Privacy Policy

1. Scope of This Policy

This policy applies to all personal data we process in connection with: visits to our website at vaultlines.sbs; use of our enquiry and contact forms; delivery of our services including the Legacy Documentation Toolkit, Heirloom Cataloguing, and Generational Planning Seminar; and any other direct communications with Vaultline.

Vaultline operates primarily under the Personal Data Protection Act B.E. 2562 (2019) (Thailand PDPA). Where clients are residents of the European Economic Area, we additionally apply principles consistent with the General Data Protection Regulation (EU) 2016/679.

2. Data We Collect

We collect personal data in the following categories:

• Contact information: name, email address, telephone number — provided via our enquiry form or by direct contact.
• Correspondence: content of messages, questions or enquiries you send us.
• Service-related data: information you share with us during service delivery, such as details about personal records or heirlooms relevant to the service scope.
• Technical data: IP address, browser type, referring pages, visit timestamps — collected automatically via server logs and, where consented, analytics cookies.

We do not collect sensitive personal data (as defined under the Thailand PDPA) except where strictly necessary and with explicit consent.

3. Legal Basis and Purpose of Processing

We process personal data on the following bases:

• Contract performance: to deliver the service you have requested.
• Legitimate interest: to respond to enquiries, manage our business operations, and improve our services.
• Consent: for analytics cookies and optional marketing communications. Consent may be withdrawn at any time.
• Legal obligation: where required by Thai law or applicable regulation.

4. How We Use Your Data

• Responding to enquiries submitted via our contact form.
• Delivering agreed services and following up after completion.
• Sending service-related communications such as appointment confirmations.
• Improving our website and services using aggregated, anonymised analytics.
• Complying with legal and regulatory requirements.

We do not use personal data for unsolicited commercial marketing without prior consent.

5. Data Sharing

We do not sell personal data to third parties. We may share data with:

• Service providers: hosting, email delivery, and analytics providers operating under appropriate data processing agreements.
• Legal authorities: where required to comply with applicable law or lawful requests.

Any third-party service providers are selected with care and are required to handle data in a manner consistent with this policy.

6. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy:

• Enquiry and contact records: up to 2 years from last contact, unless a service relationship continues.
• Service delivery records: up to 5 years from completion of service, for administrative and legal purposes.
• Technical/analytics data: anonymised after 26 months.

You may request earlier erasure of your data subject to applicable legal requirements.

7. Data Protection Measures

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss or disclosure, including:

• Encrypted storage for digital records containing personal data.
• Restricted internal access on a need-to-know basis.
• Secure email communication for sharing service outputs with clients.
• No retention of physical client documents beyond the service engagement.

In the event of a personal data breach that poses risk to individuals, we will notify affected parties and relevant authorities in accordance with the Thailand PDPA timeframe requirements.

8. Cookies

Our website uses cookies for essential functionality and, where consented, for analytics. For a full explanation of the cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

9. Your Rights

Under the Thailand PDPA and, where applicable, the GDPR, you have the following rights in relation to personal data we hold about you:

• Access: request a copy of your personal data.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of data we no longer have a legal basis to retain.
• Portability: request your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: request restriction of processing in certain circumstances.
• Withdraw consent: at any time, where processing is based on consent.

To exercise any of these rights, please write to [email protected]. We will respond within 30 days. If you are located in the EEA and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

10. Third-Party Links

Our website may include links to external websites, including official government resources and referral organisations. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

11. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will be published on this page with an updated date. For material changes, we will notify existing clients by email where we hold a current email address.

13. Contact

For questions about this policy or to exercise your data rights, please contact:

• Email: [email protected]
• Address: Vaultline, 63 Tha Phae Road, Chang Khlan, Chiang Mai 50100, Thailand
• Phone: +66 2 624 8071