Privacy Policy

1. Introduction

Brackenhall ("we", "us", "our") is a procurement and vendor advisory firm based at 305 Ratchadamri Road, Lumphini, Pathum Wan, Bangkok 10330, Thailand. We provide advisory, review, and documentation support to business clients on procurement and supplier selection matters.

This Privacy Policy describes how we handle personal information provided to us through our website, contact forms, and during the course of our professional work. We operate in accordance with the Personal Data Protection Act B.E. 2562 (PDPA) and take our obligations under that legislation seriously.

For questions about this policy, you can reach us at [email protected].

2. Data We Collect

We collect only the information needed to respond to enquiries, deliver our services, and improve how our website functions. Below is an outline of what we gather and how.

Information You Provide Directly

Name and contact details — submitted via our contact form (name, email address, phone if included)
Business information — company name, role, or context you share when making an enquiry
Message content — the text of your enquiry or any notes you submit

Information Collected Automatically

Analytics data — page views, session durations, and navigation patterns via Google Analytics (anonymised)
Technical data — IP address (truncated), browser type, device type, and operating system
Cookies and similar technologies — see Section 5 for details

Legal Basis for Processing

Consent — where you have ticked the privacy agreement box or accepted cookies

Legitimate interest — improving the website and understanding how it is used

Contract performance — processing information necessary to deliver a service you have engaged us for

Retention: Contact form data is held for up to 24 months from last interaction. Analytics data is retained for 14 months. Client engagement records may be retained for up to 5 years for commercial purposes, after which they are deleted or anonymised.

3. How We Use Data

Information we hold about you is used only for clear, reasonable purposes relevant to our advisory work and website operation.

Responding to enquiries — we use your name and contact details to reply to messages submitted through our website
Delivering our services — where an engagement is agreed, we use relevant information to carry out the work
Improving our website — aggregated analytics data helps us understand which pages are most useful
Professional communications — with your agreement, we may share brief updates about our work or availability
Legal compliance — where required by Thai law or by a legitimate regulatory request

We do not sell personal information to third parties. We do not use your data for advertising profiling or share it with data brokers.

Third-Party Processors

We work with a small number of reputable service providers who process data on our behalf under appropriate data processing agreements. These include Google Analytics for website usage statistics, and email infrastructure providers for correspondence. No personal data is transferred outside Thailand or the EU/EEA without appropriate safeguards in place.

4. Data Protection Measures

We take reasonable and proportionate steps to protect personal information from unauthorised access, disclosure, or loss.

Encrypted transmission

All data transmitted between your browser and our website is protected via TLS (HTTPS).

Access controls

Access to stored enquiries and client records is restricted to authorised staff only.

Secure hosting

Website and associated data is hosted on infrastructure with regular security patches applied.

Breach notification

In the event of a personal data breach, we will notify affected parties and the PDPC as required under Thai PDPA.

5. Cookies

Our website uses cookies to maintain basic functionality and understand how visitors use our pages. The following categories apply:

Essential

Required for the website to function, including session handling and cookie consent storage. Cannot be disabled.

Analytics

Used to understand aggregate patterns such as which pages are visited and how long sessions last. Data is anonymised.

Marketing

Used by advertising platforms (including Meta Pixel and Bing) to understand whether visitors came from an advertisement.

You can manage your preferences at any time on our Cookie Policy page.

6. Your Rights

Under the Personal Data Protection Act B.E. 2562, you have the following rights with respect to your personal information. To exercise any of these rights, please write to us at [email protected].

Right to access — you can request a copy of the personal information we hold about you

Right to rectification — if your information is inaccurate or incomplete, you can ask us to correct it

Right to erasure — you can request that we delete your personal information where we have no compelling reason to keep it

Right to data portability — you can ask us to provide your information in a common machine-readable format

Right to object — you can object to processing based on legitimate interests at any time

Right to withdraw consent — where processing is based on your consent, you can withdraw it at any time without affecting prior processing

If you feel your rights have not been respected, you have the right to raise a complaint with the Personal Data Protection Committee (PDPC) of Thailand, the relevant supervisory authority for data protection matters in this jurisdiction.

7. Third-Party Links

Our website may occasionally contain links to external resources. We are not responsible for the privacy practices of third-party websites and recommend reviewing the privacy policy of any external site before submitting personal information. The inclusion of a link does not indicate any endorsement or affiliation.

8. Children's Privacy

Our services are directed at business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has submitted information through our site, please contact us at [email protected] and we will remove it promptly.

9. Policy Updates

We may revise this Privacy Policy from time to time to reflect changes in how we work, changes in technology, or updates to Thai data protection legislation. When we make material changes, we will update the "Last updated" date at the top of this document.

We encourage you to review this page periodically. Continued use of our website after a policy update constitutes acceptance of the revised terms.