Privacy Policy

1. Introduction

Legacara Co., Ltd. ("Legacara", "we", "us", or "our") is committed to handling personal information with care and transparency. This Privacy Policy explains what personal data we collect, how we use it, how long we keep it, and what rights you have in relation to it.

This policy applies to personal data collected through our website at legacaradas.world, through our enquiry forms, and through direct communications with our team. It does not apply to third-party websites linked from our site.

Questions about this policy may be directed to [email protected].

2. Personal Data We Collect

We collect personal data in the following ways:

• Enquiry forms: Name, email address, phone number (optional), and message content when you contact us through our website.
• Programme participation: Names and contact details for programme scheduling and follow-up communications.
• Cookies and analytics: Technical data about website visits, including pages visited, browser type, and session duration. See our Cookie Policy for details.

Legal basis for processing: We process your personal data based on your consent (for marketing communications and non-essential cookies), on the performance of a contract (to deliver programmes you have enrolled in), and on our legitimate interests (for website analytics and general administration).

Retention periods: Enquiry data is retained for up to 24 months. Programme participant data is retained for up to 36 months after programme completion. Analytics data is retained as per third-party provider settings (typically 14 months for Google Analytics).

3. How We Use Your Personal Data

• To respond to enquiries and provide information about our programmes
• To schedule and deliver educational and administrative sessions
• To send follow-up communications after programmes conclude
• To improve our website and understand how visitors use it
• To meet any legal or regulatory obligations applicable in Thailand

Marketing: We do not send marketing emails without your prior consent. You may withdraw consent at any time by contacting [email protected].

4. Data Sharing

We do not sell your personal data. We may share it in limited circumstances:

• Service providers: We use Google Analytics for website analytics. Google may process data on servers outside Thailand, subject to Google's own privacy terms.
• Legal requirements: We may disclose personal data if required by Thai law or by a competent authority.

We do not share personal data with any other third parties.

5. Data Security

We take reasonable steps to protect personal data from unauthorised access, disclosure, or loss. Measures include access controls on internal systems, secure email practices, and minimal retention of personal data in physical or digital files.

If we become aware of a data breach that is likely to result in a risk to your rights or freedoms, we will notify you and the relevant authority as required under applicable Thai law.

6. Cookies

Our website uses cookies for essential functionality and optional analytics. You can manage your preferences through the cookie banner or via our Cookie Policy page.

7. Your Rights

Under Thailand's Personal Data Protection Act B.E. 2562 (PDPA), you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your data where there is no legitimate reason for us to continue holding it.
• Right to portability: Request a machine-readable copy of your data in certain circumstances.
• Right to object: Object to processing based on our legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Personal Data Protection Committee (PDPC) in Thailand.

8. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that we have collected data from someone under 18 without appropriate consent, we will delete it promptly.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any external sites you visit.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

11. Contact