Privacy Policy

MITHAT CO., LTD. (“the Company”, “we”) takes the protection of your personal data seriously. This policy explains how we collect, use, disclose and safeguard personal data under Thailand’s Personal Data Protection Act B.E. 2562 (“PDPA”). Please read it before using this website or sending us any information.

This is a translation provided for convenience. Where the two versions differ, the Thai version prevails.

1. Data controller and contact person

Data controller
MITHAT CO., LTD., company registration 0745566000375
145/18-19 Hong Tower, Room No. A912/3, 9th Floor, Bang Khun Thian-Chai Thalae Road, Samae Dam, Bang Khun Thian, Bangkok 10150, Thailand
Phone 081-395-2526 · Office 02-100-4693 · Email sales@mithat.co.th

Data protection contact
ฝ่ายคุ้มครองข้อมูลส่วนบุคคล
Email chatree@mithat.co.th · Phone 081-395-2526

2. Personal data we collect

2.1 Information you give us

• Contact form — name, email, phone, company, service of interest and the message you write.
• Job and partnership enquiries — the same fields, plus the type of enquiry.
• Rights request form — name, email, phone, the right you are exercising and your description.

2.2 Information collected automatically

• Hashed IP address — we never store raw IP addresses. Every IP passes through a one-way SHA-256 hash with a salt before being written, is used only to detect abuse, and cannot be reversed.
• Browser user-agent — browser and operating system, capped at 300 characters.
• Language preference and cookie consent choices.
• Usage statistics — pages viewed, time on page and referrer, collected through analytics cookies only after you consent.

We do not collect sensitive personal data under s.26 — such as race, religion, political opinion, criminal record or health data. Please do not include such information in any free-text field.

3. Purposes and legal bases

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.

4. Cookies

We use necessary cookies to make the site work, and install no analytics or marketing cookies until you actively consent. Each cookie, its provider, destination country and lifetime are listed in our cookie policy.

5. Disclosure and processors

We never sell your personal data. We disclose it only as necessary to:

We put data processing agreements in place with our processors under s.40 paragraph three, and require them to process data only on our instructions.

6. International transfers

Some providers listed above operate servers outside Thailand, so using them involves transferring personal data abroad under s.28 and s.29.

• We select providers with adequate protection standards, supported by Standard Contractual Clauses.
• Transfers to Google and Meta happen only if you consent to the relevant cookie category.
• You can avoid those transfers entirely by rejecting analytics and marketing cookies.

7. Retention

We keep personal data only as long as the stated purpose requires. Data past its retention period is deleted automatically every day.

8. Your rights

1. Access your data and obtain a copy (s.30)
2. Data portability to another controller (s.31)
3. Object to collection, use or disclosure (s.32)
4. Erasure or destruction, or anonymisation (s.33)
5. Restriction of processing (s.34)
6. Rectification so data stays accurate, current and not misleading (s.35)
7. Withdraw consent at any time (s.19 para. 5)
8. Lodge a complaint with the Personal Data Protection Committee (s.73)

9. How to exercise your rights

• Submit the data subject rights form — you receive a reference number immediately for tracking.
• Or contact us at chatree@mithat.co.th or 081-395-2526.
• For cookie consent, the “Manage cookies” button in the footer is immediate.

We will complete your request within 30 days of receiving it. To protect the data subject, we may ask for proof of identity first. Exercising your rights is free, unless a request is manifestly repetitive or excessive.

If we refuse a request, we will state our reasons in writing and record them under s.39.

10. Children’s privacy

This website is intended for businesses and adults. We do not knowingly collect personal data from anyone under 20. Where data from a minor is necessary, we obtain consent from the holder of parental responsibility under s.20. If you believe a minor has submitted data without such consent, please tell us at chatree@mithat.co.th and we will delete it promptly.

11. Security measures

• All traffic encrypted with HTTPS.
• Administrator passwords stored with Argon2id — never in readable form.
• Session tokens held in HttpOnly cookies that browser scripts cannot read.
• Login protected by rate limiting and Cloudflare Turnstile.
• IP addresses hashed one-way before storage.
• Database access restricted to those who need it.
• Data past its retention period deleted automatically.

12. Data breach

In the event of a personal data breach we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware, so far as practicable, under s.37(4). Where the breach poses a high risk to your rights and freedoms, we will notify you without undue delay together with remedial guidance.

13. Legal disclosure

We may disclose personal data where required by law, court order, or the order of a competent authority — limited to what that order requires.

14. Complaints

If you believe our processing is unlawful, please contact us first so we can put it right quickly.

Data controller
MITHAT CO., LTD. · Registration no. 0745566000375
145/18-19 Hong Tower, Room No. A912/3, 9th Floor, Bang Khun Thian-Chai Thalae Road, Samae Dam, Bang Khun Thian, Bangkok 10150, Thailand
Phone 081-395-2526 · Office 02-100-4693 · Email sales@mithat.co.th

If the matter is not resolved to your satisfaction, you also have the right to complain to the Office of the Personal Data Protection Committee (PDPC)
7th Floor, Ratthaprasasanabhakti Building, Government Complex, Chaeng Watthana Road, Thung Song Hong, Lak Si, Bangkok 10210, Thailand
Phone +66 2 142 1033 · Email saraban@pdpc.or.th
www.pdpc.or.th

15. Changes to this policy

We may update this policy from time to time. For material changes we increment the version number and seek fresh consent where appropriate. The current version is 2026-08-20.