Privacy Policy

1. Data Controller

The data controller for personal data collected through this website and in connection with our consulting engagements is Pivothelm, with offices at 39 Phloen Chit Road, Lumphini, Bangkok 10330, Thailand. You may contact us regarding data protection matters at [email protected].

2. Data We Collect

We collect personal data in the following situations:

• Contact form submissions: name, email address, phone number (optional), and message content.
• Enquiry correspondence: name, organisation, email address, and any information you share in emails or calls.
• Engagement delivery: names of meeting participants, working documents shared with us, and notes taken during observations or sessions — governed by the engagement agreement.
• Website analytics: anonymised usage data collected through cookies, if you have consented. See our Cookie Policy for details.

3. How We Use Your Data

We use personal data for the following purposes:

• Responding to enquiries and assessing whether an engagement is a reasonable fit.
• Delivering the consulting engagement you have commissioned.
• Preparing and sending written outputs, including reflections and scoping documents.
• Communicating with you about ongoing engagement matters.
• Complying with applicable legal obligations.

We do not use personal data for marketing communications without your explicit consent. We do not sell or rent personal data to third parties.

4. Legal Basis for Processing

• Contract performance: processing necessary to deliver a commissioned engagement.
• Legitimate interests: responding to enquiries and managing our consulting relationships.
• Consent: optional analytics cookies and any marketing communications.
• Legal obligation: record-keeping and compliance requirements under Thai law.

5. Data Retention

Contact form data is retained for 12 months from submission. Engagement-related data — including working documents, observation notes, and written outputs — is retained for 3 years from engagement close, unless the engagement agreement specifies otherwise. Analytics data is anonymised and retained for up to 24 months.

6. Data Sharing

We do not share your personal data with third parties except in the following limited circumstances:

• Service providers who process data on our behalf (such as email hosting), bound by contractual data protection obligations.
• Where required by applicable Thai law, court order, or regulatory authority.

We do not transfer personal data outside Thailand without appropriate safeguards in place.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. Working documents shared in connection with engagements are stored on access-controlled systems and handled only by the relevant consulting practitioner. In the event of a data breach likely to affect your rights, we will notify you and the relevant authority as required by law.

8. Cookies

This website uses cookies. For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

9. Your Rights

Under the Thailand PDPA, you have the following rights regarding your personal data:

• Right to access your personal data and receive a copy.
• Right to rectify inaccurate data.
• Right to request erasure of your data, subject to legal retention requirements.
• Right to restrict processing in certain circumstances.
• Right to data portability where processing is based on consent or contract.
• Right to object to processing based on legitimate interests.
• Right to withdraw consent at any time, without affecting prior processing.
• Right to lodge a complaint with Thailand's Personal Data Protection Committee.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Third-Party Links

This website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

11. Children

Our services are directed at business organisations and are not intended for persons under the age of 18. We do not knowingly collect personal data from minors.

12. Policy Updates

We may update this Privacy Policy from time to time. The revised version will be posted on this page with an updated date. Continued use of this website after any update constitutes acceptance of the revised policy.

13. Contact

For questions about this Privacy Policy or about how we handle your personal data, please contact us at [email protected] or by post at 39 Phloen Chit Road, Lumphini, Bangkok 10330, Thailand.