Privacy Policy

1. Introduction

Brackenfold ("we", "us", "our") is committed to handling personal information responsibly. This Privacy Policy describes the types of personal data we collect, how we use and protect it, and the rights available to individuals whose data we process.

This policy applies to visitors of our website at brackenf.live and to individuals who contact us or engage our consulting services. It is consistent with the requirements of Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

2. Data Controller

Brackenfold
89 Nimmanahaeminda Road, Suthep, Chiang Mai 50200, Thailand
Email: [email protected]
Phone: +66 53 894 2716

3. Personal Data We Collect

Via the contact form

• Full name
• Email address
• Phone number (if provided voluntarily)
• Message content

Via cookies and website analytics

• IP address and approximate location
• Browser type and device information
• Pages visited and time on site

During consulting engagements

• Names and contact details of engagement participants
• Information disclosed in scoping calls, workshops, or interviews

We do not collect sensitive personal data (health, financial, or identity document information) through our website.

4. Legal Basis for Processing

We process personal data on the following lawful grounds under the PDPA:

• Consent: For marketing communications (if opted into) and non-essential cookies.
• Contractual necessity: To deliver consulting services you have engaged us for.
• Legitimate interests: To respond to enquiries, manage our business, and improve our website — where these interests are not outweighed by your rights.
• Legal obligation: Where processing is required under applicable Thai law.

5. How We Use Your Personal Data

• Responding to contact form submissions and enquiries
• Scoping, agreeing, and delivering consulting engagements
• Sending invoices and maintaining engagement records
• Analysing website usage to improve our service (aggregated, anonymised)
• Complying with applicable legal obligations

We do not use personal data for automated decision-making or profiling.

6. Data Retention

Contact form enquiries that do not proceed to an engagement are retained for up to 12 months, then deleted. Engagement records are retained for 5 years from the end of the engagement for legal and accounting purposes. Website analytics data is retained for up to 26 months in aggregated form.

7. Data Sharing

We do not sell personal data. We may share data with:

• Website hosting providers — for operating and maintaining this website.
• Analytics tools — in aggregated or anonymised form only.
• Legal or regulatory authorities — where required by Thai law.

All third-party processors are required to handle personal data in a manner consistent with this policy.

8. Cookies

Our website uses cookies to ensure it functions correctly and to understand how it is used. For full details of the cookies used and how to manage your preferences, see our Cookie Policy.

9. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, or disclosure. These include secure server hosting, access controls, and limited internal access to personal data. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant Thai supervisory authority as required by law.

10. Your Rights

Under the Thai PDPA, you have the following rights in relation to your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data where we no longer have a lawful basis for holding it.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Request your data in a structured, commonly used format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee.

11. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend reviewing their policies independently.

12. Children's Privacy

Our services are intended for individuals aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date at the top of this page will reflect any changes. Continued use of our website after an update constitutes acceptance of the revised policy.

14. Contact

For any questions about this Privacy Policy or data-related requests, contact us at:

Email: [email protected]
Address: 89 Nimmanahaeminda Road, Suthep, Chiang Mai 50200, Thailand