Bold Group
Who we are
This notice explains how Kryon Innovator Co., Ltd., trading as Bold Group Thailand (“we”, “us”), collects, uses and discloses personal data, as required by Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). We are the data controller for personal data collected through this website and in the course of our business.
- Company
- Kryon Innovator Co., Ltd. · Tax ID 0105558077564
- Address
- 29 Soi Wachirathamsathit 30, Sukhumvit 101/1 Road, Bang Na, Bangkok 10260, Thailand
- Phone
- +66 63 565 6914
- [email protected]
- Data Protection Officer
- Teerasak Wongpiya · [email protected]
Bold Group Thailand is one office of the Bold Group network. Each office is a separate company and answers for its own processing; this notice covers Kryon Innovator Co., Ltd. only.
What personal data we collect
Data you give us. Your name, job title, organization, business email, phone number, LINE ID and the content of your message, when you use our contact form, email, phone, LINE or booking tool, or meet us. During an engagement, we may also record business information about client staff we work with, such as interview notes and workshop contributions.
Data collected automatically. Your IP address, device and browser type, pages visited, time on page and the site that referred you, collected through cookies and similar technologies described below.
Data we do not want. We do not ask for sensitive data under section 26, such as health, religion, biometric or criminal-record data. Please do not send it to us. If we receive it unintentionally, we will delete it unless the law allows us to keep it.
Why we use it, and on what legal basis
| Purpose | Legal basis under the PDPA |
|---|---|
| Replying to your enquiry, by contact form, email, phone or LINE | Steps you ask for before a contract, s.24(3); our legitimate interest in answering business enquiries, s.24(5) |
| Arranging a meeting through our online booking tool | Steps you ask for before a contract, s.24(3) |
| Preparing proposals and delivering engagements, including interviews and workshops with your staff | Contract, s.24(3); legitimate interest, s.24(5), for client staff who are not party to the contract |
| Invoicing, accounting and tax records | Legal obligation, s.24(6) |
| Keeping the website working and secure, including strictly necessary cookies | Legitimate interest, s.24(5) |
| Measuring how the website is used (analytics cookies) | Your consent, s.19 |
| Showing our advertising to people who visited the website (advertising cookies and pixels) | Your consent, s.19 |
| Establishing, exercising or defending legal claims | Legitimate interest, s.24(5) |
We do not sell personal data, and we do not send newsletters or marketing emails. If we ever do, we will ask for your consent first.
If you do not provide your data
Giving us your data is not a legal requirement. Without your name and a way to contact you, however, we cannot reply to an enquiry, arrange a meeting or enter into a contract with you. Declining analytics or advertising cookies does not affect your use of the website.
Cookies and similar technologies
| Type | What it does | Consent |
|---|---|---|
| Strictly necessary | Make the website work and keep it secure. | Always on; no consent needed. |
| Analytics | Google Analytics, loaded through Google Tag Manager, to count visits and see which pages are read. | Only with your consent. |
| Advertising | Meta (Facebook) Pixel and LinkedIn Insight Tag, to measure and show our advertising to people who visited the site. | Only with your consent. |
Analytics and advertising cookies are set only after you accept them in our cookie banner. You can change your choice at any time through the Cookie settings link in the footer, or by deleting cookies in your browser. Rejecting is as easy as accepting.
Who we share it with
- Service providers who act on our instructions: website hosting, email, our online booking tool, analytics and advertising platforms.
- Professional advisers such as accountants, auditors and lawyers, under a duty of confidentiality.
- Bold Group network offices or partner firms, only where your engagement needs them and you have been told beforehand.
- Government authorities, courts or regulators, where the law requires it.
Transfers outside Thailand
Some of our service providers store or process data outside Thailand, for example in the United States (Google, Meta, LinkedIn and our booking tool) and Japan (LINE). We transfer data abroad only as sections 28 and 29 of the PDPA allow: where the destination has adequate protection, where the provider applies safeguards recognised by the Personal Data Protection Committee such as standard contractual clauses, or where the transfer is necessary to perform a contract with you or steps you asked for before one. You may ask us for details of the safeguards used.
How long we keep it
| Data | Retention |
|---|---|
| Enquiries that do not lead to an engagement | 2 years after our last contact |
| Client, contract and engagement records | 10 years after the engagement ends, to meet accounting and tax duties and legal limitation periods |
| Accounting and tax documents | As long as Thai accounting and revenue law requires |
| Analytics and advertising data | No longer than the shortest retention setting that meets our purpose, and not more than 14 months |
| Data kept because of a legal claim | Until the claim is finally resolved |
When the period ends, we delete, destroy or anonymise the data.
How we protect it
We use appropriate administrative, technical and physical measures: access limited to the people who need it, password-protected and encrypted systems, and confidentiality terms with service providers. If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to risk your rights. If the risk is high, we will also tell you without delay.
Your rights
Under the PDPA you have the right to:
- Withdraw consent at any time, for processing based on consent, without affecting what was done before (s.19).
- Access and obtain a copy of your data, or ask how we obtained data you did not give us (s.30).
- Portability receive your data in a commonly used machine-readable format, or have it sent to another controller where technically possible (s.31).
- Object to processing based on legitimate interest, and to any direct marketing (s.32).
- Erasure ask us to delete, destroy or anonymise your data where the law allows (s.33).
- Restriction ask us to suspend use of your data while a request or dispute is resolved (s.34).
- Rectification ask us to correct data that is inaccurate, out of date or incomplete (s.36).
- Complain to the Personal Data Protection Committee if you believe we have not complied with the law (s.73).
How to make a request. Email our Data Protection Officer at [email protected] or [email protected], or write to the address above. We may ask you to confirm your identity. We will respond within 30 days of receiving your request. If we cannot do what you ask, we will explain why, as the law allows.
Complaints to the regulator
You may complain to the Office of the Personal Data Protection Committee (PDPC): 120 Moo 3, Government Complex, Building B (Ratthaprasasanabhakdi Building), 7th Floor, Chaeng Watthana Road, Thung Song Hong, Lak Si, Bangkok 10210 · www.pdpc.or.th · [email protected] · 02 142 1033. We would welcome the chance to resolve your concern first.
Minors
Our services are for businesses and their staff, and this website is not intended for people under 20. We do not knowingly collect data from minors. If we learn that we have, we will delete it or obtain the consent required by section 20 of the PDPA.
Other websites
Links to other websites, such as LinkedIn, our booking tool or partner firms, are governed by those sites’ own privacy notices.
Changes to this notice
We may update this notice. The date at the top shows the latest version, and we will tell you of significant changes that affect you.