Privacy Policy

1. Data Controller

The data controller responsible for personal information collected through this website and through our services is:

Thai personal data processing is governed by the Personal Data Protection Act B.E. 2562 (PDPA). Where services are provided to individuals located in the European Economic Area, the General Data Protection Regulation (GDPR) may additionally apply.

2. Personal Data We Collect

We collect personal data in the following circumstances:

2.1 Enquiry and booking

When you submit our contact form or contact us by phone or email, we collect:

• Full name (required)
• Email address (required)
• Telephone number (optional)
• Any information you include in your message

2.2 Service delivery

To arrange and carry out sessions, we may also record:

• Preferred session date, time, and location
• Any access or scheduling requirements you share with us

We do not retain copies of any family documents, photographs, or personal records you bring to sessions. All such materials are returned to you in full. Any written records produced during a session are handed over entirely to you at or following the session.

2.3 Website and cookies

Our website may collect the following automatically:

• Standard server log data (IP address, browser type, referring page, time of visit)
• Analytics data where you have consented to analytics cookies
• Cookie preference data stored in your browser's local storage

See our Cookie Policy for full details.

3. Legal Basis for Processing

4. How We Use Personal Data

We use the data we collect only for the following purposes:

• Responding to your enquiry and confirming service bookings
• Arranging sessions — scheduling, location confirmation, preparation guide delivery
• Sending completed written records or index documents to you by email where requested
• Answering any follow-up questions about the service delivered
• Improving the website through anonymised analytics
• Meeting any legal or regulatory obligations that apply to us under Thai law

We do not use your personal data for marketing purposes unless you have separately agreed to this. We do not sell personal data to third parties under any circumstances.

5. Data Sharing

We do not share personal data with third parties except in the following limited circumstances:

• Service providers: We use Google Analytics (where consent is given) and standard web hosting services. These providers process data only on our behalf and are bound by appropriate data processing terms.
• Legal requirement: Where we are required to disclose information by applicable Thai law, court order, or regulatory authority.
• Business transfer: If Heirloomly is restructured or acquired, personal data may transfer as part of that process, subject to the same commitments in this policy.

We do not share data with advertising networks, data brokers, or any other third party for commercial purposes.

6. Data Retention

We retain personal data only for as long as reasonably necessary:

• Enquiry records that do not result in a booking are held for 90 days and then deleted.
• Client booking and communication records are held for 24 months from the date of the final session, then deleted.
• Financial records (invoices, receipts) are retained for 7 years as required under Thai Revenue Code.
• Analytics data is retained in anonymised aggregate form for up to 24 months.

Family documents, photographs, and personal records brought to sessions are never copied or retained by us. They are returned in full. Any written outputs produced by us are delivered to you and no copy is kept on our systems.

7. Data Security

We take reasonable steps to protect personal data held by us, including:

• TLS encryption for all data transmitted through our website
• Access controls limiting personal data to staff who need it to carry out their work
• Secure deletion of records that are no longer required
• Regular review of our data handling practices

In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority as required by applicable law, without undue delay.

8. Cookies

Our website uses cookies and similar technologies. Essential cookies are required for the site to function. Optional cookies (analytics, preference) are used only with your consent. Full details of the cookies we use, their purpose, and how to manage your preferences are set out in our Cookie Policy.

9. Your Rights

Under the Thai PDPA and, where applicable, the GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Personal Data Protection Committee of Thailand or, where GDPR applies, with your local data protection authority.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the content or privacy practices of those sites. We encourage you to review the privacy policy of any website you visit from a link on our pages.

11. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted personal data to us, please contact us at [email protected] and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. Where changes are material, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our services or website after changes are posted constitutes acceptance of the updated policy.