Privacy Policy

Heritara is an estate records organisation and information service based in Chiang Mai, Thailand. We help households gather, label, and arrange their important documents in a clear and orderly way. We do not offer advice on formal legal, financial, or regulatory matters.

Our registered address is:

We collect only the personal information that is necessary for us to respond to your enquiry, arrange a service visit, or provide general information about our programmes. This may include:

• ▪Contact details — your name, telephone number, and email address, provided when you fill in our enquiry form or contact us directly.
• ▪General location information — the area or district within Chiang Mai, so we can confirm whether a home visit is practical.
• ▪Correspondence content — any details you share with us by email, telephone, or message when discussing your needs.
• ▪Website usage data — non-identifiable browsing information such as pages visited and session duration, collected via cookies where you have given consent.

We do not ask for, or wish to receive, copies of documents, account details, or any sensitive personal records through our website or enquiry form.

We use the information you provide only for the following purposes:

• ▪To respond to your enquiry and explain how our services work.
• ▪To arrange and confirm a service visit or information session.
• ▪To send you relevant information about our services if you have asked us to.
• ▪To keep a record of our correspondence so we can assist you consistently.
• ▪To improve our website based on anonymous usage patterns, where you have consented to analytics cookies.

We do not use personal information for automated profiling, and we do not make automated decisions based on your data.

We process personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA). The grounds on which we rely are:

• ▪Contractual necessity — to respond to an enquiry and carry out a service you have requested.
• ▪Legitimate interests — to maintain a record of correspondence and improve our service, in ways that do not override your rights.
• ▪Consent — for non-essential cookies and for any optional marketing communications, which you may withdraw at any time.

We do not sell, rent, or trade personal information. We share it only in the following circumstances:

• ▪Service providers — third parties who support our operations (for example, email delivery or website hosting), bound by confidentiality arrangements and permitted to use your data only on our behalf.
• ▪Legal requirements — where we are required to share information by applicable Thai law or a lawful authority, we will do so to the extent required.

Any third party who processes data on our behalf is required to handle it with the same care and discretion that we apply ourselves.

We keep personal information only for as long as it is reasonably necessary:

• ▪Enquiry records — retained for up to 2 years from the date of your last contact, in case you have a follow-up question or wish to book a service.
• ▪Service records — details related to a completed service are retained for up to 5 years for administrative purposes.
• ▪Website analytics — aggregate, non-identifiable data may be retained indefinitely; cookie-based data follows the expiry period stated in our Cookie Policy.

Once data is no longer needed, we delete or anonymise it in a secure and orderly manner.

Under Thailand's PDPA you have a number of rights in relation to your personal data. You may:

• ▪Access your personal data and receive a copy of what we hold about you.
• ▪Correct any inaccurate or incomplete information.
• ▪Delete personal data we hold, in circumstances where there is no longer a lawful basis for retaining it.
• ▪Restrict or object to how we process your information in certain situations.
• ▪Withdraw consent for any processing based on consent, at any time, without affecting the lawfulness of prior processing.
• ▪Portability — receive your data in a structured, commonly used format where this is technically feasible.

To exercise any of these rights, please contact us at [email protected]. We will respond within a reasonable period and in line with PDPA timelines.

We use a small number of cookies to keep our website functioning correctly and, where you consent, to understand how it is used. Our Cookie Policy sets out what cookies we use, why, and how you can manage your preferences.

You can update your cookie preferences at any time through the settings on that page, or by clearing cookies in your browser.

We take reasonable organisational and technical steps to protect the personal information we hold from loss, misuse, or unauthorised access. This includes secure email handling, restricted access to contact records, and regular review of our data practices.

No method of electronic transmission is entirely without risk. If you have concerns about the security of information you have shared with us, please contact us directly and we will address them promptly.

Our website may include links to official bodies, government offices, or other organisations that we refer clients to for formal matters. We are not responsible for the privacy practices of those external websites and recommend you read their own policies before sharing any personal information with them.

We may update this Privacy Policy from time to time to reflect changes in our services or applicable requirements. The date at the top of this page shows when it was last revised. We encourage you to check back periodically if you would like to stay informed about how we handle personal data.

If you have any questions about this Privacy Policy or wish to exercise your rights, please reach out to us. We are happy to discuss any aspect of how we look after your information.

Our related policies: