Privacy Policy

1. Introduction and Scope

TMES Company Limited ("TMES", "we", "us", or "our") is committed to protecting the privacy, confidentiality and integrity of personal information in accordance with the Personal Data Protection Act B.E. 2562 (PDPA), ISO/IEC 27701:2019 (Privacy Information Management System), and ISO/IEC 27001:2022 (Information Security Management System).

This Privacy Policy is our notice to you under section 23 of the PDPA. It applies to all personal information processed by TMES in the course of our business activities, including:

• Client and prospect data collected during sales, pre-sales, and service delivery
• Employee, contractor, and candidate personal information
• Supplier and business partner contact information
• Website visitor and enquiry data collected via tmes.co.th (described in detail in Section 4)
• Personal information processed on behalf of clients as a data processor

TMES acts as a Data Controller for information collected for our own business purposes, including everything collected through tmes.co.th, and as a Data Processor when handling personal data on behalf of our clients. Where TMES acts as a processor, data handling is governed by contractual Data Processing Agreements, and the client's own privacy notice applies.

2. Identity of the Data Controller

Data Controller:
TMES Company Limited
43 Thai CC Tower, 22nd Floor, Unit A228-A229
South Sathon Road, Yannawa, Sathon, Bangkok 10120
Thailand

Data Protection Officer (DPO):
Email: dpo@tmes.co.th
Phone: +66 (0) 92 462 9779

We have appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data protection laws. You may contact the DPO directly for any privacy-related matters.

3. Personal Information We Collect

We collect and process the following categories of personal information, depending on the nature of our relationship with you:

Identity and Contact Data: Full name, job title, company name, business email address, telephone number, postal address.

Commercial and Transactional Data: Purchase history, service agreements, invoices, enquiry records, proposals, and correspondence.

Technical and Usage Data: IP address, browser type and version, device identifiers, pages visited, time and date of access, and referral sources when you interact with our website or digital platforms.

Employment and Recruitment Data: Curriculum vitae (CV), educational and professional credentials, employment history, identification documents, and references (collected from candidates and employees).

Sensitive Personal Data: Where required and with your explicit consent (or as permitted by law), we may process sensitive data such as national identification numbers or health-related information for employment purposes. Our website does not ask for sensitive personal data; please do not include it in a message or a form.

We collect personal information directly from you (e.g., via forms on our website, contracts, or job applications), from your employer or colleagues, from publicly available business sources, and — in limited cases — from third-party partners where permitted.

4. Information Collected Through Our Website

This section explains what tmes.co.th collects, why, on what legal basis and for how long. Each form asks only for what it needs.

Contact form: your name, company, business email, phone number, the topics you are interested in and your message. We use it to reply to you and to follow your enquiry up as a sales enquiry. Legal basis: your consent, given with the tick box on the form, and steps you ask us to take before a possible contract. Kept for 36 months after the last activity on the enquiry; your name, company, email, phone and message are then removed.

Newsletter (TMES Insights): your email address and, if you give it, your name. We send articles and news only after you confirm your address from the email we send you. Legal basis: consent. Every email has an unsubscribe link. A sign-up that is not confirmed is deleted after 30 days; after you unsubscribe, your address is deleted within one month.

Certificate and company profile downloads: your email address and the network (IP) address of the request. We use them to email you the download link and to know who asked for our documents. Legal basis: your consent and our legitimate interest in knowing who receives our documents. Kept for 36 months, then deleted.

Privacy requests (the form under "Cookie settings" at the bottom of every page, or an email to our DPO): your email address, your name if you give it, and what you ask us to do. Legal basis: our legal obligation to answer you under the PDPA. Your name, email and the details of the request are removed 2 years after the request is closed.

Live chat: when live chat is offered on the site, the messages you type and any name or email you give are handled by our chat provider, Crisp, and read by our team to answer you. Legal basis: steps you ask us to take, and our legitimate interest in answering questions.

Emails the website sends: we keep a record of each email (recipient, subject and whether it was delivered) for 12 months, to show that it was sent and to find delivery problems.

Security of the website: our servers record each request (network address, the page asked for and the time) to keep the site secure and working. The contact and newsletter forms are protected by Google reCAPTCHA, and the number of times a form can be sent from one network address is limited. Legal basis: legitimate interests.

Staff area: the Backstage area of the website is for authorised TMES staff only. For staff we keep their account, sign-in records for 90 days and an audit log of administrative actions for at least 12 months.

The website and its database run in the Amazon Web Services Asia Pacific (Bangkok) region. Names, email addresses, phone numbers and messages are encrypted in the database; staff see them masked unless their role needs the full value, and each time full values are shown or exported, it is recorded.

5. Purposes and Lawful Bases for Processing

We process your personal information only where we have a valid lawful basis. Our key processing purposes are:

Service Delivery: Providing, managing, and supporting the technology solutions and services you have contracted with us. Lawful basis: Performance of a contract.

Client Relationship Management: Managing client accounts, communications, and renewals. Lawful basis: Legitimate interests / performance of a contract.

Enquiries: Answering the questions you send us and following them up. Lawful basis: Consent / steps taken at your request before entering into a contract.

Sales and Marketing: Sending relevant information about our solutions, events, and industry insights. Lawful basis: Consent (the newsletter and marketing cookies) / legitimate interests (business contacts we already work with, who may object at any time).

Website and Platform Operation: Maintaining website functionality and security, and preventing spam and abuse. Lawful basis: Legitimate interests. Analytics and advertising cookies: consent (Section 12).

Recruitment and Employment: Processing job applications and managing employment relationships. Lawful basis: Pre-contractual measures / performance of a contract / legal obligation.

Legal and Regulatory Compliance: Meeting obligations under applicable Thai law and international standards, including answering privacy requests. Lawful basis: Legal obligation.

Information Security: Protecting systems and data from unauthorised access, consistent with our ISO 27001 ISMS. Lawful basis: Legitimate interests / legal obligation.

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

If you do not give us information: giving us personal information is not a legal requirement. The contact form needs your name, company, email and phone so that we can reply; without them we cannot answer through the form, but you can still call or email us. Where information is needed to enter into or perform a contract, we may not be able to provide the service without it.

Automated decisions: we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. If you accept marketing cookies, Meta and LinkedIn may group visitors into advertising audiences (Section 12).

6. How We Use and Share Your Personal Information

We use personal information only for the purposes described in Sections 4 and 5. We do not sell, rent, or trade personal information to third parties for their own marketing purposes.

We may share personal information with:

• Service Providers and Sub-processors: Technology partners, cloud infrastructure providers (e.g., AWS, Alibaba Cloud), email services, and other vendors who process data on our behalf under contractual Data Processing Agreements that ensure equivalent protection.

• Business Partners: Where necessary to deliver contracted services, with appropriate data sharing agreements in place.

• Professional Advisors: Lawyers, auditors, and insurers, subject to professional confidentiality obligations.

• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or to protect the rights and safety of individuals.

• Corporate Transactions: In the event of a merger, acquisition, or business transfer, personal information may be transferred to the relevant parties subject to appropriate safeguards.

The services our website uses are:

• Amazon Web Services: runs the website and its database in the AWS Asia Pacific (Bangkok) region; its network (CloudFront) delivers our public pages and pictures from locations around the world.
• Resend (United States): sends the website's emails, such as enquiry notices to our team, newsletters, download links and replies to privacy requests.
• Google (United States): Google Analytics and Google Tag Manager (with your consent), reCAPTCHA (security of our forms), and Google Maps on our contact page (only if you choose to show the map).
• Meta Platforms (United States) and LinkedIn (United States): measuring our advertising, only if you accept marketing cookies.
• Crisp (France): live chat, when it is offered.
• Microsoft: sign-in of TMES staff to the Backstage area.

All third parties with whom we share personal information are required to maintain appropriate technical and organisational security measures consistent with our information security standards.

7. International Data Transfers

TMES operates across Southeast Asia, and personal information may be transferred to, stored in, or processed in countries outside Thailand. Through our website this happens with the services named in Section 6: Resend, Google, Meta and LinkedIn (United States), Crisp (France), and the worldwide delivery network of Amazon Web Services. The website's own database stays in Thailand.

Where such transfers occur, we rely on the grounds allowed by sections 28 and 29 of the PDPA, including:

• Transfers to countries with an adequate level of protection as recognised by applicable law.
• Use of contractual clauses that impose data protection obligations on the receiving party.
• Binding corporate rules or equivalent mechanisms where applicable.
• Transfers needed to do what you asked for, such as sending you an email, or made with your consent, such as analytics and advertising cookies.

Details of the safeguards for a particular transfer are available from our DPO upon request.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention guidelines are:

• Client and contract data: 7 years following the end of the contractual relationship (or longer if required by law).
• Marketing and enquiry records: 3 years from the date of last contact, or until consent is withdrawn.
• Website forms and records: as set out in Section 4 (enquiries 36 months, download requests 36 months, unconfirmed newsletter sign-ups 30 days, unsubscribed addresses 1 month, closed privacy requests 2 years, email records 12 months, staff sign-in records 90 days, audit log at least 12 months).
• Website and technical logs: Up to 12 months.
• Employment and recruitment data: 2 years for unsuccessful candidates; duration of employment plus 7 years for employees, or as required by Thai labour law.
• Financial and accounting records: As required under the Thai Revenue Code and related regulations (generally 5–7 years).

A record of the consent you gave (what you agreed to, which version of this notice and when) is kept for as long as we need to show that we had your consent, including after you withdraw it. It holds a one-way code made from your email address, not the address itself. Backup copies are overwritten on their own schedule.

When personal information is no longer required, it is securely deleted or anonymised in accordance with our data disposal procedures.

9. Information Security

TMES maintains an Information Security Management System (ISMS) certified to ISO/IEC 27001:2022 and a Privacy Information Management System (PIMS) aligned to ISO/IEC 27701:2019. Our security measures include:

• Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA), and the principle of least privilege across all systems handling personal information.

• Encryption: Encryption of personal data in transit (TLS 1.2 or higher) and at rest where technically feasible. On our website, names, email addresses, phone numbers and messages are also encrypted field by field in the database.

• Logging: Every time a staff member shows or exports full personal details from the website, it is recorded in an audit log that cannot be changed.

• Vulnerability Management: Regular vulnerability assessments, penetration testing, and patch management processes.

• Physical Security: Physical access controls to offices and data centre facilities, including CCTV, badge access, and visitor management.

• Employee Awareness: Mandatory annual information security and privacy training for all personnel with access to personal information.

• Incident Response: A formal Information Security Incident Management procedure aligned to ISO 27001 Annex A, with defined response timelines.

• Supplier Security: Due diligence and contractual security requirements for all third parties processing personal information on our behalf.

No system is completely secure. However, we continually review and improve our controls to protect the personal information entrusted to us.

10. Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, TMES will:

• Notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware, where required under the PDPA.
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, together with the remedies we are taking.
• Maintain records of all personal data breaches and the actions taken in response.

If you believe your personal information held by TMES has been compromised, please contact our DPO immediately at dpo@tmes.co.th.

11. Your Rights as a Data Subject

Under the PDPA and applicable privacy laws, you have the following rights with respect to your personal information:

Right of Access: To request access to and a copy of your personal information, and to ask how we obtained information you did not give us.

Right to Rectification: To request correction of inaccurate, incomplete or out-of-date personal information.

Right to Erasure: To request deletion, destruction or anonymisation of your personal information where processing is no longer necessary or lawful, subject to legal retention obligations.

Right to Restriction: To request that we restrict processing of your personal information in certain circumstances.

Right to Data Portability: To receive your personal information in a structured, commonly used, machine-readable format and to request transmission to another controller, where technically feasible.

Right to Object: To object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent: To withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing. You can unsubscribe from our newsletter with the link in every email, and change your cookie choices at any time under "Cookie settings" at the bottom of every page.

Right to Lodge a Complaint: To lodge a complaint with the Personal Data Protection Committee (PDPC) at www.pdpc.or.th if you believe your rights have been infringed.

To exercise any of these rights, please contact our DPO at dpo@tmes.co.th, or use "Request data deletion" under "Cookie settings" at the bottom of every page. There is no charge. We will respond within 30 days of receipt of your request. In some cases, we may require you to verify your identity before processing your request, and where the law allows us to refuse a request, we will tell you why.

12. Cookies and Similar Technologies

Our website uses cookies and similar technologies (small files and values stored by your browser). When you first visit, we ask for your choice; optional categories stay off until you accept them. You can change your choice at any time with "Cookie settings" at the bottom of every page.

Strictly Necessary (always on): remembering your cookie choices, the language you chose and an announcement you closed; Google reCAPTCHA, which protects our contact and newsletter forms from automated abuse; and the sign-in session of TMES staff in the Backstage area. The site cannot work properly without them.

Analytics (your choice): Google Analytics 4, loaded through Google Tag Manager, shows us which pages are visited and how visitors move through the site, so that we can improve it. Until you accept, Google Analytics runs in a mode that stores no cookies.

Marketing (your choice): the Meta Pixel and the LinkedIn Insight Tag measure our advertising and let us show TMES adverts on those platforms to people who visited our site; Google's advertising signals are also switched on. When you send one of our forms, these tools are told which kind of form was sent (for example an enquiry), never what you typed. These are loaded only after you accept marketing cookies.

Preferences (your choice): Google Maps on our contact page, and the live chat window (Crisp) when live chat is offered. Without this choice the map loads only when you press "Show Google map".

Withdrawing a choice stops these tools from being loaded again; cookies they have already set stay until they expire or you delete them in your browser settings. Refusing optional cookies does not affect the rest of the website.

13. Data Protection Impact Assessments (DPIA)

Where a processing activity is likely to result in a high risk to the rights and freedoms of individuals, TMES conducts a Data Protection Impact Assessment (DPIA) prior to commencing processing. DPIAs are required for activities such as:

• Large-scale processing of sensitive personal data.
• Systematic monitoring of individuals.
• Use of new technologies with significant privacy implications.

DPIAs are reviewed and approved by the DPO and relevant business stakeholders before implementation.

14. Children's Privacy

Our services and website are not directed at children under the age of 20 (the age of majority in Thailand) or under the applicable minimum age in other jurisdictions. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take steps to delete that information promptly. If you believe we hold personal information about a child, please contact dpo@tmes.co.th.

15. Changes to This Policy

TMES reviews this Privacy Policy at least annually, or whenever there are material changes to our processing activities or applicable law. When we make significant changes, we will update the "Last updated" date at the top of this Policy and, where appropriate, notify affected individuals by email or through prominent notice on our website. Where a change needs your consent, we will ask for it again.

Your continued engagement with TMES following notification of changes constitutes your acknowledgement of the updated Policy (to the extent permitted by law).

16. Contact and Complaints

For any questions, requests, or complaints regarding this Privacy Policy or our data handling practices, please contact:

Data Protection Officer (DPO)
TMES Company Limited
43 Thai CC Tower, 22nd Floor, Unit A228-A229
South Sathon Road, Yannawa, Sathon, Bangkok 10120
Thailand
Email: dpo@tmes.co.th
Phone: +66 (0) 92 462 9779

If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Committee (PDPC), the supervisory authority in Thailand:
Website: www.pdpc.or.th