Privacy Policy | Hearthway

Hearthway ("we", "us", "our") is committed to handling personal data responsibly and transparently. This policy explains what data we collect, why we collect it, and how we protect it. It applies to our website at hearthwaya.cyou and to all services we provide from our premises at 18/2 Huay Kaew Road, Su Thep, Mueang Chiang Mai, Chiang Mai 50200, Thailand.

This policy is written in line with Thailand's Personal Data Protection Act B.E. 2562 (PDPA). If you have questions, contact us at [email protected].

1. Data We Collect

We collect personal data only when necessary. The categories and sources are:

Contact form submissions: name, email address, phone number (optional), and any message content you choose to include.
Session booking and administration: name, email, phone, and information about which service you are enquiring about.
Website usage data: anonymised analytics data (page views, session duration, device type) collected via cookies, if you consent.

We do not collect sensitive personal data (such as health information, financial records, or identity document numbers) through our website. Any information shared verbally in sessions is covered by our confidentiality commitment and is not stored in our data systems.

2. Legal Basis for Processing

We process your personal data on the following legal bases under the PDPA:

Your consent: for marketing communications and non-essential cookies. You may withdraw consent at any time.
Contractual necessity: for processing your booking or enquiry in order to provide the service you requested.
Legitimate interests: for maintaining records necessary to our administrative operations, provided these interests are not overridden by your rights.

3. How We Use Your Data

To respond to enquiries submitted via our contact form
To schedule and administer sessions you have booked
To send service-related communications (confirmations, reminders)
To improve our website based on anonymised usage patterns
To meet our legal obligations under Thai law

We do not sell your personal data to any third party. We do not use your data for automated decision-making or profiling.

4. Data Retention

We retain contact and booking records for a period of two years from the date of your last interaction with Hearthway, after which they are securely deleted. Anonymised analytics data may be retained for longer as it cannot be linked to any individual. Records produced under the Shared Notes service are handed to families on completion and are not retained by Hearthway.

5. Data Sharing

We do not share your personal data with third parties except in the following limited circumstances:

Service providers: we use Google Analytics (anonymised, with IP anonymisation enabled) for website analytics. This data is governed by Google's privacy policy.
Legal requirements: we may disclose data if required to do so by Thai law or a lawful order from a competent authority.

No personal data is transferred outside Thailand except where Google's infrastructure is involved, in which case standard contractual protections apply.

6. Cookies

Our website uses cookies to support basic functionality and, with your consent, to collect anonymised analytics data. You can manage your cookie preferences at any time via our Cookie Policy page. Essential cookies cannot be disabled as they are required for the site to function correctly.

7. Your Rights Under the PDPA

Under Thailand's Personal Data Protection Act, you have the following rights:

Right of access: to request a copy of the personal data we hold about you
Right to rectification: to ask us to correct inaccurate or incomplete data
Right to erasure: to request deletion of your personal data, subject to our legal retention obligations
Right to data portability: to receive your data in a structured, commonly used format
Right to object: to object to processing based on legitimate interests
Right to withdraw consent: to withdraw consent for any processing based on consent, at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Data Security

We use reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include access controls on our administrative systems, secure email practices, and limited staff access to personal data. No online data transmission is entirely without risk, but we take our obligations seriously and review our practices regularly.

9. Children's Privacy

Our website is not directed at children under 18 years of age. We do not knowingly collect personal data from minors through our website. If you believe a minor has submitted data to us, please contact us and we will delete it promptly.

10. Third-Party Links

Our website may occasionally link to external resources. We are not responsible for the privacy practices of those sites and recommend reviewing their privacy policies directly.

11. Changes to This Policy

We may update this policy from time to time. If changes are material, we will note them with a revised "last updated" date at the top of this page. Continued use of our website after changes are published constitutes acceptance of the updated policy.

12. Contact & Complaints

For all privacy-related enquiries, contact us at [email protected] or by post at:

Hearthway
18/2 Huay Kaew Road, Su Thep
Mueang Chiang Mai, Chiang Mai 50200
Thailand

If you believe your rights under the PDPA have not been respected, you may lodge a complaint with Thailand's Personal Data Protection Committee (PDPC).