Privacy Policy

1. Introduction

Nestpath ("we", "us", "our") is committed to handling personal information responsibly. This policy explains what information we collect from visitors to this website and from people who register for our workshops and programmes, how we use it, and what rights you have over it.

This policy applies to the Nestpath website and to personal information provided in connection with our Document Organisation Workshop, Personal Records Toolkit, and Information & Orientation Programme. All activities offered by Nestpath are educational and administrative in nature.

Our registered address is 204 Rama IV Road, Silom, Bang Rak, Bangkok 10500, Thailand. Questions about this policy may be sent to [email protected].

2. Information We Collect

2.1 Information You Provide

When you submit an enquiry through our contact form, or register for a session, we collect the name and email address you provide, and any phone number or message you choose to include. These fields are used only to respond to your enquiry and to manage your participation in a programme.

2.2 Information Collected Automatically

Our website may collect standard web server log data such as IP address, browser type, pages visited, and visit duration. This data is used for general website administration and security purposes and is not used to identify individuals unless required in the event of a security incident.

We use cookies on this website. Please see Section 6 and our Cookie Policy for details.

2.3 Legal Basis for Processing (Thailand PDPA)

Under the Thailand Personal Data Protection Act B.E. 2562 (2019), we process personal data on the following bases: your consent (for enquiry forms and cookie preferences), the performance of a contract or pre-contractual steps (for programme registrations), and our legitimate interests in operating a lawful business and maintaining website security.

3. How We Use Your Information

• To respond to your enquiry or question about our programmes
• To confirm your registration for a session and send any preparation notes
• To send administrative messages related to your booking (changes, reminders)
• To analyse aggregate website usage for general improvement purposes
• To comply with applicable Thai law and respond to lawful requests

We do not use personal data for automated decision-making or profiling. We do not sell or rent personal data to third parties. We do not send marketing emails to individuals who have not specifically consented to receive them.

4. Data Sharing

We share personal data only in the following limited circumstances:

• Service providers: We use third-party services for website hosting, email delivery, and analytics (such as Google Analytics). These providers process data only on our instructions and are contractually bound to appropriate data protection standards.
• Legal requirements: We may disclose personal data where required by Thai law or in response to a valid legal process.

We do not transfer personal data outside of Thailand except where necessary to operate services (such as cloud hosting), and only where appropriate safeguards are in place.

5. Data Retention

Contact enquiry data is retained for up to 12 months from the date of the enquiry, or until you request deletion, whichever comes first. Programme registration records are retained for up to 3 years for administrative and accounting purposes. Website log data is retained for a maximum of 6 months.

Anonymised and aggregated information (such as session attendance numbers) may be retained indefinitely for internal reporting purposes.

6. Cookies

This website uses essential cookies to support basic functionality, and optional cookies for analytics purposes. You can manage your cookie preferences at any time using the controls on our Cookie Policy page. Rejecting optional cookies does not affect your ability to use the website or enquire about our programmes.

7. Data Protection Measures

We take reasonable technical and organisational steps to protect personal data from unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS) for web pages, access controls limiting who within Nestpath can view personal data, and a review of data handling practices on a regular basis.

In the event of a personal data breach that poses a risk to individuals, we will notify the relevant supervisory authority and affected individuals in accordance with our obligations under the Thailand PDPA.

8. Your Rights

Under the Thailand Personal Data Protection Act, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Ask us to correct inaccurate data
• Erasure: Request deletion of your data where we have no ongoing lawful basis to hold it
• Portability: Receive your data in a structured, commonly used format where applicable
• Objection: Object to processing carried out on the basis of legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting prior processing

To exercise any of these rights, please write to us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee of Thailand if you believe we have handled your data incorrectly.

9. Third-Party Links

Our website may contain links to external websites. Nestpath is not responsible for the privacy practices of those sites and this policy does not apply to them. We encourage you to review the privacy policies of any external site you visit.

10. Children's Privacy

Nestpath's programmes are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we have received data from a minor, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. Any material changes will be posted on this page with a revised date. Continued use of our website after a change constitutes acceptance of the updated policy. We recommend checking this page periodically.