Privacy Policy — Suriya Lab

1. Introduction

Suriya Lab ("we", "us", "our") takes the handling of personal data seriously. This policy describes what information we collect when you use our website or engage our services, how we use it, how we protect it, and what rights you have in relation to it.

Our services consist of professional advisory and consulting engagements for businesses. The personal data we handle relates primarily to professional contacts rather than consumers, and we keep the volume of data we collect to what is necessary for those purposes.

If you have questions about this policy, please contact us at [email protected].

2. Data We Collect and How

Information you provide directly

When you submit a contact or enquiry form on our website, we collect: your name, email address, phone number (if provided), and any information you include in the message field. We do not require sensitive personal data (such as financial information or identification documents) to make an enquiry.

Information collected automatically

When you visit our website, we may collect limited technical information — your approximate location (country or city), browser type, device type, and the pages you visit. This is done through cookies and analytics tools. See Section 6 for more detail on cookies.

Information from professional engagements

During a consulting engagement, you may share documents, internal materials, and contact details for team members. We use this only for the purpose of the engagement and handle it with appropriate care.

Legal basis for processing

Responding to enquiries: legitimate interest in responding to business communications
Service delivery: performance of a contract (or pre-contractual steps)
Analytics: consent (via cookie acceptance) or legitimate interest where data is aggregated and non-identifiable
Legal compliance: where we are required to retain certain records

Data retention

Enquiry data is retained for up to 24 months from the date of receipt if no engagement follows. Data related to completed engagements is retained for up to 5 years from project completion for legal and accounting purposes. You may request deletion at any time, subject to any retention obligations we have.

3. How We Use Your Data

Responding to your enquiry or request
Delivering the services you have engaged us for
Communicating with you about an ongoing engagement or follow-up
Sending service-related information (e.g. delivery of written outputs)
Improving the quality and relevance of our website (via aggregated analytics)
Meeting legal obligations, including financial record-keeping

We do not use your personal data for behavioural advertising, profiling for marketing purposes, or automated decision-making. We do not sell personal data to third parties.

Marketing communications

We may occasionally send relevant updates to clients who have completed engagements with us. You may opt out at any time by contacting [email protected] or using the unsubscribe link in any email we send.

4. Sharing Data with Third Parties

We share personal data only as necessary to operate our business:

Analytics providers (e.g. Google Analytics): aggregated website usage data under data processing agreements
Cloud storage and collaboration tools: used to store and share engagement documents, under appropriate security controls
Accounting and legal advisors: where required for financial and legal compliance

We do not share engagement materials or client information between clients or with any third party for commercial purposes. We require any third-party processor to maintain appropriate security standards.

5. Data Protection Measures

Data in transit is protected using TLS encryption (HTTPS)
Access to client materials is restricted to personnel involved in the relevant engagement
We use password-protected, access-controlled tools for document storage and communication
In the event of a data breach involving personal data, we will notify affected individuals and relevant authorities as required by applicable law within the timeframes required

6. Cookies

Our website uses cookies to function correctly and to understand how visitors use it. Essential cookies are required for basic site operation. Analytics and preference cookies are optional. For full details, including how to manage your preferences, please see our Cookie Policy.

7. Your Rights

Under Thai data protection legislation (the Personal Data Protection Act, B.E. 2562) and, where applicable, international data protection standards, you have the following rights:

Right of access: you may request a copy of the personal data we hold about you
Right to rectification: you may ask us to correct inaccurate or incomplete data
Right to erasure: you may ask us to delete your personal data where there is no legitimate reason for us to continue holding it
Right to restriction: you may ask us to restrict processing in certain circumstances
Right to data portability: you may ask us to provide your data in a structured, commonly used format
Right to object: you may object to processing based on legitimate interest
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Personal Data Protection Commission of Thailand.

8. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies separately.

9. Children's Privacy

Our services are directed at businesses and professional contacts. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have done so, we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. The updated version will be published on our website with a revised "Last Updated" date. Significant changes will be communicated directly to active clients where relevant.

11. Contact

Data Controller: Suriya Lab
Address: 77 Charoen Krung Road, Bang Rak, Bangkok 10500, Thailand
Email: [email protected]
Phone: +66 2 233 6014