Privacy Policy

1. Introduction

Stonecourt ("we", "us", "our") is committed to handling the personal data of clients, prospective clients, and website visitors with care and discretion. This Privacy Policy describes what personal data we collect, how we use it, how long we retain it, and what rights you have in relation to it.

This policy applies to all personal data collected through our website at stonecou.club, through enquiry forms, email correspondence, and in the course of delivering consulting engagements. It should be read alongside our Terms & Conditions and Cookie Policy.

Stonecourt operates under Thai law and handles personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and, where applicable, the General Data Protection Regulation (GDPR) for data subjects in the European Union.

2. Personal Data We Collect

We collect the following categories of personal data:

• Contact information: Name, email address, and phone number provided through our website enquiry form or direct email correspondence.
• Organisation details: Company name, role, and industry mentioned in initial enquiries or during engagement scoping.
• Engagement materials: Notes, documents, and discussion summaries produced during consulting sessions. These are subject to separate confidentiality terms.
• Technical data: IP address, browser type, and basic usage data collected through cookies and analytics tools. See our Cookie Policy for details.

We do not collect sensitive personal data (such as health, financial, or biometric data) unless explicitly required for a specific engagement and agreed in writing.

Legal basis for processing: We process personal data on the basis of (a) your consent, given when you submit an enquiry form or communicate with us; (b) the performance of a contract, when data is necessary to deliver an agreed engagement; and (c) our legitimate interests, including maintaining business records and improving our services.

Retention: Contact enquiry data is retained for 24 months from last contact. Engagement documentation is retained for 36 months unless a shorter period is agreed. Technical and analytics data is retained for 12 months.

3. How We Use Personal Data

Personal data collected through our website and correspondence is used exclusively for the following purposes:

• Responding to enquiries and assessing whether an engagement is appropriate
• Delivering scoping calls and agreed consulting sessions
• Sending documents, summaries, and other outputs related to an active engagement
• Invoicing and maintaining financial records as required by Thai law
• Improving our website based on anonymised usage data

We do not use personal data for unsolicited marketing. We do not sell, rent, or share personal data with third parties for their own commercial purposes. We may share limited data with trusted service providers (such as cloud storage or email services) solely for the purpose of delivering our services, under appropriate data processing agreements.

4. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, or loss. These include:

• Encrypted storage and transmission (TLS/HTTPS for web communications)
• Access limited to staff who require it to perform their role
• Regular review of data holdings and deletion of data no longer required

In the event of a personal data breach that poses a risk to your rights or freedoms, we will notify the relevant supervisory authority and, where required, affected individuals within the timeframes specified by applicable law.

5. Cookies

Our website uses cookies to maintain basic functionality and to understand how visitors use the site. We do not use tracking or advertising cookies without your consent. Full details of the cookies we use and how to manage them are set out in our Cookie Policy.

6. Your Rights

Under the Thai PDPA and, where applicable, the GDPR, you have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data, subject to our legal obligations.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on our legitimate interests.
• Right to withdraw consent: Withdraw any consent you have given at any time, without affecting the lawfulness of processing based on consent before withdrawal.
• Right to lodge a complaint: Lodge a complaint with the Office of the Personal Data Protection Committee (Thailand) or your national supervisory authority if you believe your rights have not been respected.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend reviewing their privacy policies before submitting any personal data.

8. Children's Privacy

Our services are directed at businesses and professional individuals aged 18 and over. We do not knowingly collect personal data from persons under 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will post a notice on our website. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our website after an update constitutes acceptance of the revised policy.