Privacy Policy

01

Data Controller

The data controller is Lumencrest, located at 738 Phaya Thai Road, Ratchathewi, Bangkok 10400, Thailand. For data-related enquiries, contact us at [email protected].

02

Personal Data We Collect

We collect personal data through the following means:

• Contact form: Name, email address, phone number (optional), and message content when you submit an enquiry via our website.
• Engagement conduct: During consulting engagements, we may collect names, roles, and professional contact details of staff who participate in sessions or whose work we observe.
• Cookies and analytics: Website usage data collected through cookies. See our Cookie Policy for details.
• Email correspondence: Communications you initiate with us.

We collect only the personal data necessary for the specific purpose at hand. We do not collect sensitive personal data categories as defined by the PDPA.

03

Legal Basis for Processing

We process personal data on the following legal bases:

• Consent: For marketing communications and non-essential cookies, where you have given explicit consent.
• Contractual necessity: Processing required to fulfil the terms of an engagement agreement.
• Legitimate interests: Responding to enquiries and improving our services, where our interests do not override your data protection rights.
• Legal obligation: Where processing is required to comply with Thai law or regulatory requirements.

04

How We Use Personal Data

We use personal data for the following purposes:

• Responding to enquiries submitted through our contact form
• Conducting consulting engagements in accordance with agreed scope
• Communicating regarding an existing or prospective engagement
• Improving our website and understanding how visitors use it
• Meeting legal or regulatory obligations

We do not use personal data for automated decision-making or profiling. We do not sell personal data to third parties.

05

Data Retention

We retain personal data only as long as necessary:

• Contact enquiries: Up to 24 months from last contact, unless an engagement begins.
• Engagement records: Up to 3 years from the close of an engagement, or as required by Thai commercial law.
• Observation notes: Deleted at the close of the relevant engagement.
• Website analytics: In accordance with the analytics provider's retention settings, typically 26 months.

06

Data Sharing

We may share personal data with:

• Service providers: Third-party services used to operate our website and communications, including hosting providers and analytics tools. These providers process data on our behalf under data processing agreements.
• Legal authorities: Where required by applicable law, court order, or regulatory requirement.

We do not disclose client data or engagement details to other clients or external parties, except as required by law.

07

Data Protection Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Encrypted transmission of data via HTTPS
• Access controls limiting personal data to authorised personnel
• Secure deletion of engagement observation notes at project close
• Regular review of data handling practices

In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority and, where required, affected individuals in accordance with PDPA obligations.

08

Cookies

Our website uses cookies for essential functionality and optional analytics and preference purposes. We request your consent before placing non-essential cookies. For full details of the cookies we use and how to manage your preferences, see our Cookie Policy.

09

Your Rights

Under the PDPA and applicable law, you have the following rights regarding your personal data:

• Right to access: Request confirmation of whether we hold personal data about you and obtain a copy.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of personal data where there is no continuing legal basis for processing.
• Right to restriction: Request that we limit processing in certain circumstances.
• Right to data portability: Receive personal data you provided to us in a structured, machine-readable format, where technically feasible.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent, without affecting lawfulness of processing before withdrawal.
• Right to complain: Lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receipt of a valid request.

10

Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend reviewing their privacy policies independently. This Privacy Policy applies only to our own website and services.

11

Children's Privacy

Our services are directed at businesses and individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

12

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be noted on this page with a revised "Last Updated" date. Continued use of our website or services after changes take effect constitutes acceptance of the updated policy.

13

Contact

For any questions about this Privacy Policy or your personal data:

• Email: [email protected]
• Address: 738 Phaya Thai Road, Ratchathewi, Bangkok 10400, Thailand
• Phone: +66 2 419 6325