Privacy Policy

1. Introduction

Orbyn ("we", "us", "our") is committed to handling personal data with care and transparency. This policy explains what data we collect, why we collect it, how we use it, and what rights you have in relation to it. Orbyn operates from Bangkok, Thailand and is subject to the Personal Data Protection Act B.E. 2562 (PDPA) of Thailand. This policy applies to data collected through our website and through our consulting engagement processes.

2. Data We Collect

We may collect the following categories of personal data:

• Contact information: full name, email address, telephone number
• Professional information: organisation name, role, and relevant business context shared during enquiry or engagement
• Communication records: messages sent through our contact form or by email
• Website usage data: pages visited, referral sources, browser type (via analytics cookies, where consented)

We collect personal data directly from you — through our contact form, email enquiries, or during an advisory engagement.

3. Legal Basis for Processing

• Consent: for analytics cookies and marketing communications
• Contractual necessity: for processing enquiries and managing consulting engagements
• Legitimate interests: for improving our services and maintaining business records
• Legal obligation: where required to retain records under Thai law

4. How We Use Your Data

• Responding to enquiries submitted through our contact form or by email
• Managing and conducting consulting engagements
• Maintaining records of client relationships for legal and operational purposes
• Improving our website and service quality based on usage analytics (where consented)
• Complying with applicable Thai legal and regulatory obligations

We do not use your personal data for unsolicited marketing without your express consent, and we do not sell or share personal data with third parties for commercial purposes.

5. Data Retention

Contact enquiry data is retained for up to 24 months from the date of last contact. Data related to consulting engagements is retained for seven years from the close of the engagement, in line with standard Thai commercial record-keeping requirements. Analytics data is retained in aggregate form and subject to the retention policies of the analytics provider.

6. Data Sharing

We do not sell personal data. We may share data with trusted service providers who assist our operations (such as hosting, email, and analytics services) under contractual data processing arrangements. We may also disclose data if required by Thai law, a court order, or a government authority.

7. Cookies

Our website uses cookies. Essential cookies are required for basic site functionality and cannot be disabled. Optional analytics cookies are used only with your consent. For full details on cookies used, see our Cookie Policy.

8. Data Security

We maintain appropriate technical and organisational security measures to protect personal data from unauthorised access, disclosure, or loss. These include encrypted data transmission, access controls, and secure document handling within our practice. In the event of a personal data breach, we will notify affected individuals and the Personal Data Protection Committee (PDPC) of Thailand as required under PDPA obligations.

9. Your Rights Under PDPA

Under Thailand's Personal Data Protection Act, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data (subject to legal retention obligations)
• Object to or restrict certain processing activities
• Request data portability where technically feasible
• Withdraw consent at any time (without affecting the lawfulness of prior processing)
• Lodge a complaint with the Personal Data Protection Committee of Thailand

To exercise any of these rights, contact us at privacy@{{DOMAIN_NAME}}. We will respond within 30 days.

10. Third-Party Links

Our website may contain links to external resources. We are not responsible for the privacy practices of other websites and recommend reviewing their privacy policies separately.

11. Children's Privacy

Our services are directed at businesses and their representatives. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently received data from a minor, please contact us immediately so we can remove it.

12. Policy Updates

We may update this policy from time to time. The most current version will always be available on this page, with the date of last update shown at the top. Material changes will be communicated by notice on our website.

13. Contact

For privacy-related enquiries or to exercise your rights, contact us at: