Privacy Policy | Lumenara

1. Introduction

Lumenara ("we", "us", "our") is committed to handling your personal information with care and transparency. This Privacy Policy explains what data we collect, why we collect it, and how it is used and protected. It applies to all services offered by Lumenara and to visitors to our website.

We operate under the Thailand Personal Data Protection Act B.E. 2562 (PDPA), which came into full effect in June 2022. If you have any questions about this policy or how we handle your data, please contact us at [email protected].

2. Data We Collect

We collect personal data only when you provide it to us directly or when it arises from your use of our services. The categories of data we may collect include:

Name and contact details (email address, phone number)
Business role and organisation name (if provided)
Information shared during enquiry or contact forms
Technical data from website visits: IP address, browser type, pages visited, time on site
Cookie data, as described in our Cookie Policy

We do not collect sensitive categories of data (such as health information, political views, or financial account details) through our website or standard engagement process.

3. How We Use Your Data

The data we collect is used for the following purposes:

To respond to enquiries and arrange introductory calls or sessions
To manage and deliver engagement-related communications (scheduling, notes, summaries)
To improve the functionality and content of our website
To maintain records necessary for business operations
To comply with legal obligations under Thai law

We do not sell, rent, or trade your personal data to third parties. We do not use your data for unsolicited marketing communications.

4. Legal Basis for Processing

We process personal data on the following legal bases under the PDPA:

Consent — where you have given clear agreement, such as submitting a contact form
Contractual necessity — where processing is needed to fulfil an engagement or pre-contractual steps at your request
Legitimate interests — for website analytics and improving our services, where those interests do not override your rights
Legal obligation — where we are required to retain or process data by applicable law

5. Data Retention

We retain personal data for as long as necessary for the purpose for which it was collected, or as required by law. Enquiry data not resulting in an engagement is retained for up to 12 months. Data related to an active or completed engagement is retained for up to 5 years following the conclusion of the engagement, in line with standard business record-keeping practice.

Session notes and written materials shared within an engagement are held only by the advisor and the relevant client, and are deleted or archived securely on conclusion of the engagement.

6. Data Security

We apply reasonable technical and organisational measures to protect your personal data from unauthorised access, disclosure, or loss. Access to personal data is limited to advisors and staff who need it to fulfil their responsibilities. We use secure email and storage practices for all session-related documentation.

In the event of a data breach that is likely to result in risk to your rights, we will notify you and the relevant supervisory authority as required under the PDPA.

7. Cookies

Our website uses cookies to improve your experience and to understand how the site is used. You can manage your cookie preferences through the consent banner displayed on your first visit or through our Cookie Policy page. See our Cookie Policy for full details.

8. Third-Party Services

We may use third-party tools for analytics and website operations (such as Google Analytics). These services may set their own cookies and collect data in accordance with their own privacy policies. We do not share personally identifiable information with these providers beyond what is necessary for these tools to function.

Our website may include links to external sites. We are not responsible for the privacy practices of those sites.

9. Your Rights Under the PDPA

Under the Thailand Personal Data Protection Act, you have the following rights regarding your personal data:

Right to access — to request a copy of the personal data we hold about you
Right to rectification — to request correction of inaccurate data
Right to erasure — to request deletion of your data where there is no legal basis for continued retention
Right to restriction — to request that we limit how we process your data in certain circumstances
Right to data portability — to receive your data in a structured, commonly used format
Right to object — to object to processing based on legitimate interests
Right to withdraw consent — where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that a minor has submitted personal information, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Significant changes will be communicated clearly on our website. Continued use of our services after a policy update constitutes acceptance of the revised terms.

12. Contact

For privacy-related enquiries, to exercise your rights, or to raise a concern, please contact:

Email: [email protected]
Address: 19 Sathorn Nuea Road, Silom, Bang Rak, Bangkok 10500, Thailand
Phone: +66 2 235 6740

You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand if you believe your data has been handled unlawfully.