Privacy Policy

01Who is responsible and what this policy covers

Fakduai Logistics and Digital Platform Co., Ltd., at the address below, is the controller for website inquiries and its own business administration. For customer systems that we operate under documented instructions, the customer may be the controller and Fakduai the processor; the project agreement determines these roles.

This notice covers visitors, prospective clients, customer representatives and workshop participants. Independently operated websites or services, including linked partner products, have their own notices.

02Information collected and its sources

We collect information you provide through forms, communications and service use. Hosting and embedded service providers may receive technical information when your browser connects to them.

• Contact and project information: name, email, phone, company, selected service, budget range and project description. Mandatory form fields are needed to respond meaningfully; withholding them may prevent submission or a response.
• Contract and billing records, correspondence, support requests and project information when a service is commissioned. Only data necessary for the agreed work should be supplied.
• Technical information such as IP address, device/browser information, access or security logs, language preference and AI session identifiers.
• AI questions and responses, and workshop registration or recordings where these are actually collected under a relevant activity notice. Customer-provided personal data must be supplied lawfully.

03Purposes and legal bases

We select a lawful basis for each purpose rather than treating website use as consent to every use of your data.

• Responding to inquiries, preparing proposals and delivering agreed services: steps requested before a contract or performance of a contract, as applicable.
• Billing, accounting and legally required records: compliance with legal obligations.
• Security, fraud prevention, necessary service administration and legal claims: legitimate interests assessed against your rights, or another applicable legal basis.
• Optional marketing, non-essential tracking and activity recordings where consent is required: separate, informed and revocable consent. Refusing optional processing does not prevent necessary services. Sensitive data requires the additional conditions imposed by law.

04Cookies, browser storage and external resources

The site uses a language preference cookie (i18n_redirected). The AI assistant stores a random session ID, daily question count and last-used date in localStorage. These entries remain on your device until cleared or replaced; the daily counter resets when the assistant is used on a new day. Clearing browser storage also clears these preferences and limits.

Google Fonts, externally hosted article images and Google Maps may receive technical information under their own policies. Maps load only after you activate them. We do not treat this notice as consent for non-essential analytics or advertising; any such feature must provide its own notice and legally required choice before activation.

05AI assistance and automation

Where available, the assistant can process questions using your browser’s on-device AI. If that mode is unavailable, the question and random session identifier are transmitted to a Fakduai-operated n8n endpoint and may be processed by the AI providers used for that workflow. Browser providers and remote providers may also process relevant technical data under their own terms.

Do not submit passwords, access tokens, sensitive personal data or confidential production records to the public assistant. It produces project guidance, not binding quotations or decisions with legal effects. Project use of customer data with AI, including provider retention, model-training permissions and human oversight, must be addressed in the project’s notice and agreement before processing.

06Who may receive information

Access is limited by the purposes above: authorized staff and necessary contractors; hosting, storage, email, workflow, AI and support providers; and professional advisers or authorities where required by law or necessary for lawful claims. Providers processing on our behalf must be subject to appropriate instructions and safeguards.

Inquiry data is not permission to sell your personal information or share it for unrelated advertising. If a future service involves legally defined sale, advertising sharing or additional recipients, the relevant notice and required choices must be provided first. Contact us for the recipients applicable to your inquiry or project.

07International data transfers

Service providers or customer configurations may involve access or processing outside Thailand. Applicable transfers require a lawful mechanism and appropriate safeguards under PDPA sections 28–29 and relevant rules. Where EU or UK transfer rules apply, adequacy decisions or approved contractual safeguards and required risk assessments may be necessary. A project notice should identify the actual destinations and safeguards; no specific hosting country is promised here.

08How retention is determined

Inquiry information is kept while responding, preparing a requested proposal or handling necessary follow-up. When those purposes end, it should be deleted or anonymized unless an applicable accounting, contractual, dispute or legal obligation requires retention. Contract and billing records follow those obligations and relevant limitation periods.

Security logs and AI workflow records must have retention proportionate to security and processing needs. Device storage can be cleared by the user; server and provider backups may follow their own deletion cycles. There is no single fixed retention period for all categories. You may request the applicable criteria and deletion status through the contact channel below.

09Security and incident handling

Appropriate organizational and technical measures should match the sensitivity and risks of the processing, including access control, secure transmission, confidentiality and incident response. No website or network can guarantee absolute security.

Where PDPA requires it, a controller must notify the competent authority without delay and, where feasible, within 72 hours of becoming aware of a personal data breach, subject to the statutory risk exception. High-risk incidents also require notice to affected individuals without delay. Processors must promptly inform the controller; other applicable laws may impose additional notification duties.

10Your rights and how to exercise them

Subject to the conditions and exceptions of applicable law, you may request access or a copy, correction, deletion or anonymization, restriction, portability, information about the source of data and objection to processing. You may withdraw consent without affecting prior lawful processing, and object to direct marketing. Other valid legal grounds may still require some data to be retained.

Contact us below with enough information to locate your records. Identity verification must be proportionate and requests are handled within applicable statutory deadlines; PDPA access requests are generally fulfilled without delay and within 30 days, subject to lawful refusal. You may complain to Thailand’s PDPC or another competent supervisory authority. Requests concerning a customer’s system may need to be addressed to that customer as controller.

11Children and sensitive information

Public business inquiry and AI features are not designed for children to use independently. For student workshops or any service involving minors, the appropriate activity notice and legally required parent or guardian authorization must be arranged. Do not submit health, biometric, criminal-record or other legally sensitive information unless a service specifically requires it and the applicable legal conditions have been explained.

12Additional rights and updates

EU GDPR, UK GDPR, California CCPA/CPRA, Japan APPI and Korea PIPA may apply when their territorial, activity and other statutory conditions are met. Applicable supplementary rights, including limits on automated decisions, opt-outs for sale or advertising sharing, and recognized preference signals, are respected where legally required. A translated page alone does not determine legal applicability.

Material changes will be described with a new update date and appropriate notice. New processing purposes or consent-based activities require a valid legal basis and any new consent required by law; continued browsing alone does not supply that consent.