Privacy Policy

1. Who We Are

Driftwood Co is a founder advisory practice based in Bangkok, Thailand. We provide advisory sessions and support engagements for early-stage founders. For the purposes of data protection, Driftwood Co acts as the data controller for personal information collected through this website and our working relationships.

Our contact address is: 120 Ekkamai Road, Khlong Tan Nuea, Watthana, Bangkok 10110, Thailand. For privacy-related enquiries, please write to: [email protected].

2. Information We Collect

We collect personal information in the following ways:

• Contact form submissions: When you fill in our enquiry form, we collect your name, email address, phone number (if provided), and the message you submit.
• Direct email and calls: If you contact us directly by email or phone, we may retain a record of that communication.
• Advisory engagements: During working sessions, we may take notes that include context you share about your venture, team, or situation. These are held securely and used only to support our work together.
• Website analytics: We use analytics tools to understand how visitors use our website. This includes pages viewed, time on page, and general geographic region. This data is aggregated and does not identify you personally.
• Cookies: Our website uses cookies for basic functionality and analytics. See our Cookie Policy for details.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• Responding to enquiries: To reply to messages submitted through our contact form or received directly.
• Delivering advisory services: To carry out the sessions and engagements you have arranged with us, including preparation and follow-up notes.
• Service communications: To send you information directly related to an active engagement, such as session summaries or scheduling details.
• Website improvement: To understand how our website is used and to make it more useful for visitors.
• Legal compliance: To meet obligations under applicable Thai law and, where relevant, international data protection standards.

We do not use your personal information for automated decision-making or profiling, and we do not sell or rent your data to third parties.

4. Legal Basis for Processing

We process personal information on the following legal bases:

• Consent: When you submit our contact form or agree to cookies, you are giving us consent to process the relevant data.
• Contractual necessity: When you engage our advisory services, processing your information is necessary to perform that engagement.
• Legitimate interests: We may process certain data — such as enquiry records — on the basis that it is in our legitimate business interest to maintain accurate records of communications, provided this does not override your rights.

5. How Long We Retain Your Data

We retain personal information only for as long as it is needed for the purpose for which it was collected, or as required by applicable law. In practice:

• Enquiry records that do not lead to an engagement are held for up to 12 months, then deleted.
• Session notes and engagement records are retained for 3 years following the end of an engagement.
• Analytics data is held in aggregated, anonymised form for up to 26 months.

6. Data Protection Measures

We take reasonable steps to protect personal information against unauthorised access, loss, or misuse. These include:

• Secure, encrypted connections (HTTPS) for our website.
• Access controls that limit who within our practice can view client-related notes and records.
• Storage of working notes in password-protected environments.
• Regular review of data handling practices.

In the event of a data breach that is likely to affect your rights or freedoms, we will notify you and, where applicable, the relevant supervisory authority without undue delay.

7. Third-Party Services

We use a small number of third-party services to operate our website and business. These may process personal data on our behalf and are subject to their own privacy policies:

• Google Analytics: Used to understand website traffic patterns. Data is anonymised before processing where settings allow.
• Email service provider: Used to receive and manage enquiry form submissions.
• Google Maps: Used to display our office location. When you view the map, Google may set cookies. Refer to Google's privacy policy for details.

We do not share personal data with any other third parties except where required by law.

8. Cookies

Our website uses cookies to support basic site functionality, remember your preferences, and collect aggregate usage data. You can manage your cookie choices at any time. For a full explanation of the cookies we use and how to control them, please visit our Cookie Policy.

9. Your Rights

You have the following rights in relation to your personal data:

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can ask us to correct any inaccurate or incomplete data.
• Erasure: You can request that we delete your personal data where there is no longer a valid reason to hold it.
• Portability: Where applicable, you can request your data in a structured, machine-readable format.
• Objection: You can object to processing based on legitimate interests or for direct marketing purposes.
• Restriction: You can ask us to restrict processing in certain circumstances, for example while a dispute is resolved.
• Withdraw consent: Where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within a reasonable timeframe, generally within 30 days.

10. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites, and this policy does not apply to them. We encourage you to review the privacy policy of any site you visit through a link from our pages.

11. Children

Our services are directed at business founders and professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently received data from a minor, please contact us and we will remove it promptly.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable requirements. When we do, the "Last updated" date at the top will be revised. Continued use of our website following an update constitutes acceptance of the revised policy.

13. Contact

If you have any questions about this policy or how we handle your data, please reach out: