ประกาศความเป็นส่วนตัวPrivacy Notice

This notice explains what happens to your personal data when you visit this website or contact us through it. It covers the website only.

If you become a client, we will give you a separate notice covering the personal data we handle during the engagement, alongside your engagement letter — which we always send you to review before any work begins.

Data controller and how to contact us

The data controller for this website is Atlas Audit and Advisory Co., Ltd., 1 Empire Tower, 47th Floor, Unit 4703, South Sathorn Road, Yannawa, Sathorn, Bangkok 10120, Thailand.

• Email support@atlasaudit.co.th
• Tel +66 2 119 8483
• LINE @821orlzd

If you have a question about this notice, or want to exercise your rights under the Personal Data Protection Act B.E. 2562 (2019), please contact us at support@atlasaudit.co.th

What we collect, and whether you have to give it

Almost everything we hold comes from the contact form, which you fill in yourself. This website runs no analytics and does not track how you use it. Our fonts, images and scripts all sit on our own server, so opening a page and reading it sends your data to no outside company other than our hosting provider, which stores this page and may keep access logs including your IP address — and nothing is sent to Google or anyone else unless you scroll down far enough for the map in our contact section to appear. Both are explained under “Who else sees your data”.

What you type into the form

• Name (required)
• Email (required)
• Phone (optional)
• Service needed (optional)
• Message — free text you write yourself (optional)

When your browser sends the form, the form provider also receives your IP address, browser type, and the date and time you sent it. An IP address is personal data under the definition in Section 6. Our form does not ask for your ID card number, passport number, or any financial details.

No law requires you to fill in this form; giving us your data is entirely voluntary. But without your name and email we cannot reply to you or prepare a proposal. The optional fields you can simply leave blank, and you are always welcome to call us or use LINE instead.

What we use it for, and on what legal basis

• Replying to you and preparing the proposal or quotation you asked for — necessary for steps taken at your request before entering a contract (Section 24(3))
• Keeping a record of the enquiry, and keeping spam out of our inbox — legitimate interest (Section 24(5))
• Keeping the website running and secure — the hosting provider's access logs, which include your IP address; legitimate interest (Section 24(5))

We do not use your data for marketing, we send no newsletter, we do not profile you, and we do not sell or trade your data with anyone.

We do not ask for your consent for this form, and we do not need to: filling in a form to ask us to get back to you is itself your request, made before any contract exists.

How long we keep it

The email we receive from the form sits in our mailbox. If you do not go on to become a client, we keep it for no more than 1 year from our last contact with you, then delete it. You can ask us to delete it sooner at any time by emailing support@atlasaudit.co.th

If you do become a client, your first enquiry becomes part of the engagement file and is kept for the period set out in your engagement letter, and for as long as the law and professional standards require an auditor to retain records.

The same data also sits in Netlify's form system. Netlify does not publish how long it retains form submissions, so we will not guess that period on its behalf. If you ask us to delete your data, we will delete your email from our mailbox and delete your submission from our Netlify forms dashboard, and confirm back to you.

Who else sees your data

We have no group companies and belong to no firm network. Your data is not passed to any other firm.

Contact form — Netlify, Inc. (United States)

When you press send, your data goes to Netlify, which receives it and relays it as an email to our mailbox. Netlify therefore receives everything you typed, along with your IP address and the date and time you sent it.

Netlify is our data processor. We have put in place a Data Processing Agreement with Netlify, of the kind Section 40 of the Personal Data Protection Act B.E. 2562 requires a controller to have. Under it, Netlify may process the data only on our instructions, may not use it for its own marketing or commercial purposes, must maintain appropriate security measures, and must notify us of a confirmed personal data breach within 48 hours. (Netlify's Data Processing Agreement)

Map — Google

Our contact section has an embedded Google map. It loads by itself, with no click from you, once you scroll down far enough for the map to appear on your screen. The “Show map” button is only a fallback in case the map does not load by itself.

Simply opening a page and reading it does not load the map, and neither does pressing “Request a proposal” — the map sits well below that point, and only loads once you scroll to the bottom of the contact section. If you never scroll that far, nothing at all is sent to Google.

Once it loads, Google receives your IP address, browser and device information, the date and time, and the address (URL) of the page you are on, and may store Google's own cookies on your device. If you do not want Google to receive this, you can choose not to scroll down to the map, or disable JavaScript and reach us by phone or email instead. (Google's privacy policy)

Hosting provider — Netlify, Inc. (United States)

This website is published through Netlify, a website-infrastructure and content delivery network (CDN) provider. When you open a page, your browser connects to whichever Netlify server is nearest to you, automatically. We therefore cannot say in advance which country any individual visit is served from.

Netlify keeps ordinary server access logs, which include your IP address, to the extent needed to deliver the page and keep the service secure. We do not access those logs, and we do not use them to analyse visitor behaviour.

Netlify does not publish how long it retains those logs. We have asked them in writing, and we will update this notice with the period as soon as they reply. In the meantime we will not guess a period on their behalf. (Netlify's privacy policy)

LINE account

The site only links to our LINE account. Viewing a page sends nothing to LINE until you press that link yourself. If you message us there, your use of LINE is governed by LY Corporation (Japan), and we, as the account operator, receive your internal account identifier, your language setting, and whatever you send us. (LINE's privacy policy)

Other cases

We may disclose your data to government bodies or regulators where the law requires — for example the Federation of Accounting Professions, the Revenue Department, or a court — and to our own legal advisers where necessary.

Cookies and what is stored on your device

We store no cookies of our own on your device. This website has no analytics, no advertising cookie, and no tracking of how you use it. The one exception is Google's map in our contact section, which loads by itself once you scroll down to it, and once it does, Google may store Google's own cookies on your device. Those cookies are Google's, not ours, and we cannot read them. We show no cookie consent banner.

The only thing the site stores on your browser is the language you chose, saved as atlas-lang, whose value can only ever be th or en. It exists so the site opens in your language next time. We never receive it, it is never sent to anyone, and it cannot identify you. You can delete it yourself in your browser settings.

Cross-border transfer of personal data

So far as this website is concerned, your data can leave Thailand in the following ways: every time you open a page (this site is published through Netlify, Inc. in the United States, which operates servers in several countries), when you submit the contact form (to Netlify in the United States), and when the map loads (to Google in the United States). Separately, if you choose to contact us on LINE, that conversation sits with LY Corporation in Japan.

For the form, we rely on the exception in Section 28(3): the transfer is necessary for steps taken at your own request before entering a contract. You filled in the form to ask us to get back to you, and sending it through a form provider is part of doing what you asked.

For the map, we do not claim Section 28(3): loading the map is not a step taken at your request — it loads by itself, without you pressing anything. We disclose it here as it is, together with the ways to avoid it set out under “Who else sees your data”.

For the hosting of this website, we are not the ones sending your data anywhere. When you open a page, your browser connects to Netlify's servers directly, so your IP address is recorded at that end — it does not pass through us first. We set it out here so you know.

To be straight about one thing: the Personal Data Protection Committee has not published a list of countries with an adequate data protection standard, so there has been no determination either way about the United States. We therefore do not claim that the United States offers adequate protection.

Security, and what not to send through the form

The contact form is submitted over an encrypted connection (HTTPS), and this website is served over HTTPS. The emails from the form are read only by the engagement partner and the staff who need them to reply to you. Beyond our duties under the personal data protection law, we are already bound by the confidentiality obligations of the accounting profession's code of ethics.

The message box is free text — you can type anything into it. Please use it for first contact only. Please do not send financial statements, tax documents, ID numbers, or data about your employees, directors or shareholders through it: those are business confidences that belong in a more suitable channel.

Please also do not send sensitive personal data under Section 26, such as health information or criminal records — we do not ask for any of it, and we do not need it to prepare a proposal for you. For the same reason, please do not send these documents over LINE. Once we are talking, we will point you to a suitable channel for documents.

Your rights, and complaints

As a data subject you have the following rights:

• To access and obtain a copy of your data, or to ask how we obtained data you did not consent to give (Section 30)
• To receive your data in a machine-readable form and have it sent to another data controller (Section 31) — this applies to the data you typed into the form yourself
• To object to our collection, use or disclosure of your data (Section 32) — you can tell us to stop keeping the record of your enquiry, even after we have replied to you
• To have your data erased or destroyed, or made non-identifying (Section 33)
• To ask us to suspend use of your data (Section 34)
• To have your data corrected so it is accurate, current, complete and not misleading (Section 36)
• To withdraw consent at any time (Section 19, paragraph 5) — we never asked for your consent, so this one does not apply to this form. The law requires us to list it.
• To lodge a complaint with the Expert Committee (Section 73)

To exercise them, email support@atlasaudit.co.th. We will respond within 30 days.

If you believe that we, or the providers who process data on our behalf, are not complying with the personal data protection law, you can complain to the Expert Committee straight away without telling us first, by submitting it through the Office of the Personal Data Protection Committee at pdpc.or.th. But if you tell us first, we will have the chance to put it right for you quickly.

Changes to this notice

If we make a material change to this notice, we will publish the new version on this page. The version you see here is the one in force.

This notice is published in Thai and English. If the two texts conflict, the Thai text prevails.