Privacy Policy

1. Introduction

Hexenmark ("we", "us", "our") is a business consulting practice registered in Phuket Province, Thailand, with offices at 64 Phang Nga Road, Talat Yai, Phuket 83000. We take the handling of personal data seriously and are committed to transparency about how we collect, use, and protect the information you share with us.

This policy applies to personal data collected through our website at hexenmar.info and through our consulting engagement process. If you have questions about any part of this policy, contact us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact information: name, email address, phone number — provided when you submit an enquiry via our website contact form or contact us directly.
• Business information: company name, role, nature of business — provided voluntarily during initial consultations and engagement scoping.
• Engagement data: documents, customer data, or internal records you share with us as part of a consulting engagement (e.g., during customer journey mapping). This data is used solely for the stated engagement purpose.
• Website usage data: IP address, browser type, pages visited, session duration — collected via cookies and analytics tools if you have given consent.

We collect data by the following means:

• Website contact form submissions
• Direct email and telephone communication
• Documents and data shared during consulting engagements
• Website cookies and analytics (with consent)

Legal basis: Contact and enquiry data is processed on the basis of legitimate interest (responding to business enquiries) and, where applicable, contract performance. Engagement data is processed on the basis of contractual necessity. Website analytics are processed on the basis of consent.

Retention: Enquiry data is retained for up to 24 months. Engagement documents and related data are retained for the duration of the engagement and deleted within 90 days of engagement closure unless longer retention is agreed in writing. Website analytics data is retained in accordance with the third-party analytics provider's retention settings.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Responding to enquiries and scoping potential engagements
• Delivering contracted consulting engagements
• Sending administrative communications related to an active engagement
• Sending follow-up communications after an engagement closes (occasional, not marketing)
• Improving our website and service offering based on aggregated usage data

Third-party sharing: We do not sell personal data. We may share data with third-party service providers who assist with website hosting, analytics, or document storage — always under a data processing agreement that restricts use to the stated purpose. We do not share client business data with any third party without explicit written consent.

Marketing: We do not send unsolicited marketing communications. If you would like to opt out of any follow-up communication, email us at [email protected].

4. Data Protection Measures

• Website data transmitted over HTTPS (TLS encryption in transit)
• Access to client data restricted to staff directly involved in the relevant engagement
• Engagement documents stored in access-controlled cloud storage
• Data breaches reported to affected parties within 72 hours of discovery
• Passwords and access credentials subject to regular review

5. Cookies

Our website uses cookies. Essential cookies are required for basic site functionality and cannot be disabled. Analytics and marketing cookies are only placed if you provide consent via the cookie banner on your first visit. For full details, see our Cookie Policy.

6. Your Rights

Under applicable Thai data protection law (Personal Data Protection Act B.E. 2562) and where relevant, international standards, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data where we no longer have a lawful basis to retain it.
• Portability: Request your data in a machine-readable format where technically feasible.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of consent: Withdraw consent at any time where processing is consent-based, without affecting prior processing.

To exercise any of these rights, contact [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee if you believe your rights have not been respected.

7. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently before sharing any personal data with them.

8. Children's Privacy

Our services are directed at business owners and professional team members and are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, contact [email protected] and we will delete it promptly.

9. Policy Updates

We may update this policy from time to time to reflect changes in our practices or applicable law. Material changes will be noted at the top of this page with an updated effective date. Continued use of our website or services after a policy update constitutes acceptance of the revised terms.

10. Contact

For any privacy-related queries or rights requests: