นโยบายความเป็นส่วนตัว
How Tropical Media (Tropical Media Co., Ltd.) processes personal data on tropical-media.work under Thailand's PDPA and the EU GDPR.
Tropical Media Co., Ltd. ("Tropical Media", "we", "us") operates tropical-media.work. We are a company established in Thailand, and we process personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
Because we offer our services to customers in the European Union and European Economic Area, we also process the personal data of individuals in the EU/EEA in accordance with the EU General Data Protection Regulation ("GDPR") (Articles 13 and 14). Where both laws apply, we give you the benefit of the higher standard of protection.
1. Data controller
Tropical Media Co., Ltd.
179 Moo 1, Tubprik, Muang Krabi, 81000 Krabi, Thailand
Company registration / Tax ID: 0815563000977
Email: [email protected]
We are the "data controller" under the PDPA and, for individuals in the EU/EEA, under the GDPR.
2. EU Representative (Article 27 GDPR)
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
- European Union (EU)
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/cortilehq
See our EU Representative page for details. You may also write to us directly at [email protected].
3. What we process, why, and on what legal basis
The legal bases below are stated under the GDPR; the PDPA recognises equivalent lawful bases (consent, necessity for a contract / pre-contractual steps, and legitimate interest), which we rely on for the same purposes.
| Purpose | Data | Legal basis (GDPR / PDPA equivalent) |
|---|---|---|
| Contact form | First name, name, email, company, service of interest, message, newsletter choice, page and language you used | Art. 6(1)(b) pre-contractual steps and/or Art. 6(1)(a) consent; PDPA s.24 |
| Free AI workflow check | Your answers (industry, team size, website, workflow description, tools, volume, goals, AI preference, constraints), name, email, company, report language, consent record | Art. 6(1)(a) consent and Art. 6(1)(b) pre-contractual steps; PDPA s.19/s.24 |
| AI assistant (chat) | Your messages and the assistant's replies, page and language, time, and contact details only if you share them in the chat | Art. 6(1)(f) legitimate interest in answering inquiries; Art. 6(1)(b) where you ask about our services; PDPA s.24 |
| Newsletter | Email, source of the sign-up, consent timestamp | Art. 6(1)(a) consent; PDPA s.19 |
| Abuse prevention (rate limits, spam protection) | A salted, one-way hash of your IP address; the IP address itself is not stored | Art. 6(1)(f) legitimate interest; PDPA s.24(5) |
| Server and proxy logs | IP address, user agent, timestamp, requested URL | Art. 6(1)(f) legitimate interest; PDPA s.24(5) |
| Website analytics (only with your consent) | Pages visited, device and browser data, shortened IP address, Google Analytics cookies | Art. 6(1)(a) consent; PDPA s.19 |
4. AI processing
The free workflow check and the website assistant use a large language model to answer you. Your answers or chat messages are sent from our own automation server to our AI provider, Anthropic PBC (USA), under its commercial terms, which exclude using customer inputs to train its models. The output is a report or a chat reply; we do not make decisions with legal or similarly significant effects about you based solely on automated processing (Art. 22 GDPR).
Please don't enter sensitive personal data (e.g. health data) or confidential third-party data into the workflow check or the chat.
5. Where your data lives, recipients and processors
Website data is handled by systems we operate ourselves:
- Hetzner Online GmbH (Germany, EU) hosts our servers: the website, our content and lead database (Directus, self-hosted) and our automation server (n8n, self-hosted). Contact requests, workflow checks, chat sessions and newsletter sign-ups are stored there.
- Cloudflare, Inc. (USA/global) delivers the website (content delivery network, DNS, TLS and attack protection). Cloudflare processes connection data such as your IP address, never the content of your form submissions beyond what is needed to deliver them.
- Anthropic PBC (USA) generates workflow-check reports and assistant replies (see section 4).
- Google Ireland Ltd. / Google LLC provides Google Analytics, only if you allow analytics cookies (see the Cookie Policy). IP addresses are shortened.
- Email delivery service: reports and replies are sent via an email provider acting as our processor, bound by a data-processing agreement.
Fonts and images are served from our own domain; your browser does not contact Google Fonts or image services when you visit our pages.
6. International data transfers
Personal data collected on this website is stored in the European Union (Hetzner, Germany). Because our company and team are located in Thailand, we access that data remotely from Thailand to operate the service and respond to your requests.
- For EU/EEA personal data: Thailand is not the subject of an EU adequacy decision. Our access from Thailand is protected by appropriate safeguards under Chapter V GDPR, including arrangements based on the EU Standard Contractual Clauses, together with technical and organisational measures (EU data at rest, encrypted transport, least-privilege access). Transfers to Anthropic, Cloudflare and Google in the USA rely on the EU-U.S. Data Privacy Framework where the recipient is certified, and on the EU Standard Contractual Clauses otherwise. You may request more information about these safeguards via [email protected].
- Under the PDPA: where personal data under our control is transferred out of Thailand's scope of protection, we do so in accordance with PDPA ss.28–29 (adequate protection or appropriate safeguards).
7. Retention
- Contact requests and workflow checks: 24 months after your last interaction with us, then deleted.
- Assistant chats: 12 months, then deleted; longer only if the chat led to a project inquiry, under the same rule as contact requests.
- Newsletter: until you unsubscribe or withdraw consent.
- Server and proxy logs: 14 days, then deleted automatically.
- Analytics data: 14 months in Google Analytics.
8. Your rights
Under both the PDPA and the GDPR you have the right to: access a copy of your data; rectification of inaccurate data; erasure; restriction of processing; data portability; and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing, for analytics via "Cookie settings" in the footer.
To exercise any right, email [email protected]. We respond within the timeframes required by the applicable law (at the latest within 30 days under the PDPA and one month under the GDPR).
Exercise your data subject rights under GDPR
We provide you with an easy way to submit privacy-related requests to us, such as a request to access or erase your personal data. If you want to make use of your data subject rights, please visit our Trust Center: https://app.prighter.com/portal/cortilehq
9. Complaints
- Thailand: you may lodge a complaint with the Office of the Personal Data Protection Committee (PDPC), Thailand.
- EU/EEA: you also have the right to lodge a complaint with the data-protection supervisory authority in your member state of residence or work.
10. Governing law
This policy and our processing of personal data are governed by the laws of Thailand, without prejudice to the mandatory data-protection rights available to you under the GDPR and your local law as an individual in the EU/EEA.
11. Changes
We may update this policy to reflect changes in our processing or the law. The current version is always available at this URL.
Last updated: 9 November 2026.