Privacy Policy

1. Introduction

Cairnstone ("we", "us", "our") is a document organisation and educational information service based at 77/3 Klang Mueang Road, Nai Mueang, Mueang Khon Kaen, Khon Kaen 40000, Thailand. We are committed to handling personal information responsibly and in accordance with the Thailand Personal Data Protection Act B.E. 2562 (PDPA) and other applicable data protection frameworks.

This policy applies to information collected through our website at cairnstonem.world, through our contact form, and in the course of delivering our services. If you have questions about this policy, please contact us at [email protected].

2. Data We Collect

We collect only the information needed to communicate with you and deliver our services. This includes:

• Contact information: Name, email address, telephone number (where provided)
• Enquiry content: The details you include in your message when contacting us
• Usage data: Browser type, pages visited, and time spent — collected via analytics cookies if consent is given
• Engagement records: Notes from sessions and correspondence, retained for the duration of the engagement

We do not collect financial information, document contents, or any special category personal data through our website. Information discussed during in-person sessions is kept separate from digital systems.

Legal basis: Contact enquiries are processed on the basis of consent. Service delivery records are held under the legitimate interest of fulfilling the agreed engagement and maintaining a record of correspondence.

Retention: Website enquiry data is held for up to 24 months. Engagement records are retained for 5 years following the close of the engagement, then deleted.

3. How We Use Your Data

• Responding to enquiries submitted through our contact form
• Arranging and delivering agreed services
• Sending service-related correspondence (session summaries, scheduling)
• Improving our website based on aggregated usage analytics
• Complying with applicable legal obligations

We do not use your data for direct marketing without your explicit consent, and we do not sell or transfer personal data to third parties for their own commercial purposes.

4. Data Sharing

We do not share your personal data with third parties except in the following limited circumstances:

• Service providers: We use a small number of trusted tools (email hosting, website analytics) whose providers may process data on our behalf under appropriate data processing agreements
• Legal requirements: Where disclosure is required by Thai law or a competent authority

Analytics data is processed by Google Analytics (aggregated and anonymised). No personal identifiers are included in analytics reports.

5. Data Protection Measures

• Email correspondence is handled through encrypted channels
• Internal records are access-controlled — only staff involved in your engagement can access your data
• Physical session notes are stored in a locked office and not shared electronically unless necessary
• In the event of a data breach affecting your personal information, we will notify you within 72 hours of becoming aware of the incident

6. Cookies

Our website uses cookies to support basic functionality and, with your consent, analytics. We use the following categories:

• Essential cookies: Required for the website to function correctly
• Analytics cookies: Collect anonymised usage data to help us understand how the site is used (only set with consent)
• Preference cookies: Remember your consent choices

Full details are in our Cookie Policy.

7. Your Rights

Under the Thailand PDPA and, where applicable, GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Ask us to correct inaccurate or incomplete data
• Erasure: Request deletion of your data, subject to legal retention requirements
• Portability: Receive your data in a structured, commonly used format
• Objection: Object to processing based on legitimate interests
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing
• Complaint: Lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices or content of those sites. We recommend reviewing the privacy policy of any external site you visit.

9. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted information to us, please contact us at [email protected] and we will delete it promptly.

10. Policy Updates

We may update this policy from time to time. Significant changes will be communicated by posting a revised version on this page with an updated "Last Updated" date. Continued use of our website after such changes constitutes acceptance of the updated policy.