Privacy Policy

1. Introduction

Lanna Forge ("we", "us", "our") is committed to handling the personal information you share with us with care and in compliance with applicable data protection law — including the Personal Data Protection Act B.E. 2562 (Thailand) and, where relevant, the European Union's General Data Protection Regulation (GDPR).

This policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and what rights you have over it. If you have questions, contact us at [email protected].

2. Data We Collect

Information you provide directly

• Name and contact details (email address, phone number) when submitted via our contact form
• Business information included in messages or during consultation conversations
• Correspondence and documentation shared as part of an engagement

Information collected automatically

• Browser type, device type, and IP address (collected via analytics tools)
• Pages visited, time spent, and navigation patterns on our website
• Cookie data where cookies have been accepted (see our Cookie Policy)

Legal basis for processing

We process personal data on the basis of: (a) your consent, where given; (b) the performance of a contract or pre-contract steps; and (c) our legitimate interest in operating our business, providing services, and maintaining website security.

3. How We Use Your Data

• Responding to enquiries submitted via our contact form
• Managing and delivering consulting engagements
• Maintaining records required for financial and legal compliance
• Improving the performance and content of our website via analytics
• Communicating service-related updates or changes to engagement terms

We do not use your personal data for direct marketing without your explicit consent, and we do not sell personal data to third parties under any circumstances.

4. Data Sharing

Lanna Forge does not share personal data with third parties except in the following situations:

• With service providers who support our operations (e.g., website hosting, analytics), under appropriate data processing agreements
• Where required by law, regulation, or court order
• With your explicit consent

We use Google Analytics to understand website usage patterns. Google Analytics sets cookies and processes data in accordance with Google's own privacy terms. You can opt out of Google Analytics via our Cookie Policy page.

5. Data Protection Measures

We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or disclosure. These include:

• SSL/TLS encryption for data transmitted to and from our website
• Access controls limiting who within the firm can view client data
• Mutual non-disclosure agreements with all clients before engagement commencement
• Regular review of data handling practices

6. Data Retention

Personal data submitted via our contact form is retained for up to 24 months from the date of last contact, unless a consulting engagement begins — in which case data is retained for the duration of the engagement plus seven years, as required for financial record-keeping. You may request deletion at any time (subject to legal retention obligations).

7. Cookies

Our website uses cookies to function correctly and to understand usage patterns. For detailed information about which cookies we use and how to manage your preferences, please see our Cookie Policy.

8. Your Rights

Under applicable data protection law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your personal data (subject to legal retention requirements)
• Object to or restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you believe your rights have not been upheld, you have the right to lodge a complaint with Thailand's Personal Data Protection Committee or, for EU residents, your local supervisory authority.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend you review their policies independently.

10. Children's Privacy

Our services are intended for business use by adults (18 years and over). We do not knowingly collect personal data from individuals under 18. If we become aware that we have done so, the data will be deleted promptly.

11. Policy Updates

We may update this policy from time to time. Material changes will be communicated via email to clients with active engagements, and the updated policy will be published on this page with a revised "Last Updated" date. Continued use of our website following an update constitutes acceptance of the revised policy.

12. Contact

Data Controller: Lanna Forge
Address: 142 Ratchadaphisek Road, Din Daeng, Bangkok 10400, Thailand
Email: [email protected]