Privacy Policy

1. Introduction

Cairnstone ("we", "us", "our") is committed to handling your personal information with care and transparency. This policy describes what data we collect, why we collect it, how we use it, and the rights you hold over it. It applies to all visitors to our website and to clients who engage our services from our office at 26 Phuket Road, Muang, Phuket 83000, Thailand.

Our services are educational and organisational in nature. The personal data we handle is limited to what is necessary to respond to enquiries and deliver sessions. We do not handle financial records, estate valuations, or assets of any kind on your behalf.

2. Data We Collect

Information You Provide

• Full name and preferred contact name
• Email address and telephone number
• Content of any message submitted via our contact form
• Nationality or country of residence, where voluntarily shared during enquiry

Data Collected Automatically

• Browser type and version
• Pages visited and approximate time spent
• Referral source
• Anonymised IP address

Automatic data is collected through cookies and analytics tools. You may manage cookie preferences via our Cookie Policy.

3. Legal Basis for Processing

We process your personal data on the following bases under applicable Thai data protection law (the Personal Data Protection Act B.E. 2562, "PDPA") and, where relevant, the EU General Data Protection Regulation (GDPR):

• Contractual necessity — to provide the session you have booked or enquired about.
• Legitimate interest — to respond to your enquiry, maintain session records, and improve our services.
• Consent — for optional marketing communications and analytics cookies, which you may withdraw at any time.

4. How We Use Your Data

• To respond to your enquiry by email or telephone
• To schedule and confirm session bookings
• To provide the session summary referred to in our service descriptions
• To send service-related communications (e.g. scheduling reminders)
• To improve our website based on aggregated, anonymised analytics data
• To comply with legal obligations, if applicable

We do not use your data for automated decision-making or profiling. We do not sell your data to any third party.

5. Data Retention

We retain personal data only for as long as is necessary for the purpose for which it was collected:

• Enquiries that do not result in a booking: deleted within 3 months of last contact.
• Session records: retained for 3 years after the final session, then securely deleted.
• Website analytics data: retained in anonymised form for up to 26 months.

6. Data Protection Measures

We take reasonable steps to protect your personal data against loss, misuse, or unauthorised access. These include:

• Encrypted email communications where supported
• Password-protected file storage with restricted staff access
• Session notes stored in locked, access-controlled systems
• No retention of client documents after the conclusion of an engagement

In the event of a data breach that is likely to result in risk to your rights, we will notify you and the relevant supervisory authority within 72 hours of becoming aware, in line with applicable law.

7. Cookies

We use cookies to understand how visitors use our website and to remember your preferences. For a full explanation of the cookies we use and how to manage them, please see our Cookie Policy.

8. Third-Party Services

We may use the following third-party services, which may process limited data on our behalf:

• Google Analytics (anonymised website usage data)
• Google Maps (embedded map on our homepage — subject to Google's own privacy policy)
• Email service provider for general correspondence

We are not responsible for the privacy practices of third-party websites linked to from our pages. We encourage you to read their policies directly.

9. Your Rights

Under the Thai PDPA and, where applicable, the GDPR, you have the following rights in relation to your personal data:

• Access — to request a copy of the personal data we hold about you.
• Rectification — to ask us to correct inaccurate data.
• Erasure — to request deletion of your data, subject to lawful retention obligations.
• Portability — to receive your data in a structured, machine-readable format.
• Objection — to object to processing based on legitimate interest.
• Withdraw consent — to withdraw marketing or analytics consent at any time, without affecting prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

If you are in the EU/EEA and believe your rights have not been respected, you may lodge a complaint with your local data protection supervisory authority. If you are in Thailand, the relevant supervisory authority is the Personal Data Protection Committee (PDPC).

10. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us promptly at [email protected] and we will delete it without delay.

11. Policy Updates

We may update this policy from time to time to reflect changes in our practices or applicable law. When we do, we will revise the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after a change constitutes acceptance of the updated policy.

12. Contact Us

Cairnstone is the data controller for the purposes of this policy.