Privacy Notice
EPICIA respects your privacy and processes personal data in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and other applicable requirements.
1. Who is responsible for your data
“EPICIA” and “EPICIA Group” are brand references used on this website for businesses operated by two separate Thai legal entities: EPICIA Consulting Co., Ltd. and EPICIA Specialty Co., Ltd.
For an enquiry relating to Consulting, EPICIA Consulting Co., Ltd. is the relevant Data Controller. For an enquiry relating to Specialty, EPICIA Specialty Co., Ltd. is the relevant Data Controller. For a general enquiry, EPICIA Consulting Co., Ltd. is the initial Data Controller and recipient and may refer the enquiry to EPICIA Specialty Co., Ltd. where appropriate to respond to the subject matter.
Privacy contact: privacy@epiciagroup.com
Business location: Bangkok, Thailand.
2. Personal data we collect
We collect information you provide through the contact form: your name, business email, company (if provided), area of interest and message/enquiry content. We may also receive limited technical and security information generated through the normal operation of the website and form, such as information reasonably necessary to deliver the site, protect it against abuse and maintain service security.
We do not request a telephone number or file upload through the website contact form. Please do not submit sensitive personal data or information that is not necessary for your enquiry.
3. How we collect personal data
We collect personal data primarily from you when you submit the website contact form or correspond with us by business email. Limited technical/security information may be generated automatically through the operation of the website and its service providers.
4. Why we use personal data and our lawful bases
We process personal data to respond to and manage enquiries; understand the services or business matter you are contacting us about; communicate about potential Consulting or Specialty engagements; prepare or discuss proposals or requested next steps; maintain appropriate business correspondence and records; secure the website and prevent misuse; establish, exercise or defend legal claims where necessary; and comply with applicable legal obligations.
Depending on the activity, processing may rely on steps taken at your request before entering into a contract or contractual necessity, legitimate interests in reasonable business communications and security, compliance with legal obligations, or consent where consent is specifically required.
The privacy acknowledgement on the contact form confirms that you have been informed of this Privacy Notice. It is not blanket consent for marketing. We do not use contact-form information for newsletters or promotional email marketing without an appropriate separate basis or opt-in where required.
5. Who may receive your data
Personal data is accessible only to the relevant EPICIA entity and personnel who reasonably need it for the purposes described above. We also use service providers supporting website hosting, form processing, business email, security and related technical operations. These providers may process data on our behalf subject to their applicable service arrangements. We may disclose information where required by law, lawful authority, or where reasonably necessary to establish, exercise or defend legal rights.
6. International processing and transfers
Some service providers may process or store information outside Thailand as part of their global infrastructure. Where personal data is transferred internationally, EPICIA will handle the transfer in accordance with the PDPA and other applicable data-protection requirements, taking into account the circumstances and safeguards applicable to the relevant service or transfer.
7. How long we keep data
We retain personal data only for as long as reasonably necessary for the purposes described in this Notice. The retention period is determined by criteria including the status and duration of the enquiry or business relationship, the need to maintain appropriate business records, applicable contractual, accounting or legal requirements, limitation periods for potential claims, security needs and the need to resolve disputes. When personal data is no longer reasonably required, we will delete, destroy or anonymise it as appropriate, subject to applicable law.
8. Security
We use reasonable organisational and technical measures appropriate to the nature of the information and our operations to protect personal data against unauthorised or unlawful access, use, alteration, disclosure, loss or destruction. No internet transmission or storage system can be guaranteed to be completely secure.
9. Your rights
Subject to the PDPA, applicable conditions and exceptions, you may have rights to request access to and a copy of your personal data; rectification; erasure or destruction; restriction of use; objection to certain processing; data portability where applicable; withdrawal of consent where processing relies on consent; and the right to lodge a complaint with the competent supervisory authority.
To exercise a right, email privacy@epiciagroup.com and describe your request. We may ask for information reasonably necessary to verify your identity and protect personal data. We will handle valid requests without undue delay and within the period required by applicable law.
10. Changes to this Notice
We may update this Privacy Notice when our services, website technologies or legal requirements change. The current version published on this website applies from its stated effective date.