Legal
Privacy Policy
How Saraya collects, uses, and protects your personal information.
Last Updated: 3 May 2025 · Effective Date: 3 May 2025
1. Introduction
Saraya ("we", "our", or "us") is committed to handling personal information with care, transparency, and respect. This Privacy Policy explains what personal data we collect when you use our website at sarayathx.pro or engage with our services, why we collect it, how it is processed, and the choices available to you.
Our services are non-regulated workplace culture and engagement advisory services designed for organisations in Thailand and the wider region. We do not provide medical, legal, or financial advice, and no personal data is processed in connection with regulated activities.
If you have questions about this policy or how your data is handled, please contact us at [email protected] before using our services.
2. Data We Collect
Information You Provide Directly
- Full name (when submitting a contact or enquiry form)
- Email address (for correspondence and follow-up)
- Phone number (if voluntarily provided)
- Message content and any details shared in free-text fields
Information Collected Automatically
- Browser type, device type, and operating system
- Pages visited and time spent on each page
- Referring URL and approximate geographic region
- Cookies and similar tracking technologies (see Section 5)
Legal Basis for Processing
We process personal data under the following legal bases in accordance with Thailand's Personal Data Protection Act (PDPA) B.E. 2562 (2019):
- Consent — for optional marketing communications and non-essential cookies
- Legitimate interest — for website analytics and improving our services
- Contractual necessity — when processing data to deliver a service you have requested
We retain personal data for no longer than 36 months from the date of collection, or for the duration of an active advisory relationship plus 12 months thereafter.
3. How We Use Your Data
- Service delivery — to respond to enquiries, schedule sessions, and communicate with you about our advisory work.
- Internal records — to maintain accurate records of our engagements and any agreed action plans.
- Website improvement — to understand how visitors use our site so we can make it clearer and more useful.
- Marketing communications — only with your explicit consent; you may withdraw consent at any time.
- Legal compliance — to meet obligations under applicable Thai law or respond to lawful requests.
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. Data may be shared with trusted service providers (for example, email delivery platforms or analytics tools) under appropriate data-processing agreements.
4. Data Protection Measures
We take reasonable technical and organisational steps to keep personal data secure, including:
- HTTPS encryption for all data transmitted through our website
- Restricted access — only staff who need data to fulfil their role may access it
- Regular review of access controls and data handling procedures
- Physical and electronic safeguards for stored records
In the event of a personal data breach that is likely to affect your rights, we will notify affected individuals and the relevant supervisory authority within the timeframe required by the PDPA. While we take care to protect your data, no system is entirely without risk, and we encourage you to keep your own communications secure.
6. Your Rights
Under Thailand's PDPA and, where applicable, other regional data protection frameworks, you have the following rights:
Right to Access
Request a copy of the personal data we hold about you.
Right to Rectification
Ask us to correct inaccurate or incomplete data.
Right to Erasure
Request deletion of your data where no legal obligation requires us to retain it.
Right to Portability
Receive your data in a structured, commonly used format.
Right to Object
Object to processing based on legitimate interest or for direct marketing.
Right to Withdraw Consent
Withdraw consent at any time without affecting prior processing.
To exercise any of these rights, email us at [email protected]. We will respond within 30 days. If you believe your rights have not been respected, you may also lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand.
7. Third-Party Links
Our website may contain links to external websites or resources. These are provided for convenience only. Saraya has no control over and accepts no responsibility for the content or privacy practices of any external site. We recommend reading the privacy policy of any website you visit through such links.
8. Children's Privacy
Our services are directed at business clients and professional individuals aged 18 and over. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that data has been submitted by a minor, we will delete it promptly. If you are a parent or guardian and believe a minor has provided us with personal data, please contact us at [email protected].
9. Policy Updates
We may revise this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or the services we offer. When we make significant changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify active clients directly.
Continued use of our website or services following any update constitutes acceptance of the revised policy. We encourage you to review this page periodically.
10. Contact & Data Controller
If you have questions, concerns, or requests relating to your personal data, please reach out. We aim to respond to all privacy-related queries within 30 days.