Privacy Policy

1. Introduction

Penvale ("we", "us", "our") is committed to handling personal information carefully and transparently. This policy explains what data we collect, why we collect it, how we use it, and what rights you have in relation to it. It applies to all personal data collected through our website and through our educational sessions and services.

Our registered address is 56 Sukhumvit Road, Tha Pradu, Rayong 21000, Thailand. If you have questions about this policy, please contact us at [email protected].

2. Data We Collect

We collect personal data in the following situations:

• Contact form submissions: name, email address, and optionally phone number and a message.
• Session enrolments: name, email address, phone number, and any scheduling information needed to arrange your session.
• Document Roadmap Sessions: where you bring documents to a session, we may see personal information contained in those documents. We do not copy, store, or record document content.
• Website usage: if analytics cookies are accepted, we receive anonymous data about how visitors use our website (pages visited, time on site). This does not identify you personally.

3. How We Use Your Data

We use the information we collect for the following purposes:

• Responding to enquiries submitted through our contact form
• Arranging and confirming session bookings
• Sending practical information related to sessions you have booked (dates, location, what to bring)
• Improving the quality of our educational content based on aggregated feedback
• Complying with legal obligations

We do not use your personal data for marketing purposes without your explicit consent, and we never sell personal data to third parties.

4. Legal Basis for Processing

We process personal data on the following legal grounds under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and applicable international standards:

• Consent: for marketing communications and analytics cookies, where you have given explicit consent.
• Contract performance: to fulfil a booking or session arrangement you have requested.
• Legitimate interests: to respond to enquiries and improve our services, balanced against your rights.
• Legal obligation: where we are required to process data by Thai law.

5. Data Retention

We retain personal data only for as long as necessary for the purpose it was collected:

• Contact form data: up to 12 months from last contact, unless you become a session participant.
• Session records: up to 3 years from the date of the session, for administrative and legal purposes.
• Analytics data: aggregated and anonymised; individual session data is not retained beyond 26 months.

6. Data Sharing

We do not share your personal data with third parties for their own commercial purposes. We may share data with:

• Service providers who assist in operating our website (such as hosting and analytics providers), bound by data processing agreements.
• Authorities, where required by Thai law or legal process.

7. Cookies

Our website uses cookies. Essential cookies keep the website functioning properly. Optional analytics and preference cookies are only placed with your consent. For full details, see our Cookie Policy.

8. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include access controls, secure email practices, and periodic review of our data handling procedures. If a data breach occurs that is likely to affect your rights, we will notify you in accordance with applicable Thai data protection law.

9. Your Rights

Under Thailand's PDPA and applicable data protection principles, you have the following rights:

• Access: to request a copy of the personal data we hold about you.
• Rectification: to ask us to correct inaccurate data.
• Erasure: to request deletion of your personal data, subject to legal retention obligations.
• Restriction: to ask us to limit how we use your data in certain circumstances.
• Data portability: to receive your data in a structured, machine-readable format where applicable.
• Objection: to object to processing based on legitimate interests.
• Withdraw consent: to withdraw consent for any processing based on consent, at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Third-Party Links

Our website may contain links to external websites, including government and institutional sources we reference in our educational content. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

11. Children's Privacy

Our services are designed for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently received data from a minor, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. If changes are significant, we will notify you by email where we hold your contact details.

13. Contact

For questions, concerns, or to exercise your rights under this policy, contact us at: