Privacy Policy

1. Introduction

Naga Sync ("we", "us", "our") is committed to handling personal data with care and transparency. This Privacy Policy explains what information we collect, how we use it, how we protect it, and what rights you have in relation to it. It applies to all personal data collected through our website at nagasynces and through our consulting engagements.

Our registered office is at 38 Nimmanhaemin Road Soi 9, Suthep, Chiang Mai 50200, Thailand. For privacy-related questions, contact us at privacy@nagasynces.

2. Data We Collect and How

We collect the following types of personal data:

• Contact information — name, email address, and phone number, submitted through our website contact form.
• Communication data — content of messages you send us via the website form or email.
• Usage data — general information about how you interact with our website, such as pages visited and session duration, collected via analytics cookies (if you have consented).
• Engagement data — if you become a client, we may collect operational and process-related information as part of delivering our services. This is governed by a separate engagement agreement.

We do not collect sensitive personal data (health data, biometric data, etc.) through our website. All data collection is either necessary for providing our services or based on your prior consent.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and, where applicable, the EU General Data Protection Regulation (GDPR):

• Consent — for analytics and marketing cookies, where you have provided explicit consent via our cookie banner.
• Contractual necessity — to respond to your enquiry and deliver our consulting services if you become a client.
• Legitimate interests — to operate and improve our website, respond to general enquiries, and maintain records for business continuity.

4. How We Use Your Data

• To respond to enquiries submitted via our website contact form.
• To deliver AI integration consulting services where an engagement agreement is in place.
• To send service-related communications (e.g., scheduling, updates, follow-up).
• To analyze and improve our website performance (analytics cookies, with consent).
• To comply with legal and regulatory obligations.

We do not use your personal data for unsolicited marketing, and we do not sell personal data to third parties.

5. Data Retention

We retain personal data for as long as necessary for the purpose it was collected. Enquiry data from website forms is retained for up to 12 months. Client engagement data is retained for up to 5 years following engagement close, to fulfill our business record-keeping obligations. Analytics data is retained in anonymized or aggregate form as permitted by applicable law.

6. Data Sharing

We do not sell personal data. We may share data with the following categories of third parties only to the extent necessary:

• Service providers — hosting, email, and analytics providers operating under data processing agreements.
• Legal authorities — where required by Thai law, court order, or to protect our legal rights.

Where third-party services involve data transfers outside Thailand, we take steps to ensure appropriate protections are in place.

7. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These include access controls, encrypted communication channels, and restricted internal data access. In the event of a personal data breach, we will notify affected individuals and relevant authorities in accordance with our obligations under the PDPA.

8. Cookies

Our website uses cookies. Essential cookies are necessary for basic website functionality and cannot be disabled. Analytics, marketing, and preference cookies are optional and require your consent. For full details, see our Cookie Policy.

9. Your Rights

Under the PDPA, you have the following rights in relation to your personal data:

• Right to access — to request a copy of the personal data we hold about you.
• Right to rectification — to request correction of inaccurate or incomplete data.
• Right to erasure — to request deletion of your data, subject to legal retention requirements.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — to withdraw previously given consent at any time, without affecting the lawfulness of processing prior to withdrawal.
• Right to lodge a complaint — with the Office of the Personal Data Protection Committee (PDPC) of Thailand if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@nagasynces. We will respond within 30 days.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Children's Privacy

Our services are intended for organizations and business professionals. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected data from a minor without appropriate consent, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last Updated" date at the top of this page. Continued use of our website after changes take effect constitutes acceptance of the revised policy.

13. Contact

For any questions about this Privacy Policy or how your data is handled, contact our data privacy contact at:
Naga Sync
38 Nimmanhaemin Road Soi 9, Suthep, Chiang Mai 50200, Thailand
privacy@nagasynces