Privacy Policy

Introduction

Crest Mara is committed to protecting the privacy and security of personal information entrusted to us by clients, prospective clients, and website visitors. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with applicable data protection laws in Thailand, including the Personal Data Protection Act (PDPA).

By engaging with our services or using our website, you acknowledge that you have read and understood this Privacy Policy. If you have questions about our privacy practices, please contact us at [email protected].

1. Information We Collect

We collect personal information that you provide directly to us and information gathered through your use of our website and services.

Information You Provide Directly

• Name, email address, and phone number when you submit contact forms or inquire about services
• Business information including company name, role, and organizational details
• Communication preferences and service interests
• Information shared during consulting engagements, including operational data and strategic materials
• Feedback and correspondence when you communicate with us

Information Collected Automatically

• IP address, browser type, and device information
• Pages visited, time spent on pages, and navigation patterns
• Referring website and search terms used to find our website
• Cookie data as described in our Cookie Policy

We do not collect sensitive personal data such as health information, financial account details, or biometric data unless specifically required for a consulting engagement and with your explicit consent.

2. How We Use Your Information

We process your personal information for the following purposes, based on legitimate business interests and contractual necessity:

• To respond to inquiries and provide requested information about our consulting services
• To deliver consulting services under engagement agreements, including project execution and deliverable preparation
• To communicate about project progress, schedule meetings, and coordinate engagement activities
• To process payments and maintain financial records as required by law
• To improve our website functionality and user experience through analytics
• To send occasional updates about our services, with your consent (you may opt out at any time)
• To comply with legal obligations and respond to lawful requests from authorities
• To protect our legal rights and prevent fraud or misuse of our services

3. Legal Basis for Processing

Under the PDPA and applicable data protection regulations, we process your personal data based on:

• Consent: When you submit forms or agree to receive communications
• Contract Performance: When processing is necessary to deliver consulting services you have engaged
• Legitimate Interests: When processing serves our business operations while respecting your privacy rights
• Legal Obligation: When required to comply with Thai laws and regulations

4. Data Sharing and Disclosure

We do not sell or rent your personal information to third parties. We may share your data in the following limited circumstances:

• Service Providers: Trusted third parties who assist with website hosting, email communications, payment processing, and analytics, under strict confidentiality agreements
• Professional Advisors: Legal, accounting, and insurance advisors when necessary for business operations
• Legal Requirements: When required by law, court order, or governmental authority
• Business Transfers: In connection with a merger, acquisition, or sale of assets, subject to continued protection of your data

All third parties are contractually obligated to protect your information and use it only for specified purposes.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

• Encryption of data in transit and at rest using industry-standard protocols
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security assessments and updates to our information systems
• Secure disposal procedures for data that is no longer needed
• Confidentiality agreements with employees and contractors

While we strive to protect your information, no security system is impenetrable. We cannot guarantee absolute security, but we continuously work to maintain robust protections.

6. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law.

• Contact Inquiries: Retained for 2 years after last contact
• Client Project Data: Retained for 7 years after engagement completion to meet professional standards and legal requirements
• Marketing Communications: Retained until you opt out or request deletion
• Website Analytics: Aggregated data retained indefinitely; individual data retained for 24 months

7. Your Privacy Rights

Under the PDPA and applicable data protection laws, you have the following rights regarding your personal data:

• Right to Access: Request confirmation of what personal data we hold about you and obtain a copy
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data under certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing of your data for direct marketing purposes
• Right to Withdraw Consent: Withdraw previously given consent at any time
• Right to Lodge a Complaint: File a complaint with the Personal Data Protection Committee in Thailand

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 days as required by law.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance user experience and gather analytics data. For detailed information about our cookie practices, please review our Cookie Policy.

You can manage cookie preferences through your browser settings or our cookie consent tool.

9. Third-Party Links

Our website may contain links to external websites operated by third parties. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party websites you visit.

10. International Data Transfers

While our primary operations are based in Thailand, some of our service providers may process data in other jurisdictions. When we transfer data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, to protect your information.

11. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately so we can delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page and notify active clients via email.

Continued use of our website or services after changes become effective constitutes acceptance of the updated Privacy Policy.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: