Privacy Policy

1. Who We Are

Pensaro is a document organisation and educational services business registered in Thailand. Our address is 110 Ratchadaphisek Road, Din Daeng, Bangkok 10400. For data-related matters, we act as the data controller and can be reached at [email protected].

2. What Personal Data We Collect

We collect only the personal data necessary to deliver our services and respond to enquiries:

• Contact form submissions: name, email address, and optionally a telephone number and message.
• Workshop and session bookings: name and contact details sufficient to arrange and confirm your appointment.
• Website usage data: anonymised information collected via analytics cookies, including pages visited and approximate location (country level), if you have consented to analytics cookies.
• Communications: any information you voluntarily share when contacting us by email or telephone.

We do not retain, copy, or record any of the documents or personal financial records you bring to a filing or workshop session. Those remain entirely yours.

3. Legal Basis for Processing

We process personal data on the following grounds under the Thailand Personal Data Protection Act B.E. 2562 (PDPA 2019) and applicable data protection principles:

• Contractual necessity: to deliver services you have booked.
• Consent: for marketing communications and analytics cookies, where you have given your agreement.
• Legitimate interests: to respond to enquiries and improve our services, where this does not override your rights.

4. How We Use Your Data

• To respond to enquiries submitted via the contact form or by telephone.
• To schedule, confirm, and follow up on service sessions.
• To send a post-session summary if you have requested one.
• To improve our website and services using anonymised analytics, where consented.
• To send occasional information about our services where you have opted in — you may withdraw this at any time.

We do not sell your personal data. We do not share it with third parties except as described in Section 5.

5. Data Sharing

We share personal data only in the following limited circumstances:

• Service providers: our website hosting provider and email service, operating under data processing agreements.
• Analytics platforms: anonymised usage data may be processed by a third-party analytics service if you consent to analytics cookies.
• Legal obligations: where required by Thai law or a lawful authority request.

6. Data Retention

We retain contact form data for up to 12 months from the date of submission. Booking and session records are retained for up to 2 years for administrative purposes. Analytics data is retained in anonymised form for up to 26 months. You may request deletion at any time (see Section 8).

7. Cookies

Our website uses essential cookies to function correctly, and optional analytics and preference cookies subject to your consent. For full details, see our Cookie Policy.

8. Your Rights

Under the Thailand PDPA and applicable principles, you have the following rights:

• Access: to request a copy of the personal data we hold about you.
• Rectification: to ask us to correct inaccurate or incomplete data.
• Erasure: to request deletion of your personal data where there is no overriding legal basis for retention.
• Restriction: to ask us to limit processing in certain circumstances.
• Portability: to receive your data in a structured, machine-readable format where technically feasible.
• Objection: to object to processing based on legitimate interests.
• Withdrawal of consent: to withdraw any previously given consent at any time, without affecting prior processing.

To exercise any of these rights, please contact [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand if you believe your data has been handled unlawfully.

9. Security

We take reasonable technical and organisational measures to protect personal data against loss, misuse, or unauthorised access. Our website uses HTTPS encryption. Access to stored contact data is restricted to staff who need it to fulfil their responsibilities.

In the event of a data breach that poses a risk to individuals, we will notify affected parties and the relevant authority in line with our obligations under the PDPA.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

11. Children

Our services are intended for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe we have received data from a minor, please contact us so we can arrange its deletion.

12. Changes to This Policy

We may update this policy from time to time. The current version will always be available on this page, with the Last Updated date shown above. Material changes will be communicated by a visible notice on our website.

13. Contact

For any questions about this policy or how we handle your personal data:

• Email: [email protected]
• Phone: +66 2 692 3471
• Address: 110 Ratchadaphisek Road, Din Daeng, Bangkok 10400, Thailand