Privacy Policy

1. Data Controller

The data controller for personal information collected through this website and our services is:

2. Information We Collect

We collect personal information only when you provide it directly or when it is generated by your use of our website. The categories of information we may collect include:

• Contact details: name, email address, and telephone number when submitted via our contact form or enrolment enquiry.
• Communication records: messages and correspondence you send to us.
• Technical data: IP address, browser type, pages visited, and session duration — collected automatically via cookies and analytics tools.
• Membership data: enrolment records and service usage information for active members.

We do not collect sensitive personal data (as defined under PDPA) and we do not collect financial account details.

Legal Basis for Processing

• Consent — for marketing communications and optional cookies.
• Contract performance — for service delivery to enrolled members.
• Legitimate interests — for website security, fraud prevention, and improving our services.

Retention Periods

• Contact form enquiries: 12 months from submission, then deleted.
• Member records: for the duration of membership plus 24 months.
• Analytics data: aggregated and anonymised after 26 months.

3. How We Use Your Information

• To respond to your enquiries and provide information about our services.
• To administer your membership and deliver the resources you have enrolled in.
• To send occasional updates about material changes to content you have access to (Library members).
• To improve website content and user experience using aggregated analytics.
• To comply with legal obligations under Thai law.

We do not use personal data for automated decision-making or profiling. We do not sell personal data to third parties.

4. Data Sharing

We share personal data only in limited circumstances:

• Service providers: Third-party platforms used for website hosting, email delivery, and analytics — bound by data processing agreements and PDPA-equivalent obligations.
• Legal requirements: When required to do so by Thai law or a competent authority.

We do not transfer personal data outside Thailand except where necessary for hosting services that maintain equivalent data protection standards.

5. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted data transmission (HTTPS/TLS).
• Access controls limiting data access to authorised staff only.
• Regular review of data handling practices.
• Prompt notification procedures in the event of a data breach, in line with PDPA requirements.

6. Cookies

Our website uses cookies to function correctly and to understand how visitors use the site. We use essential cookies (required for basic site operation) and optional analytics cookies (used only with your consent). Full details are available in our Cookie Policy.

7. Your Rights Under PDPA

Under Thailand's Personal Data Protection Act, you have the following rights regarding your personal data:

• Right to be informed: To know what personal data we hold and how we use it.
• Right of access: To request a copy of the personal data we hold about you.
• Right to rectification: To request correction of inaccurate or incomplete data.
• Right to erasure: To request deletion of your personal data where no legal basis for continued processing exists.
• Right to restrict processing: To request that we limit how we use your data in certain circumstances.
• Right to data portability: To receive your data in a structured, commonly used format.
• Right to object: To object to processing based on legitimate interests.
• Right to withdraw consent: To withdraw consent at any time for processing based on consent, without affecting prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee (PDPC) if you believe your rights have not been respected.

8. Third-Party Links

Our website and library materials contain links to external websites — primarily official Thai government and regulatory sources. We are not responsible for the privacy practices of those websites. We encourage you to review their privacy policies before submitting any personal information.

9. Children's Privacy

Vestapath's services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

10. Policy Updates

We may update this policy periodically to reflect changes in our practices or applicable law. The "Last Updated" date at the top of this page will always reflect when the most recent version was published. Where changes are material, we will notify active members by email.

11. Contact Us

For any privacy-related questions, requests to exercise your rights, or concerns about how your data is handled: