How MKI Consulting Services collects, uses, discloses and protects personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand.
MKI Consulting Services is the business consulting division of MKI Supplies Co., Ltd. (“MKI”, “we”, “us” or “our”), a company incorporated in Thailand with its registered office at 237/13 Akkra Rat Phattana Road, Rat Phattana, Saphan Sung, Bangkok 10240, Thailand.
For the purposes of the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”), MKI Supplies Co., Ltd. acts as the Data Controller in respect of personal data collected through this website and in the course of providing our consulting services. Where we process personal data on behalf of a client under a consulting engagement, we act as a Data Processor and process that data only on the client’s documented instructions.
This policy applies to personal data we collect through www.mkisupplies.com, through email, telephone, WhatsApp and other messaging channels published on this website, and through business meetings, proposals and engagements arising from those contacts. It explains what we collect, why we collect it, who we share it with and the rights available to you.
This policy does not apply to third-party websites we link to. We encourage you to review the privacy notices of any site you visit.
We collect only the personal data we reasonably need for the purposes described in section 4.
Automatically collected data is gathered through server logs (strictly necessary) and, only where you have given consent, through analytics cookies. See section 5.
We do not seek and do not require sensitive personal data as defined in section 26 of the PDPA (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data or criminal records). Please do not submit such data through this website. If it is provided to us unsolicited, we will delete it unless we are required to retain it by law.
Under the PDPA we must have a lawful basis for each processing activity. The table below sets out how we use personal data and the basis on which we rely.
| Purpose | Data Used | Lawful Basis (PDPA) |
|---|---|---|
| Responding to enquiries and preparing proposals | Identity, contact, enquiry content | Necessity for taking steps at your request prior to entering a contract (s.24(3)) |
| Delivering and administering consulting engagements | Identity, contact, engagement data | Performance of a contract (s.24(3)) |
| Operating, securing and maintaining the website | Technical data, server logs | Legitimate interest in network and information security (s.24(5)) |
| Understanding how the website is used and improving it | Usage data via analytics cookies | Consent (s.19) |
| Remembering your site preferences | Functional cookie data | Consent (s.19) |
| Sending marketing communications and measuring campaigns | Contact data, marketing cookie data | Consent (s.19), withdrawable at any time |
| Accounting, tax, and statutory record keeping | Identity, contact, billing data | Compliance with a legal obligation (s.24(6)) |
| Establishing, exercising or defending legal claims | As relevant to the claim | Legitimate interest / legal obligation (s.24(5), s.24(6)) |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interest, we have assessed that our interest is not overridden by your fundamental rights and freedoms, and you may object to that processing as described in section 10.
Cookies are small text files placed on your device by a website. We also use comparable technologies such as local storage. In line with PDPA requirements and the guidance issued by the Personal Data Protection Committee, no cookie other than a strictly necessary cookie is placed on your device until you have given consent.
When you first visit the site you are shown a consent banner offering, with equal prominence, the options to accept all cookies, reject all non-essential cookies, or select individual categories. Your choice is recorded together with the date, time and version of this policy.
| Category | Purpose | Consent |
|---|---|---|
| Strictly Necessary | Page delivery, security, load balancing and storing your cookie preferences (mki_consent). Cannot be disabled. | Not required |
| Functional | Remembering preferences such as language or region. | Required — off by default |
| Analytics & Performance | Aggregate statistics on how the site is used, so we can improve it. | Required — off by default |
| Marketing | Measuring campaign effectiveness and showing relevant content on other platforms. | Required — off by default |
You can review or change your cookie choices at any time. Withdrawing consent is as straightforward as giving it.
Your consent record is retained for 180 days, after which you will be asked again. If we materially change how we use cookies we will publish a new version of this policy and ask for fresh consent. You can also block or delete cookies through your browser settings, although strictly necessary cookies are required for parts of the site to function correctly.
We do not sell personal data. We disclose it only in the following circumstances:
Some of our service providers, including our content delivery network and font provider, operate servers outside Thailand. Where personal data is transferred abroad we comply with sections 28 and 29 of the PDPA by transferring only to destinations with adequate data protection standards, or by putting in place appropriate safeguards such as contractual clauses obliging the recipient to maintain protection equivalent to that required under Thai law, or by relying on another lawful ground including your explicit consent after being informed of the inadequacy of the destination’s standards.
We retain personal data only for as long as necessary for the purpose for which it was collected, and thereafter as required by law.
| Data | Retention Period |
|---|---|
| Enquiries that do not lead to an engagement | 24 months from last contact |
| Client engagement and correspondence records | Duration of the engagement plus 10 years |
| Accounting and tax records | 10 years, as required by the Revenue Code and the Accounting Act |
| Website server logs | 90 days |
| Cookie consent records | 180 days, or until withdrawn |
| Marketing contact data | Until consent is withdrawn, then a suppression record only |
At the end of the applicable period we securely delete, destroy or irreversibly anonymise the data.
In accordance with section 37 of the PDPA we maintain appropriate organisational, technical and physical measures to protect personal data against unauthorised or unlawful access, alteration, disclosure, loss or destruction. These include encryption of data in transit using TLS, access control on a need-to-know basis, restricted administrative privileges, secure configuration and patching of systems, confidentiality obligations for staff and contractors, and periodic review of our controls.
Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of it, and will notify affected data subjects where the breach carries a high risk.
Subject to the conditions and exemptions in the PDPA, you have the following rights:
To exercise any right, please contact us using the details in section 15. We may ask for information sufficient to verify your identity before acting on a request, in order to protect your data from disclosure to the wrong person.
We will respond within 30 days of receiving a valid request, as required by the PDPA. If we need longer because a request is complex, we will tell you within that period and explain why. There is no charge for a request unless it is manifestly unfounded or excessive, in which case we will inform you of any reasonable fee before proceeding. If we decline a request, we will record the reason and inform you of your right to complain to the Office of the Personal Data Protection Committee.
This website is a business-to-business resource and is not directed at children. We do not knowingly collect personal data from anyone under 20 years of age without the consent of a person exercising parental responsibility, as required by section 20 of the PDPA. If you believe a minor has provided us with personal data, please contact us and we will delete it.
This website contains links to external sites and messaging services, including WhatsApp. Following such a link takes you to a service operated by a third party under its own privacy notice and cookie practices, over which we have no control and for which we accept no responsibility.
We review this policy periodically and may update it to reflect changes in our practices, technology or legal obligations. The effective date and version number appear at the top of this page. Where a change materially affects how we use your personal data, or where new cookie categories are introduced, we will seek fresh consent through the cookie banner and, where appropriate, notify you directly.
For any question about this policy, to exercise your rights, or to raise a concern about how we handle personal data, please contact:
| Data Controller | MKI Supplies Co., Ltd. (MKI Consulting Services) |
|---|---|
| Registered Address | 237/13 Akkra Rat Phattana Road, Rat Phattana, Saphan Sung, Bangkok 10240, Thailand |
| Privacy Contact | info@mkisupplies.com |
| Telephone | +66 (0) 81 348 1458 · +66 (0) 81 566 3454 |
| Response Time | Within 30 days of a valid request |
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC), Ministry of Digital Economy and Society, 9th Floor, Ratthaprasasanabhakti Building, Government Complex, Chaeng Watthana Road, Lak Si, Bangkok 10210, Thailand.