إشعار الخصوصية

This notice explains what personal data BDH Corporation Co., Ltd. ("BDH", "we", "us") collects through this website and when you buy from us, why, how long we keep it, who receives it, and your rights under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). In short: we collect little, we use no cookies or trackers, and we never see your card number.

In short

• The contact form keeps what you type and a one-way hash of your IP address, not the IP address itself.
• Our server keeps request logs for up to 90 days, for security.
• No cookies, no analytics, no advertising trackers, and no fonts or scripts from other companies.
• When you buy, Stripe handles the payment. Your card details never reach our servers.
• You can ask to see, correct, delete or move your data, and you can complain to the PDPC.

1. Who is responsible

The data controller is BDH Corporation Co., Ltd., a company registered in Thailand. Its registered details are listed under company facts.

We have not appointed a data protection officer (DPO). For any privacy question or request, use our contact page and choose the topic Privacy request (PDPA).

2. What this notice covers

This notice covers:

• this website, www.bdhcorporation.com;
• purchases you make from BDH, such as model licences and Edge AI Store plans.

The Edge AI Store and the Edge AI Trainer are BENTO services that sign in with a TESAIoT platform account. Each service tells you on screen what it collects and why. For example, the Edge AI Store shows a "Who sees what" table and asks for separate consent before a feature uses personal data. Those notices explain the data each service needs to run, such as the boards you register and the results your models report.

3. What we collect, why, and for how long

Contact form

• Data: your name, email address, company (optional), the topic you choose, your message, the language of the page, the time you sent it, and a salted one-way hash of your IP address. We do not store the IP address itself.
• Why: to answer your enquiry, and to tell messages from the same sender apart so that we can deal with abuse.
• Legal basis: steps you ask us to take before a possible contract (PDPA section 24(3)), and our legitimate interest in answering the people who write to us (section 24(5)).
• Do you have to give it? We need your name, email address and message to reply. Without them we cannot answer you.
• How long: up to 24 months from the date you sent the message, then deleted. If your enquiry leads to a contract, we keep what is needed as part of that contract's records.

Protection against abuse

To stop the contact form and the staff sign-in from being flooded, the server holds IP addresses in memory for a few minutes to count attempts. They are not written to disk. Legal basis: our legitimate interest in keeping the website secure (section 24(5)).

Server logs

• Data: IP address, date and time, the address of the page requested, the response status and size, the referring page, and your browser's user agent.
• Why: to keep the website secure and running, and to investigate faults and attacks.
• Legal basis: our legitimate interest (section 24(5)), and legal obligations where they apply (section 24(6)).
• How long: up to 90 days, then deleted, unless a specific record is needed for longer to investigate a security incident or because the law requires it.

The website application also logs each request's page address, status and timing, without the IP address.

Purchases from BDH

When you buy from us, we process:

• the name and email address of your TESAIoT account;
• what you bought, the price, taxes, any code used, the order reference and the time;
• the board a licence is bound to, and when the model was deployed;
• the payment status and limited payment details that Stripe makes available to us, such as the card brand and the last four digits. We never receive your full card number or security code;
• for a tax invoice, the name, address and tax ID you give us;
• records of refunds, disputes and our messages with you.

We use this data:

• to sell and deliver what you ordered, and to support you (contract, section 24(3));
• to keep tax and accounting records (legal obligation, section 24(6));
• to prevent fraud and to establish, exercise or defend legal claims (legitimate interest, section 24(5)).

If you do not give the data an order needs, we cannot complete the order.

How long: order, tax and accounting records are kept for as long as Thai tax and accounting law requires, generally at least 5 years. Licence records are kept for as long as the licence lasts, and then for as long as needed to deal with legal claims.

What we do not do

• We do not use cookies, analytics, advertising trackers, or fonts or scripts from other companies on this website. See our Cookie Notice.
• We do not sell personal data.
• We do not use contact-form details to send marketing.
• We do not make decisions about you by automated means alone that have legal or similarly significant effects.

4. Who receives your data

• Our hosting provider, DigitalOcean, which runs the server this website is on. At the time of writing, the server is in Singapore.
• Stripe, for payments. For businesses in Thailand, Stripe's contracting entity is Stripe Payments (Thailand) Ltd, and Stripe Payments Europe, Limited takes part for the processing of personal data. Depending on the activity, Stripe acts on our behalf or as a data controller in its own right, as Stripe's Privacy Policy explains.
• Our email services, which pass each contact-form message on to our staff by email and carry our replies to you.
• Professional advisers, such as accountants, auditors and lawyers, who must keep it confidential.
• Authorities, such as the Revenue Department, courts or police, when the law requires it.

Each of them receives only what it needs for its purpose.

5. Transfers outside Thailand

Some recipients process data outside Thailand:

• this website's server is in Singapore;
• our email services may handle contact-form messages and our replies in the United States and other countries outside Thailand;
• Stripe states that it provides some or all of its service from systems in the United States and other countries outside Thailand, and that data there may be disclosed as the laws of those places require.

We make these transfers only as PDPA sections 28 and 29 allow, for example where a transfer is needed to perform a contract with you or to take steps you asked for, or where the recipient has suitable safeguards. Stripe states that it uses the EU Standard Contractual Clauses, as adapted for transfers from Thailand under the PDPC's notification on section 29. For our own systems we use encrypted connections (HTTPS), access limited to authorised staff, and data minimisation, such as keeping a hash instead of the IP address in the contact inbox. You can ask us for more detail about the safeguards for a transfer.

6. How we protect your data

• Every page and form uses an encrypted connection (HTTPS).
• The contact inbox stores a hash, not your IP address, and is open only to the website service and authorised staff.
• The staff editor needs a password and locks after repeated failed sign-ins.
• Card data is handled only by Stripe, which is certified to PCI DSS Service Provider Level 1.

If a personal data breach is likely to put your rights at risk, we notify the PDPC within 72 hours of becoming aware of it. If the risk is high, we also tell you without undue delay, as PDPA section 37 requires.

7. Your rights

Under the PDPA you have the right to:

• withdraw consent where we rely on it, at any time, without affecting what was done before (section 19);
• access your data and get a copy, and ask us to disclose how we obtained data about you that was collected without your consent (section 30);
• receive or transfer the data you gave us in a commonly used, machine-readable format (section 31);
• object to processing based on legitimate interest, or for direct marketing (section 32);
• erasure, or to have data destroyed or made anonymous, when there is no longer a lawful reason to keep it (section 33);
• restriction of use, for example while we check a request (section 34);
• rectification, so that your data is accurate, up to date and complete (sections 35 and 36).

To use a right, send a request through our contact page with the topic Privacy request (PDPA). We may ask you to confirm who you are. We answer within 30 days. Requests are free, unless they are clearly unfounded or excessive. We may refuse a request where the law allows, for example when we must keep tax records. If we refuse, we tell you why.

8. Complaints

If you think we have not followed the PDPA, please tell us first so that we can put it right. You also have the right to complain to the Office of the Personal Data Protection Committee (PDPC) at pdpc.or.th.

9. Children

This website is not aimed at children. If you are under 20, please ask a parent or guardian before you send us personal data or buy from us.

10. Changes to this notice

We update this notice when our practices or the law change. The date at the top shows the current version. If a change affects how we use data you have already given us, we tell you before it applies.

11. Contact and language

For privacy requests, use our contact page with the topic Privacy request (PDPA). Our registered company details are under company facts.

This notice is published in Thai and English. Where the two versions differ, the Thai version prevails.