S Sundara Contact Us
LEGAL · PRIVACY

Privacy Policy

Last updated: 14 May 2025  ·  Effective: 14 May 2025

1. Introduction

Sundara ("we", "us", "our") is a hospitality consulting practice operating from Ko Samui, Surat Thani, Thailand. We take the privacy of all individuals who interact with us seriously and are committed to handling personal information with care and transparency.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have in relation to it. It applies to information collected through our website at sundarathx.info, through contact forms, and through direct correspondence.

If you have any questions about this policy, please write to us at [email protected].

2. Personal Data We Collect

We may collect the following categories of personal data:

  • Contact details: name, email address, and telephone number when you complete an enquiry form or contact us directly.
  • Correspondence content: the content of messages you send, including descriptions of your business situation.
  • Technical data: IP address, browser type, device type, pages visited, and session duration collected automatically when you visit our website.
  • Cookie data: preferences and behaviour data collected via cookies, as described in our Cookie Policy.

We do not collect sensitive personal data such as financial account details, health information, or government-issued identification numbers through this website.

3. Legal Basis and Purpose of Processing

We process personal data on the following grounds:

  • Consent: when you submit an enquiry form or accept optional cookies, you provide consent for us to use that data for the purposes stated at the time of collection.
  • Legitimate interests: we may process technical and usage data to maintain website security, improve our service, and understand how visitors engage with our content.
  • Pre-contractual steps: when you enquire about a consulting engagement, processing your contact details is necessary to respond and to proceed if both parties wish to work together.

We use the data collected for the following purposes:

  • Responding to enquiries and scheduling introductory conversations.
  • Delivering agreed consulting services and maintaining service records.
  • Improving our website and understanding how visitors find and use it.
  • Complying with applicable legal obligations.

4. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

  • Enquiry records: up to 24 months from the date of initial contact, unless an ongoing advisory relationship requires longer retention.
  • Client engagement records: for the duration of the engagement and for up to five years thereafter for administrative and accounting purposes.
  • Technical and analytics data: typically up to 26 months in aggregated or anonymised form.
  • Cookie consent records: up to 13 months from the date of consent.

When data is no longer needed, we delete or anonymise it securely.

5. Sharing Personal Data

We do not sell personal data. We may share data in the following limited circumstances:

  • Service providers: we use third-party tools including website hosting, email services, and analytics platforms. These providers act as data processors under our instruction and are bound by appropriate agreements.
  • Analytics services: we use Google Analytics to understand website traffic. Google may process data in the United States under their standard contractual terms. You can opt out via cookie preferences.
  • Legal requirements: we may disclose data if required to do so by law, court order, or a competent regulatory authority.

All third-party processors are selected with care and are required to maintain appropriate data protection standards.

6. Data Protection Measures

We take reasonable technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, or destruction, including:

  • HTTPS encryption for all data transmitted through our website.
  • Restricted access to personal data on a need-to-know basis.
  • Regular review of systems and access controls.
  • Use of reputable, security-conscious hosting and communication services.

In the event of a data breach that poses a risk to individuals, we will take appropriate steps to contain the incident and notify relevant parties as required by applicable law.

7. Cookies

Our website uses cookies and similar tracking technologies. Essential cookies are necessary for the site to function correctly. Optional cookies — including analytics and marketing cookies — are used only with your consent.

You can review and update your cookie preferences at any time by visiting our Cookie Policy page.

8. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

  • Right of access: to request a copy of the personal data we hold about you.
  • Right to rectification: to request correction of inaccurate or incomplete data.
  • Right to erasure: to request deletion of your data where there is no compelling reason for us to continue processing it.
  • Right to restriction: to request that we limit the way we use your data while a complaint is being resolved.
  • Right to data portability: to receive a copy of your data in a structured, machine-readable format where technically feasible.
  • Right to object: to object to processing based on legitimate interests.
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We aim to respond within 30 days.

9. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before submitting any personal information.

10. Children's Privacy

Our services are directed at business owners and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe that a minor has submitted personal data through our website, please contact us so we can arrange for its deletion.

11. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Kingdom of Thailand. Data processing practices are aligned with the Thailand Personal Data Protection Act B.E. 2562 (PDPA) and, where applicable, international standards including GDPR principles.

If you believe your data protection rights have not been respected, you may contact the Office of the Personal Data Protection Committee (PDPC) in Thailand.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of the page. We encourage you to review this page periodically. Continued use of our website following any changes constitutes acceptance of the revised policy.

13. Contact

For any questions, requests, or concerns relating to this Privacy Policy or your personal data, please contact: