Privacy Policy

1. Introduction

Ravelyn is a strategic advisory firm with its principal office at 142 Sathorn Road, Khwaeng Silom, Khet Bang Rak, Bangkok 10500, Thailand. We provide strategic direction, operating model, and advisory retainer services to mid-sized companies.

We take data protection seriously. This policy sets out how we handle personal data in connection with our website and advisory activities, in a manner consistent with the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the "PDPA") and other applicable laws.

If you have questions about this policy or about how your data is handled, please contact us at [email protected] before using the site or submitting any personal information.

2. Personal data we collect

We collect personal data through the following means:

Via the contact form on this website

• Full name (required)
• Email address (required)
• Phone number (optional)
• Message content you choose to include

Automatically when you visit this site

• IP address and approximate geographic location
• Browser type and device information
• Pages visited and time spent on each page
• Referring website or search query

Legal basis for processing (under PDPA)

• Consent — where you have actively submitted a form or accepted cookie usage
• Legitimate interest — for website analytics and security monitoring
• Pre-contractual steps — where you have enquired about an engagement and we need to respond

Retention periods

• Contact form data: retained for up to 24 months from the date of submission, or for the duration of an advisory relationship, whichever is longer
• Website analytics data: retained for up to 26 months in aggregated or anonymised form
• Engagement records: retained for 7 years following the end of an engagement, as required by Thai commercial law

3. How we use personal data

Personal data collected through this website is used for the following purposes:

• To respond to enquiries submitted via the contact form
• To assess whether an advisory engagement may be appropriate
• To deliver services where an engagement has been agreed
• To send relevant updates about Ravelyn's work, where you have consented to receive them
• To understand how the website is used and to improve its content and performance
• To meet legal and regulatory obligations

We do not sell personal data to third parties. We do not use personal data for automated decision-making or profiling.

Where we use third-party service providers (such as website hosting, analytics, or email tools), those providers access data only as necessary to perform their service and are bound by appropriate data processing terms. You may contact us at [email protected] for a list of current sub-processors.

If you have subscribed to receive written updates from Ravelyn, you may unsubscribe at any time by contacting [email protected].

4. Data protection measures

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encrypted transmission of data via HTTPS/TLS
• Access to personal data limited to staff who require it for a specific purpose
• Regular review of access controls and software security
• Secure storage with reputable third-party hosting providers operating data centres in compliant jurisdictions

In the event of a data breach that is likely to affect your rights and freedoms, we will notify relevant authorities and affected individuals as required under applicable law, and without undue delay.

5. Cookies

This website uses cookies — small text files stored on your device — to support basic functionality, understand how the site is used, and (where consented) to support marketing activities.

• Essential cookies — necessary for the site to function; cannot be disabled
• Analytics cookies — help us understand visitor behaviour in aggregate; optional
• Marketing cookies — support advertising and re-engagement; optional
• Preference cookies — remember your settings between visits; optional

You can manage cookie preferences at any time via our Cookie Policy page, which includes functional controls to accept or decline optional cookie categories.

6. Your rights under the PDPA

As a data subject under Thailand's Personal Data Protection Act B.E. 2562, you have the following rights:

• Right to access — request a copy of personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data where there is no lawful basis for continued processing
• Right to restriction — request that we limit processing while a dispute is resolved
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — withdraw previously given consent at any time, without affecting the lawfulness of earlier processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.

7. Third-party links

This website may contain links to external websites operated by third parties. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any external sites you visit.

8. Children's privacy

Ravelyn's services are directed at business owners, executives, and senior decision-makers. This website is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have received data from a person under 18 without appropriate parental consent, we will delete it promptly.

9. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. The date at the top of this page indicates when it was last revised. Where changes are material, we will notify visitors via a notice on the website. Continued use of the site after an update constitutes acceptance of the revised policy.

10. Contact and data controller details

The data controller for personal data processed in connection with this website is:

For general enquiries unrelated to data protection, please use the contact form on our homepage.