Privacy Policy

§ 01 — Data Controller

Who We Are

The data controller for personal data collected through this website and our services is:

§ 02 — Data Collection

What Personal Data We Collect

We collect personal data only when you provide it directly or when it is generated through your use of the website:

Information you provide:

• Full name and email address when submitting an enquiry form
• Phone number, if you choose to provide it
• Message content submitted through the contact form
• Payment information processed through our payment provider (we do not store card data directly)

Automatically collected data:

• IP address, browser type, and device information
• Pages visited and time spent on each page
• Referring website URL
• Cookie identifiers (see Section 6 and our Cookie Policy)

Legal basis for processing (under PDPA):

• Consent — for marketing communications and non-essential cookies
• Contract — for processing enrolment and order fulfilment
• Legitimate interest — for website analytics and security monitoring
• Legal obligation — where required by Thai law

§ 03 — How We Use Your Data

Purpose of Processing

• To respond to enquiries and process enrolment or order requests
• To deliver course access, workshop logistics, and toolkit shipment information
• To send transactional emails related to your order or registration
• To send marketing communications, only where you have opted in
• To improve website content and user experience using aggregated analytics
• To comply with legal and regulatory obligations under Thai law

We do not sell your personal data to third parties. We do not use personal data to make automated decisions that significantly affect you.

Data Retention

Enquiry records are retained for 24 months. Enrolment and order records are retained for five years from the date of transaction for accounting and legal purposes. Analytics data is retained in aggregated form for up to 26 months.

§ 04 — Sharing and Third Parties

Who We Share Data With

We share personal data only where necessary to deliver our services or comply with legal obligations:

• Payment processors — to handle secure payment transactions (data transferred under standard contractual protections)
• Shipping and logistics providers — for toolkit and printed material delivery, limited to name and address only
• Website analytics providers — aggregated, anonymised usage data only
• Legal authorities — where required by applicable Thai law or court order

All third-party providers are contractually required to handle personal data in accordance with applicable data protection law.

§ 05 — Security Measures

How We Protect Your Data

• HTTPS encryption for all data transmitted through this website
• Access to personal data restricted to team members who require it for their role
• Database access protected by password authentication and access logging
• Regular reviews of data access permissions
• In the event of a data breach that is likely to affect your rights, we will notify you and, where required, the relevant Thai supervisory authority within the timeframes set by the PDPA

§ 06 — Cookies

Cookies We Use

This website uses cookies for essential functionality, analytics, and preference storage. Essential cookies cannot be disabled. Analytics and preference cookies are used only with your consent. For full details, please read our Cookie Policy.

§ 07 — Your Rights

Rights Under Thai PDPA

As a data subject under Thailand's PDPA, you have the following rights regarding your personal data:

• Right to access — request a copy of personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of data where no longer necessary or where consent is withdrawn
• Right to data portability — request personal data in a machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — at any time, for processing based on consent, without affecting prior processing
• Right to lodge a complaint — with the Office of the Personal Data Protection Committee (PDPC) of Thailand

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

§ 08 — External Links

Links to Other Websites

This website may contain links to external resources or regulatory bodies. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any external sites you visit.

§ 09 — Children's Privacy

Age Restrictions

Pensara's services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that personal data from a minor has been submitted, it will be deleted promptly.

§ 10 — Policy Updates

Changes to This Policy

We may update this Privacy Policy from time to time. When changes are significant, we will post a notice on this page with the revised effective date. Continued use of our services after a policy update constitutes acceptance of the revised terms.