Privacy Policy

Privacy Notice

PLEASE READ THIS POLICY CAREFULLY.  IF YOU DO NOT ACCEPT THESE TERMS, YOU ARE ADVISED NOT TO USE THE WEBSITE www.hugheskrupica.com

This policy was last updated: 2nd July 2021

Use of this website, www.hugheskrupica.com, constitutes your legal agreement to the terms within this Privacy Policy and your acceptance of the policy is deemed to occur upon your first use of the website.

Hughes Krupica Consulting Co., Ltd. may update this policy from time to time. On each visit to the website you should refer to this page to ensure that you are aware of and accept any changes.

Policy Statement

Hughes Krupica Consulting Co., Ltd. recognises the trust you place in us when you share personal information with us. We are committed to being open, honest and transparent with our use of personal data.

This privacy policy provides you with details of the personal information we collect when we engage with you, how we will use and look after your personal information, your privacy rights and how the law protects you.

We will take all reasonable steps to ensure that your personal information is safeguarded and kept in accordance with data protection law.

By providing us with your data, you warrant that you are over 13 years of age.

About Us

Hughes Krupica Consulting Co., Ltd. is registered in Thailand under Company Registration Number 0-1055-56141-10-9. Our office address is registered at 23/123-125 Boat Lagoon, Koh kaew, Muang, Phuket, Thailand.

Our website at www.hugheskrupica.com is designed to promote our high-quality legal advice and consulting services.

Where we manage personal data, we identify as a Data Controller and recognise and act on our obligations under applicable data protection law. For any issues relating to data protection the persons responsible are Pongsak Daengkaew; Robert Krupica and Desmond Hughes, representing and as directors of Hughes Krupica Consulting Co. Ltd. You can contact them in relation to data protection matters by email to [email protected].

What personal data do we collect?

Personal information is any information relating to an identified or identifiable individual. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal information about you when we engage with you.

This will include but might not be limited to:

  • Identity Data – title, first name, last name, job title, company name or similar identifier. If you interact with us through social media, this may include your social media user name;
  • Contact Data – billing address, delivery address, email address and telephone numbers;
  • Transaction Data – details about services you have purchased from us or we have purchased from you.
How do we collect personal data?

We use different methods to collect data from and about you, through:

Our Contact Form

The Contact Form on our website is used to collect your name, email and phone number as well as your message, so that we can respond to your communications and provide details of our services and deal with general company enquiries. Data is held on the grounds of being legitimate to our business interests.

Emails

We retain copies of emails sent to us on our servers which are hosted through the services of Google Asia Pacific Pte. Ltd who may use servers in their discretion in accordance with their terms and conditions of use, under which we do not control. Your personal information will be held by us in accordance with this Privacy Policy and will be on the basis of being legitimate to our business interests.

Telephone calls

Calls to us may be recorded and any data relating to the call may be retained by us. The data will be held on the basis of being for our legitimate business needs or in order to fulfil our contractual obligations if you are a client of ours. Sometimes we must also record telephone calls which may be contentious or disclose essential information relevant to a transaction, case, or issue.

Other direct interactions

You may give us your data by filling in forms or by corresponding with us face-to-face, by post, or through chat or social media. This includes personal data you provide when you: sign up to receive our newsletter; make enquiries or request information be sent to you; order our services; ask for information to be sent to you; engage with us on social media; enter a competition, promotion or survey; contact us direct; or leave comments or reviews on our services.

Social media

We use social media to engage with users and link to our LinkedIn, Twitter, Facebook pages and YouTube channel. We do not keep any specific data that identifies you as an individual user but hold details of our followers on these platforms. You should refer to the Privacy Policies of these channels to understand how they treat your data in relation to linking to our site.

If you send us a direct message via social media, the details may be retained by us only as relevant to any ongoing contract or to further our legitimate business interests or as required for legal purposes. The third-party provider may also retain details in accordance with their Privacy Policy.

Testimonials

We may ask you for a testimonial about our services that may be used on our website or social media. Your name and company may be used. Data is only published based on valid consent obtained from you.

Visits to our website

When you visit our website we do not attempt to identify you as an individual user and we will not collect personal information about you unless you specifically provide this to us.

Special categories of data

We do not generally collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences. Exceptions to this relate to client engagements where such information is supplied to us and for which we must retain information.

Children

We do not market this website to those under 18 years old. Consistent with the GDPR (EU) and PDPA (TH) we will never knowingly request personally identifiable information from anyone under the age of 16 years old. It is not always possible to identify from social media the age of a person who clicks to follow or likes our social media postings.

Information we get from other sources

From time to time, we may need to obtain information from third parties about you. This will only apply where it is necessary to provide our services and as permitted by law.

We may receive personal data relating to your identity and contact data from data partners; and data from any third parties who are permitted by law or have your permission to share your personal data with us, such as via social media or review sites.

How do we use your data?

Thailand data protection law requires us to have a “legal basis” for processing personal data.

The legal basis we rely on are:

  • Performance of a contract we are about to enter into or have entered into with you;
  • Compliance with a legal or regulatory obligation;
  • Carrying out activities that are legitimate to our business interests;
  • Consent. However, generally, we shall not rely on consent as a legal basis for processing your personal data other than where the law requires it. Where our legal basis is consent, you have the right to withdraw consent at any time.

We may use the information we collect from you in the following ways:

  • To administer and improve the website;
  • To personalise the content and user experience of the website or any potential services;
  • To allow us to respond to communications;
  • To send email notifications which have been specifically requested;
  • To send marketing communications, where expressly agreed;
  • To provide third parties with statistical information about our users;
  • To ask for feedback or testimonials;
  • To deal with enquiries and complaints made by or about you relating to the website.

Users contacting this website and/or its owners do so at their own discretion and provide any such personal data requested at their own risk. Your personal information is kept private and stored securely until a time it is no longer required or has no use.

Our legitimate interests

When we use our legitimate interests as the legal basis for processing your personal information, we will consider and balance any potential impact on you and your rights before we process your personal data. We will only then proceed where we believe our interests are not overridden by the impact on you. Our legitimate interests include the management of our business operations.

Sharing Information
Disclosure

We do not share, sell, or distribute your data to third parties, except as contractually agreed with you or as provided in this Privacy Policy. We may disclose your personal information if we are required to do so by law, in connection with any legal proceedings, and to establish, exercise, or defend our legal rights, or if otherwise legally permitted.

Client Investigation Reports

We may send some Clients status reports about companies we have investigated on their behalf to in relation to prospective business in advance of or in connection to due diligence or another activity. Contact details are kept on an excel spreadsheet or third party or proprietary software, and include details of individuals, company names, name and title of contacts, and a summary of the status, amongst other details and information.

Data Processors

We may use Data Processors who act on our instruction in relation to the management of your data and they must adhere to all data protection laws and regulations. We will ensure that any Data Processors used only operate on our written instructions and comply with their obligations under the GDPR (EU) and PDPA (TH). You will be informed of any other Data Controllers who have access to your data and who may determine processing activities separately to us or as a Joint Data Controller.

Marketing

We may carry out direct marketing by email, phone, text, or post.

External Links

Users of the website are advised to adopt a policy of caution before clicking on any external web links. Clicking an external link will take the user away from our website. Once you leave our website or are redirected to a third-party website, plug-in, or application, you are no longer governed by this Privacy Policy or our website’s terms and conditions. We cannot guarantee or verify the contents of any externally linked website and users click on external links at their own risk.  Hughes Krupica Consulting Co., Ltd. and its owners cannot be held liable for any damages, or the consequences of visiting any external links.

Social Media Platforms

Communication, engagement, and actions taken through external social media platforms that this website and its owners participate on are subject to our terms and conditions as well as the privacy policies held with each social media platform respectively.

Users are advised to use social media platforms wisely and communicate and/or engage with them with due care and caution in regard to their own privacy and personal details. This website nor its owners will not ask for personal or sensitive information through social media platforms and encourage users wishing to discuss sensitive details to contact them through primary communication channels such as by telephone or email.

Hughes Krupica Consulting Co., Ltd. uses social sharing buttons which help share web content directly from web pages to the social media platform in question. Users are advised that before using such social sharing buttons, that they do so at their own discretion, and should consider that the social media platform may track and save requests to share a web page, through the users’ social media platform account.

Payment Processing

Payments handled on our website may be managed by a third party if any payment system is introduced. Our firm currently uses PayPal for certain client payment processes who will send email communications on our behalf only with your express consent. This third party operates under a contractual agreement with Hughes Krupica Consulting Co., Ltd. and is not permitted to use your personal data for its own purposes. They act on our instructions which must comply with the obligations of data processors under the GDPR (EU) and PDPA (TH). You can refer to PayPal Privacy Policy at https://www.paypal.com/en/webapps/mpp/ua/privacy-full.

Payments handled on our premises shall comply with the standard procedures and requirements as laid down by law to ensure that personal data is kept secure.

If we purchase products or services from you we will keep your account details you send us as part of your invoices on our files. A record of your account details will also be kept with our banking services provider.

Data Retention

We keep your personal information in accordance with our Data Retention Policy which reflects ours needs to provide services to you as contracted and also as required to meet legal, statutory, and regulatory obligations. The need to hold information is regularly reviewed and data will be disposed of when no longer required.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, personal data is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such system and are required to keep the information confidential.

We take appropriate steps to ensure a safe processing of personal data, however, we cannot guarantee the security of data transmitted through our website or by email. Any transmission is at your own risk.

Data Storage

Our website is hosted by Amazon AWS (https://aws.amazon.com/). Any information that you supply to us may be stored and processed by servers located in Thailand or external servers.  Your data may be transferred in accordance with the relevant data protection laws.

We also use a series of tech products which can be found here: https://www.hugheskrupica.com/legal-tech/

Each tech product supplier has its own set of policies which you can inspect by clicking through to their websites.

Rights of Data Subjects

Hughes Krupica Consulting Co., Ltd. recognises a data subjects rights and will uphold these in accordance with data protection laws. You are entitled to see the information held about you and you may ask us about any of the following:

Subject access requests

Data subjects (i.e. individuals) have the right to access personal data that is held by submitting a subject access request (SAR) to Hughes Krupica Consulting Co., Ltd. We will endeavour to respond quickly to any such requests, which legally require us to respond within one month of receiving the request and necessary information. A subject access request can be made by emailing us at [email protected].

Right to rectification

Data subjects have the right to request that we amend or change personal information that is inaccurate or incorrect.

Right to erasure

Data subjects have the right to ask us to delete personal information from our systems without giving any reason and at any time. We will act on any such request without delay. However, if a request contravenes a contractual or legal requirement, then we may refuse and will endeavour to provide reasons within any constraints such as legal privilege, confidentiality or privacy obligations.

Right to restrict processing

Data subjects have the right to rectification or erasure of personal data in the following circumstances:

  • Personal data is not accurate;
  • The processing of data is unlawful – data subjects may request that processing is restricted;
  • Data is required to exercise legal rights or defend legal claims;
  • Data is unlawful but there may be lawful grounds for processing, which override this right
Right to data portability

Data subjects have the right to obtain and request the transfer of their data to different service providers.

Right to object

Data subjects have the right to object to the processing of data at any time based on their particular situation. This includes objecting to profiling unless it is in the ‘public interest’ or exercised lawfully by an official authority. We will only process data under lawful grounds.

Using your rights

We do not use any automated processing that results in any automated decision based on a data subject’s personal information.

Right not to be subject to decisions based on automated processing

If you wish to invoke any of these rights, you should contact the person responsible for data protection by email to [email protected].

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Data Breaches

We will report any unlawful breach of data as required by the GDPR (EU) and PDPA (TH) within 72 hours of the breach occurring, if it is considered that there is an actual, or possibility, that data within our control including the control of our data processors, has been compromised. If the breach is classified as ‘high risk’ we will notify all data subjects concerned using an appropriate means of communication.

Important Information
Questions and queries

If you have any concerns about how we handle your data, you can contact the Data Controller by email at [email protected].

Changes to our Privacy Policy

We reserve the right to change this Privacy Policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon their posting on the website.

You will be deemed to have accepted any changes to the terms of the privacy policy on your next visit to the website following the amendment.

Complaints

If you want to raise a concern about the use of your data, you can contact us by email at [email protected].

Legal Terms
No Waiver

No failure or delay by us in exercising any of our rights in accordance with this Privacy Policy or our terms and conditions shall be deemed to be a waiver of that right, and no waiver of a breach of any provision of the Agreement shall be deemed to be a waiver of any subsequent breach of the same or any other provision.

Severance

If one or more of the provisions of this Privacy Policy or our terms and conditions is found to be unlawful, invalid, or otherwise unenforceable, those provision(s) shall be deemed severed from the remainder of these terms and conditions and shall remain enforceable.

Third Party Rights

The terms of this Privacy Policy shall not confer rights on any third parties so far as is permitted to be excluded under law, including Thai law, and to the extent applicable in the U.K, the Contracts (Rights of Third Parties) Act shall not apply.

Jurisdiction and Governing Law

The terms of this Privacy Policy and all disputes, whether contractual or otherwise, arising out of or in connection with the policy are governed by and shall be construed in accordance with the laws of Thailand and each party submits to the exclusive jurisdiction of the Thai courts.