Skip to main content
Office.in.th
Request a quote

This is a translation. The Thai version prevails in case of any discrepancy.

Security, PDPA & Cookie Governance

Security and Personal Data Protection

Office.in.th designs its systems on the principles of collecting only the data that is necessary, separating permissions by role, keeping usage logs that can be audited, and giving users clear control over non-essential cookies, in line with Thailand's PDPA guidelines.

HTTPS

Enforced over TLS with security headers

RBAC

Access control for Admin and the Customer Portal

PDPA

Supports requests for access, correction, deletion and withdrawal of consent

Cookie status on this website

Necessary cookies: Used for sessions, CSRF and sign-in; not used for advertising.

Analytics/marketing cookies: Off by default, and switched on only when the user gives consent.

Change your mind at any time: The “Cookie settings” button at the bottom of the website lets you change or withdraw your consent at any time.

Vulnerability protection measures

  • CSRF tokens are used on forms, and session cookies are set as HttpOnly/SameSite
  • CSP, X-Frame-Options, Referrer-Policy and Permissions-Policy are added to reduce XSS, clickjacking and referrer leakage
  • No third-party fonts/scripts are loaded on public pages, reducing unnecessary transfer of data to outside parties
  • We recommend enabling MFA, making encrypted backups and testing restores according to the MA (maintenance) cycle

PDPA principles the system supports

  • Purposes are stated before data is collected through the Demo/quotation/Support forms
  • Only the data necessary for sales, installation, issuing accounting documents and after-sales service is collected
  • Access to data is restricted by user role and recorded in an audit log
  • Requests for access, correction, deletion, restriction of use, objection and withdrawal of consent are supported through the contact channels below

Cookie policy (Thailand)

  • Necessary cookies are always on so that the website works and to prevent request forgery
  • Analytics and marketing cookies require explicit consent before they are enabled
  • The “Reject” and “Accept all” options take a similar amount of effort, to reduce dark patterns
  • Withdrawing consent must be easy, and the system will not load optional scripts after consent is withdrawn

Data we collect and why

This table is a short privacy notice for website users, customers and project coordinators. The actual data may vary according to the contract and the system installed for each organization.

Contact details
Name, organization, position, phone, email, province
Contacting you back, quoting, scheduling demos and following up on sales
Business document data
Taxpayer ID number, address, quotations, invoices, receipts
Issuing documents as required by contract, tax and accounting
After-sales service data
License, Ticket, attachments, problem-resolution history
Providing Support, Warranty and MA services
Technical data
IP, access time, user agent, audit log
Maintaining security, investigating anomalies and preventing attacks

How data subjects can exercise their rights

Data subjects may request access to their data, a copy of it, its correction, deletion or restriction of use, may object to processing, or may withdraw consent, by sending a request together with only the identity verification information that is necessary.

Email: [email protected]

Target response time: Within 30 days, or as required by law

Data breaches: Notify the security team immediately at [email protected]

Legal note

This page sets out practices and a privacy notice for the system; it is not legal advice on any specific case. Before it is used for contractual purposes or as an organization's official notice, the wording should be reviewed again by a legal expert/data protection officer.

Retention Data is retained as necessary for its purposes, contracts, tax, accounting and disputes.
Transfer Data is not sent outside the system or to third parties, unless necessary for the service or required by law.