Privacy Policy

1. Introduction

Velora Co., Ltd. ("Velora", "we", "us", "our") operates as an organisational design and people advisory firm at 55/2 Wireless Road, Lumphini, Bangkok 10330, Thailand. We act as the data controller for personal information collected through this website and through our service engagements.

This Privacy Policy applies to all personal data we collect from visitors to our website, enquirers, and clients. It does not apply to third-party websites that may be linked from our pages.

By interacting with our website or services, you acknowledge that you have read and understood this policy. If you have questions, please contact us at [email protected] before proceeding.

2. Data We Collect

Information you provide directly

• Contact details — name, email address, telephone number submitted via our enquiry form.
• Enquiry content — the message or subject you choose to share when reaching out.
• Engagement data — information exchanged during service delivery, including workshop notes, role maps, and advisory correspondence.

Information collected automatically

• Usage data — pages visited, time on site, referral source, and browser type, gathered through analytics cookies.
• Device data — IP address, operating system, and screen resolution for compatibility purposes.
• Cookie data — see Section 5 for full details.

Legal basis for processing

• Consent — when you submit a form or accept optional cookies, you give explicit consent under PDPA Section 19.
• Legitimate interest — we process usage analytics to improve the site experience without intruding on your privacy.
• Contractual necessity — when a service engagement is agreed, processing your contact and project data is required to deliver that service.

Retention periods

• Enquiry form submissions: 24 months from date of submission.
• Client engagement records: 5 years from project completion, in line with standard business record-keeping practice.
• Analytics data: 26 months (Google Analytics default).
• Cookie consent records: 12 months.

3. How We Use Your Data

Service delivery

We use your contact details to respond to enquiries, schedule sessions, and deliver the advisory or workshop service you have engaged us for. Without this, we cannot provide a service.

Communication

We may send you follow-up notes, session summaries, or check-in messages related to an active engagement. We do not send unsolicited marketing emails. If you wish to receive our occasional newsletter, you may opt in separately.

Website improvement

Anonymised analytics data helps us understand which information is most useful to visitors so we can improve page content and navigation.

Legal compliance

We may retain or disclose data where required by Thai law, a court order, or a regulatory authority.

Data sharing

We do not sell personal data. We may share data with:

• Service providers — hosting, analytics, and email infrastructure partners who process data only on our instruction under data processing agreements.
• Professional advisors — accountants or legal advisors where strictly necessary and under confidentiality obligations.
• Authorities — where disclosure is required by law.

4. Data Protection Measures

Technical safeguards

• All data transmitted to and from this website is encrypted using TLS (HTTPS).
• Access to personal data is restricted to authorised Velora personnel who need it to perform their role.
• Our hosting infrastructure is maintained with current security patches and monitored for unusual access.

Organisational safeguards

• Staff handling personal data receive regular guidance on data protection responsibilities.
• Third-party service providers are selected and monitored to ensure adequate security practices.
• We review our data handling practices periodically to ensure they remain appropriate.

Breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected individuals without undue delay, in accordance with the PDPA.

5. Cookies

We use cookies and similar technologies on this website. Cookies are small text files stored on your device to help the site function and to gather usage insights.

Types of cookies we use

• Essential cookies — necessary for basic site functionality. Cannot be disabled.
• Analytics cookies — help us understand how visitors navigate the site (e.g. Google Analytics).
• Preference cookies — remember choices such as cookie consent status.
• Marketing cookies — used to deliver relevant information to interested visitors.

You can manage your cookie preferences at any time via our Cookie Policy page, which includes toggle controls for each category.

6. Your Rights

Under the Thailand Personal Data Protection Act B.E. 2562, you have the following rights regarding your personal data:

• Right to access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct inaccurate or incomplete data.
• Right to erasure — in certain circumstances, you may request deletion of your personal data.
• Right to data portability — you may request your data in a structured, commonly used format where technically feasible.
• Right to object — you may object to processing based on legitimate interest at any time.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Right to restrict processing — you may ask us to limit how we use your data in certain situations.
• Right to lodge a complaint — you may file a complaint with the Personal Data Protection Committee (PDPC) of Thailand if you believe your rights have been infringed.

To exercise any of these rights, please write to us at [email protected]. We will respond within 30 days.

7. Third-Party Links

Our website may contain links to external websites for reference purposes. We have no control over the content or privacy practices of those sites and are not responsible for their policies. We encourage you to review the privacy policy of any external site you visit.

8. Children's Privacy

Our services are intended for business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted personal data through our website, please contact us at [email protected] and we will remove it promptly.

9. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will provide a visible notice on our website. Continued use of our website following any update constitutes acceptance of the revised policy.

10. Contact Us

For privacy-related enquiries, requests to exercise your rights, or questions about this policy, please contact our data controller: