Privacy Policy

1. Who We Are

Wildfern is a nonprofit and social enterprise advisory practice based in Bangkok, Thailand. Our registered address is 34 Nakhon Sawan Road, Wat Sommanat, Pom Prap Sattru Phai, Bangkok 10100. We act as the data controller for personal information collected through this website and through our advisory engagements.

For data-related enquiries, contact us at: [email protected]

2. Data We Collect

We collect personal data in the following ways:

• Contact form submissions: name, email address, phone number (optional), and message content.
• Direct correspondence: emails or calls you initiate with us.
• Engagement-related records: notes and documents created during advisory sessions, with your knowledge and participation.
• Website analytics: anonymised usage data, including pages visited and approximate location (country-level).
• Cookies: see our Cookie Policy for full details.

We do not collect sensitive personal data (as defined by the PDPA) unless you voluntarily share it in correspondence, in which case it is treated with heightened care.

3. Legal Basis for Processing

We process personal data on the following legal grounds:

• Consent: for cookie preferences and marketing-related communications, where you have opted in.
• Legitimate interests: for responding to enquiries, managing client relationships, and improving our services.
• Contractual necessity: where processing is required to fulfil an advisory engagement you have entered into.
• Legal obligation: where we are required to retain records under applicable Thai law.

4. How We Use Your Data

• Responding to your enquiry and determining whether an engagement is appropriate.
• Delivering advisory services as agreed.
• Sending written notes, session summaries, and other engagement documents.
• Maintaining records of the engagement for our own reference.
• Improving the quality of our services and website.
• Meeting any legal or regulatory obligations.

We do not use your personal data for unsolicited marketing, and we do not sell or trade personal data to any third party.

5. Data Sharing

We share personal data only in the following limited circumstances:

• Service providers: such as email hosting and website analytics tools, where they act under our instruction and are contractually bound to appropriate data handling standards.
• Legal requirements: if we are required to disclose information by law, court order, or regulatory authority.

We do not share engagement content or client information with other clients or third parties for commercial purposes.

6. Data Retention

We retain personal data for as long as is necessary to fulfil the purposes described above, or as required by law. Typical retention periods:

• Enquiry and contact form data: up to 24 months from last contact, unless an engagement commences.
• Engagement records (notes, documents, correspondence): up to 5 years from the end of the engagement.
• Financial records: as required by Thai accounting law (minimum 5 years).

After the applicable period, data is securely deleted or anonymised.

7. Data Protection Measures

• Personal data is stored on password-protected systems with restricted access.
• Email communications are sent via encrypted channels where supported.
• Engagement documents shared electronically use access controls.
• We regularly review our data handling practices and update them as needed.
• In the event of a data breach affecting your rights, we will notify you and the Office of the Personal Data Protection Committee (PDPC) as required under the PDPA.

8. Cookies

Our website uses cookies to understand how visitors use the site and to improve your experience. Essential cookies are necessary for the site to function. Optional analytics and preference cookies are only placed with your consent. For full details, see our Cookie Policy.

9. Your Rights Under the PDPA

As a data subject under Thailand's PDPA, you have the following rights:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data, subject to legal retention obligations.
• Right to restrict processing: ask us to limit how we use your data in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format where technically feasible.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand.

10. Third-Party Links

Our website may contain links to external organisations or resources. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

11. Children's Privacy

Our services are directed at organisations and professionals aged 18 and above. We do not knowingly collect personal data from individuals under 18. If we become aware that we have done so, we will delete the information promptly.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page. Continued use of our website following changes constitutes acceptance of the revised policy.

13. Contact

For any questions or requests relating to this Privacy Policy or your personal data:

• Email: [email protected]
• Post: 34 Nakhon Sawan Road, Wat Sommanat, Pom Prap Sattru Phai, Bangkok 10100, Thailand
• Phone: +66 2 281 7409