Privacy Policy

1. Introduction

Vesterly ("we", "us", "our") is committed to handling personal information with care and transparency. This Privacy Policy explains what personal data we collect, how we use it, how we protect it, and the rights available to you under applicable Thai data protection law.

Vesterly operates from 63 Tha Phae Road, Chang Khlan, Chiang Mai 50100, Thailand. This policy applies to all visitors to our website and all persons who engage our administrative services.

Questions about this policy may be directed to [email protected].

2. Personal Data We Collect

We collect personal data in the following circumstances:

2.1 Information you provide directly

• Name, email address and telephone number submitted via our contact form
• Content of messages or enquiries you send to us
• Personal documents provided to us as part of our administrative services

2.2 Information collected automatically

• Cookies and similar technologies (see Section 5 and our Cookie Policy)
• Server log data including IP address, browser type and pages visited
• Analytics data collected via third-party tools (if analytics cookies are accepted)

2.3 Legal basis for processing

We process personal data on the following bases under the Thai Personal Data Protection Act B.E. 2562 (PDPA):

• Consent — for cookies and marketing communications
• Contractual necessity — to deliver services you have requested
• Legitimate interests — for website security and improving our services

2.4 Retention periods

Enquiry data is retained for up to 24 months. Service engagement records are retained for up to 5 years for administrative and compliance purposes. Website analytics data is retained for up to 26 months.

3. How We Use Your Data

We use personal data for the following purposes:

• Responding to enquiries and communicating about our administrative services
• Delivering the services you have requested
• Maintaining a record of our service engagements
• Improving the usability and content of our website
• Complying with applicable legal obligations

We do not sell personal data to third parties. We do not use personal data for unsolicited direct marketing without your prior consent.

3.1 Third-party service providers

We may share data with service providers who assist in operating our website (such as hosting providers and analytics tools). These providers are contractually required to handle data only as instructed by us and not to use it for their own purposes.

4. Data Security

We take reasonable and proportionate steps to protect personal data from unauthorised access, loss or misuse. These include:

• Password-protected access to internal systems containing personal data
• Secure file transfer practices for digitized documents
• Restricted access — only team members who need data to do their work can access it
• Physical document tracking logs throughout service engagements

In the event of a personal data breach that is likely to cause risk to your rights and freedoms, we will notify you and, where required, the relevant supervisory authority, within the timeframe required under applicable law.

5. Cookies

Our website uses cookies to provide basic functionality and, where you consent, to understand how the site is used. The types of cookies we use are:

• Essential cookies — required for the website to function; cannot be disabled
• Analytics cookies — help us understand visitor behaviour (optional; requires consent)
• Preference cookies — remember settings you have chosen (optional; requires consent)

For full details, including how to manage your cookie preferences, see our Cookie Policy.

6. Your Rights

Under the Thai Personal Data Protection Act (PDPA), you have the following rights in relation to your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of data we no longer have a lawful basis to hold
• Right to restriction — request that we limit how we use your data in certain circumstances
• Right to data portability — receive your data in a structured, commonly used format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand.

7. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those websites and recommend that you read their privacy policies before submitting any personal data to them.

8. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently received data from a minor, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The updated date at the top of this page will reflect when changes were made. Continued use of our website or services after any update constitutes acceptance of the revised policy. For material changes, we will notify existing contacts directly where practical.