Privacy Policy

For any personal data that is collected through the Site, the data controller is Petrol Solution Co., Limited, operating the The True Thailand (T3) project.

A named Data Protection Officer has not been formally appointed as of the date of this Policy. Privacy inquiries should be directed to the contact details in Section 29; do not treat that inbox as a formal DPO appointment unless T3 confirms one separately.

This Policy covers personal data connected to your use of www.thetruethailand.com — pages you visit, and any information you choose to submit through a form on the Site. It does not cover any third-party website you reach via a link from the Site (see Section 26).

Based on the audit summarized above, the Site can currently collect the following categories of personal data, depending on how you use it:

T3 does not currently ask for, and does not knowingly collect, sensitive personal data (such as health data, religious belief, or biometric data) through any form on the Site.

Personal data reaches T3, if at all, in one of two ways: (1) you type it directly into a form on the Site, or (2) it is generated automatically as part of normal web traffic (for example, basic technical data described in Section 15). T3 does not purchase personal data from third parties or combine your data with data bought from data brokers.

Where personal data is genuinely received (see Section 12 for the important caveat about the Partnership Inquiry form), it would be used to: respond to your inquiry; evaluate a potential partnership, sponsorship, or collaboration; send newsletter updates you have actively requested, once that feature is technically connected; keep the Site secure and functioning; and comply with legal obligations.

Under the PDPA, personal data may only be processed where a lawful basis applies. The bases relevant to T3's current and planned processing are: your consent (Section 7); the steps necessary to respond to your request before entering into an agreement, i.e. pre-contractual measures (Section 8); T3's legitimate interests, balanced against your rights (Section 9); and compliance with a legal obligation (Section 10).

Where T3 relies on your consent — for example, to send newsletter emails once that feature is connected, or to record a cookie-preference choice beyond what is strictly necessary — you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal. See Section 23 for how to exercise this.

The Partnership Inquiry form includes a specific consent checkbox with the wording: "I agree that T3 may use this information to respond to my partnership inquiry." This checkbox must be ticked before the form's email action can be used.

If you submit a partnership, sponsorship, or business inquiry, T3 processes the information you provide as a pre-contractual step — to consider and respond to a possible collaboration at your request — which is a recognized lawful basis under the PDPA distinct from consent.

For basic technical/security data described in Section 15, T3's (or, where applicable, its hosting provider's) legitimate interest is keeping the Site secure, functioning, and free of abuse. This is balanced against your right to privacy — no such data is currently used for profiling, advertising, or any purpose beyond running the Site.

T3 may process or disclose personal data where required to comply with Thai law, a lawful request from a competent authority, or to establish, exercise, or defend legal claims.

The Site displays two "Subscribe to T3 Updates" email fields (in the global footer and on the Knowledge page). As of this Policy's date, neither is connected to a live email-sending or subscriber-management service: submitting the field shows an honest "coming soon" message and does not transmit your email address anywhere. This is a known, temporary state, not a hidden data flow — the front-end code paths were inspected directly to confirm this.

When newsletter sign-up becomes technically functional, T3 will only send marketing emails to addresses that were actively submitted through this feature, each email will include a way to unsubscribe, and this Policy will be updated to name the email-delivery service used at that time.

The Partnership Inquiry form on /partner-with-t3 lets you type organization and contact details, a discussion topic, and a free-text message. Its "Continue by Email" button does not submit this data to a T3 server or database — it opens a pre-filled email in your own device's default email application, addressed to T3's project inbox, which you must then choose to send.

This means: if you use this form, T3 only receives your information if your email client actually sends that email, and it is received the same way any email is — into the connect@thetruethailand.com inbox, not into a database or CRM. From that point on, it is handled like any other business email T3 receives.

The AI Concierge panel and floating widget do not collect, transmit, or store any conversation data. They present a fixed set of pre-written starter questions and quick links, each of which simply navigates you to an existing page of the Site — no text you might type is sent anywhere, because free-text input is not currently offered by these components.

If a live, AI-generated Concierge is introduced in the future, this section will be updated in advance to describe what is sent to the AI provider, how long conversations are retained, and what rights apply, before that feature goes live.

The public Site does not offer visitor accounts, sign-up, or sign-in, so no account or authentication data is collected from visitors today. (An administrative user/password structure exists in the underlying database design for future content-management use, but it is not connected to the live Site and does not involve visitor data.)

T3 does not run any analytics service, tracking pixel, or advertising script — none was found anywhere in the Site's code as of this Policy's date.

Like virtually any website, ordinary web infrastructure (for example, the web server or hosting platform that delivers Site pages to your browser) typically records basic technical data as a normal part of serving traffic — such as IP address, browser type, and request timestamps — in standard server logs. T3 has not published details of its specific hosting/deployment provider or that provider's log-retention practices in this repository, so this Policy describes this honestly as a general, infrastructure-level fact about how websites work, rather than asserting specific retention periods or safeguards that have not been verified. This will be completed once hosting is finalized and confirmed (see Section 19).

The Site's use of cookies and similar storage technologies (including localStorage) is described in full in the separate Cookies Policy, which includes a real inventory of what is used. In summary: as of this Policy's date, T3 uses no analytics, advertising, or third-party tracking cookies, and the only browser storage item is an optional, first-party record of your own cookie-preference choice.

T3 does not sell personal data. Because the forms described above do not currently transmit data to any T3-operated server or third-party processor (the Partnership Inquiry form uses your own email client; the newsletter fields are not connected to anything), there is currently no third-party data processor receiving personal data on T3's behalf from the public Site.

If T3 begins using a third-party service that processes personal data on its behalf — for example, an email-delivery provider, a form-backend service, or a hosting/CDN provider that handles personal data beyond basic infrastructure logging — that service will be named here, along with the safeguards in place, before or as soon as it goes live.

T3 has not confirmed the physical location of its hosting infrastructure in this repository. If personal data is transferred outside Thailand once a hosting/processor arrangement is finalized, T3 intends to apply the safeguards required under the PDPA for cross-border transfers (such as an adequacy finding, standard contractual clauses, or another PDPA-recognized safeguard) and will describe the specific arrangement here.

T3 has not yet formally documented specific retention periods for personal data, because — as described above — no live database is currently receiving form submissions from the public Site. This is flagged here deliberately rather than filled in with an invented number.

The general principle T3 intends to apply once data is actively stored is: personal data will be kept only for as long as needed for the purpose it was collected for (for example, responding to and closing out a partnership inquiry), plus any period required by Thai law, after which it will be deleted or anonymized. A formal retention schedule should be adopted before any form is connected to a live database, and this Policy should be updated to state the confirmed periods at that time.

T3 intends to apply security measures appropriate to the sensitivity of the data it handles. As of this Policy's date, no application-level encryption, access-control, or data-handling claims are made beyond what is stated in this Policy, because no live database or backend currently stores visitor-submitted personal data to secure. Once a backend is connected, this section will be updated to describe the actual technical and organizational measures in place — this Policy does not claim data is encrypted, access-restricted, or stored in any particular location unless that has been verified.

Where T3 processes your personal data as a data controller, the PDPA gives you a number of rights over that data, summarized in Section 22.

Subject to the exceptions and conditions set out in the PDPA, you have the right to:

• Access — request a copy of the personal data T3 holds about you.
• Correction — request that inaccurate or incomplete personal data be corrected.
• Deletion or destruction — request that your personal data be deleted, destroyed, or anonymized in certain circumstances.
• Restriction of processing — request that T3 limit how your personal data is used in certain circumstances.
• Objection — object to processing carried out on the basis of legitimate interests.
• Data portability — request your data in a structured, commonly used, machine-readable format, where technically feasible and where the PDPA's portability right applies.
• Withdraw consent — withdraw any consent you have given, at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of the rights in Section 22, contact T3 at connect@thetruethailand.com, describing which right you would like to exercise and, where relevant, which submission you are referring to (for example, the date and content of a partnership inquiry). Because most current forms do not create a stored record on any T3 server (see Sections 11–12), in practice a rights request today would most often relate to an email you sent us directly, which T3 will handle as an ordinary correspondence request.

T3 aims to respond to legitimate rights requests within a reasonable time and in accordance with PDPA requirements.

To protect your data from being disclosed to the wrong person, T3 may ask you to confirm your identity — for example, by replying from the same email address used in your original inquiry — before actioning a rights request. This step is proportionate to the request and will not be used to create an unreasonable barrier to exercising your rights.

The Site is intended for general audiences and is not directed at children. T3 does not knowingly collect personal data from children through any form on the Site. If you believe a child has provided personal data to T3, please contact us using the details in Section 29 so it can be addressed.

The Site links to external websites, including official Thai government resources. As of this Policy's date, the Site does not embed third-party video players, maps, or social-media widgets that would load third-party trackers on your device. If the Site does link to an external website, that website's own privacy policy governs any data it collects — this Policy does not cover external websites.

This Policy may be updated as the Site's features, forms, hosting, or legal requirements change — in particular, once the newsletter, partnership-inquiry storage, or AI Concierge become technically connected to a live backend, since that will introduce new, real data flows that must be described accurately. The "Last updated" date at the top of this page reflects the most recent revision.

If you believe your personal data has been processed in a way that does not comply with the PDPA, you have the right to lodge a complaint with Thailand's Personal Data Protection Committee (PDPC), the supervisory authority responsible for enforcing the PDPA, in addition to (or instead of) contacting T3 directly.

For any question about this Privacy Policy or how personal data is handled, contact:

• Email: connect@thetruethailand.com
• Telephone: +66 93 045 1972
• LINE: ps4line