Privacy Policy

The data controller responsible for your personal information is:

Estora
248 Mahidol Road, Pa Daet, Chiang Mai 50100, Thailand
Email: [email protected]
Telephone: +66 53 326 091

We collect personal data only when you choose to provide it to us. The types we collect include:

• Contact details: name, email address, and telephone number submitted through our enquiry form.
• Message content: any information you include in the message field of our enquiry form.
• Session booking information: name and contact details provided when booking a workshop.
• Website usage data: pages visited, time on site, and general device information collected via analytics cookies (only with your consent).

We do not collect sensitive personal data (such as health information or financial details) through our website.

We process personal data on the following bases under Thailand's Personal Data Protection Act B.E. 2562 (PDPA):

• Consent: for marketing communications and analytics cookies, where you have given express consent.
• Contract performance: when processing is necessary to respond to an enquiry or provide a booked session.
• Legitimate interests: for basic website security and maintaining session records, where these interests are not overridden by your rights.

• To respond to your enquiries and facilitate workshop bookings.
• To send confirmation and information emails related to sessions you have booked.
• To send general updates about Estora programmes, if you have consented to receiving them.
• To understand how our website is used and make improvements (analytics data only, with consent).
• To comply with applicable legal obligations.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

• Enquiry form data is retained for up to 12 months after the initial contact, or until your request is fulfilled, whichever is earlier.
• Session booking records are kept for 36 months for administrative purposes.
• Analytics data is retained according to the respective service provider's default retention period.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), restricted access controls, and regular reviews of our data handling processes. In the event of a personal data breach that presents a risk to your rights and freedoms, we will notify the relevant authority and, where required, you, within the timeframes required by applicable law.

Our website uses cookies. Essential cookies are necessary for the site to function and are set without your consent. Optional cookies (analytics and preference cookies) are only set with your agreement via our cookie consent notice. For full details of the cookies we use, please see our Cookie Policy.

We may use the following third-party services, which may process data on our behalf:

• Google Analytics: for website traffic analysis (with your consent).
• Email service providers: for communicating with enquirers and session participants.

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to read their respective policies.

Under Thailand's PDPA, you have the following rights regarding your personal data:

• Access: you may request a copy of the personal data we hold about you.
• Rectification: you may ask us to correct inaccurate or incomplete data.
• Erasure: you may request that we delete your personal data, subject to certain conditions.
• Restriction: you may ask us to restrict how we process your data in certain circumstances.
• Portability: you may request a copy of data you provided in a structured, machine-readable format.
• Objection: you may object to processing based on legitimate interests.
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand.

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Where changes are significant, we will make reasonable efforts to notify users. Continued use of our website after changes take effect constitutes acceptance of the revised policy.