Privacy policy

1. Data we collect

• Contact details: full name, business name, phone number, email and LINE ID (if given)
• Business details: type of business, chosen domain name and the content you send us, such as logo, images and text
• Payment details: the transfer slip you send us. We never store card numbers or banking passwords.
• Conversations: messages you send us on LINE, by email or on Facebook

2. How we use your data

• To contact you, make the contract and provide website building, hosting and yearly care
• To issue receipts, verify payments and keep accounting records
• To register and set up domains and company email (if you choose these services)
• To send renewal reminders and service notices, and answer after-sales questions

Our legal bases are performance of the contract, legitimate interests and compliance with applicable laws such as tax and accounting law.

3. Sharing data with others

We do not sell your data. We share only what is necessary with providers that help us deliver the service (hosting and backup providers, domain registrars and the email provider you choose), and with authorities when the law requires it. These providers may store data on servers outside Thailand; we choose providers with appropriate security measures.

4. Visitors to our customers' websites

The website we build for you may use Google Analytics or Facebook Pixel and includes a PDPA cookie-consent banner. You are the data controller for your own visitors; we process data on your instructions and help you set things up lawfully. Your business should have its own privacy policy. Message us if you'd like help writing one.

5. How long we keep data

• Customer data and website content: for the length of the contract and up to 90 days after it ends so you can ask for your files, then deleted or anonymised
• Payment records and accounting documents: as required by law (usually at least 5 years)
• Conversations with people who did not become customers: up to 1 year

6. Security

We use HTTPS/SSL, back up daily, limit access to people who need it and use trusted providers. No system is 100% secure; if a data breach affects you, we will notify you and the relevant authorities as the law requires.

7. Your rights

You may at any time ask to access or get a copy of your data, correct it, have it deleted or destroyed, restrict or object to its use, port it, and withdraw consent you have given. Withdrawing consent does not affect use that has already taken place. You may also complain to the Personal Data Protection Committee (PDPC) if you believe we have not complied with the law.

8. Cookies on thumweb.com

On your first visit, a banner lets you choose "Accept all", "Reject all" or "Settings" to choose by category. We record your choice as PDPA evidence (date and time, categories chosen and policy version, without your name or contact details). You can change or withdraw consent at any time with the "Cookie settings" link at the bottom of every page.

• Necessary cookies: remember your cookie choice and make the sign-up form and payment page work. Always on; no consent needed.
• Analytics cookies: Google Tag Manager and Google Analytics 4 count visitors, pages viewed and how people found us, so we can improve the site. Example cookies: _ga, _ga_*, kept up to 2 years. Only used if you consent to this category.
• Marketing cookies: Meta (Facebook) Pixel measures our ads and shows relevant ads on Facebook/Instagram. Example cookie: _fbp, kept up to 90 days. Only used if you consent to this category.

If you reject them, every page still works normally.

9. Contact us

For questions or to exercise your rights, contact LINE @142vuzjx or email hello@thumweb.com. We reply within 30 days as required by law. We may update this policy from time to time and will show the update date at the top of this page.