• have inaccurate data corrected, completed and kept up to date;
• complain to the Personal Data Protection Committee (pdpc.or.th) if you believe we have not complied with the law.

To exercise these rights, contact us using the details below. We may ask you to verify your identity. We will respond within 30 days of receiving your complete request, free of charge unless the request is clearly unfounded or excessive. Some rights have legal limits; if we cannot fully meet a request, we will explain why.

If you are outside Thailand

If the GDPR, the UK GDPR or another data protection law applies to our handling of your personal data, you have the rights that law gives you, which are broadly the same as those above, including the right to complain to the data protection authority in the country where you live or work. We will honour requests made under those laws.

Children

Our website and services are intended for businesses and organisations, not for children. Under the PDPA, people under 20 years of age are minors, and their personal data generally needs the consent of a parent or guardian. We do not knowingly collect personal data from minors; if we learn that we have done so without the required consent, we will delete it.

Changes to this policy

We may update this policy to reflect changes in the law or in how we handle personal data. The current version is always on this page, with the date it was last updated. If we make a significant change, we will highlight it on the website and, where required, ask for your consent again.