Privacy Policy

1. Who we are

Wikanda Lorsuwan, trading as Adscraft Digital (a performance-marketing consultancy in Bangkok), is the data controller. This means they decide why and how your personal data is used.

We are a small business and have not appointed a Data Protection Officer (DPO). For any privacy question or request, contact us directly through these channels:

• LINE: @adscraftdigital (https://line.me/R/ti/p/%40adscraftdigital)
• Email: vicky@adscraftdigital.com
• Phone: 082 204 0646
• Registered mail, or in person (please book ahead if you can): 8/665 Soi Ramkhamhaeng 60, Hua Mak, Bang Kapi, Bangkok 10240, Thailand

2. What data we collect

We collect only what we need. What we collect depends on how you use our website or contact us.

Please do not enter patient details, such as a patient's name, symptoms, treatment history, test results or before-and-after photos, in the Maps Check fields, form message or chats. The same goes for other sensitive data, such as religion or fingerprints. We do not need it. If we receive such data, we will not use it and will delete it promptly.

• Contact form: your name, business name, LINE ID or phone number, email (optional), the service you are interested in, your message (optional), and a box to receive news and offers (optional). We need your name, business name and LINE ID or phone number to reply. Without them, we cannot reply. If you tick the box, we also record the date and the version of the consent text.
• Maps Check, answers: your answers to 12 multiple-choice questions about your own Google Business Profile. You must answer all of them to see a result. After you submit the form, the page shows your result on screen right away: your score out of 100, your band, your points for each area and your top 3 fixes (you can open the rest). The result is based only on your answers. It is not a real profile audit and not a Google score. We keep the points you got for each question with your contact details (see the next item).
• Maps Check, contact details: before you see your result, you must enter your contact name, your business name (clinic, shop or other business), your business type (1 of 8 types, such as restaurant/café or clinic/health) and your phone number or LINE ID, and tick the consent box. Without them, the page cannot show your result. The Maps Check does not ask for your email. When you submit the form, we save your contact name, business name, business type, phone number or LINE ID, total score, band, the points for each of the 12 questions, the page address (including any tracking parameters in the link, such as utm), the date and time, and the version of the consent text you agreed to, as one row in our Google Sheet (see section 5).
• Technical data: when you open any page on our website, including the Maps Check page, our hosting provider keeps server logs (records of visits to the site), such as IP address (the number that identifies your internet connection), browser type, page visited and time. When you submit the Maps Check form, Google receives your IP address and browser details as part of the request and handles them under Google's terms. We do not save your IP address with your result.
• LINE, Facebook Messenger, Instagram, phone and email: if you contact us this way, we see what that channel shows us, such as your display name, profile picture, LINE user ID, phone number or email address, and the messages you send. If you add our LINE Official Account as a friend, LINE gives us an internal LINE user ID so we can send you messages.
• Website usage data: our website does not currently use analytics or advertising cookies (see section 7). The Maps Check page adds usage events to a list inside the page (called the dataLayer): starting the check, answering all questions, submitting the form (with score, band and business type), showing the result (with score and band), and clicks on our LINE button. These events do not include your name, business name, phone number or LINE ID. No measurement tool is loaded on the page now, so this data is not sent to any tool. If we add Google Tag Manager or Google Analytics 4 later, the consent rules in section 7 apply.
• Ad budget calculator: the numbers you enter stay in your browser. We do not receive or store them.
• Clients: if you hire us, we also keep the details we need to do the work and bill for it, such as contact persons, quotes, invoices and work records. When we manage ad, analytics or tracking accounts for a client, we process the client's customer data as the client's data processor, on the client's instructions. That client's privacy policy covers that data.

3. Data we get from other sources

Besides what you give us yourself, we may get data from these sources.

When we first contact a clinic or business using data from these sources, we say where we got it and include a link to this policy. You can ask us to stop contacting you or to delete the data at any time (see section 8).

• Public information about clinics and businesses: name, area, category, review count, and public social and LINE accounts (such as Facebook, Instagram, TikTok and LINE) with follower counts, from Google Maps and those platforms. Where a clinic or page is named after a doctor or owner, this is personal data. We use it for Bangkok Clinic Radar benchmarks and to offer our services. Legal basis: legitimate interest. You can object at any time.
• Details someone else enters in the Maps Check: a user may enter another business's name and answer the questions about that business's profile. We handle that data as described in section 2.

4. Why we use your data, and our legal basis

The PDPA lets us use personal data only when we have a legal reason (a legal basis). We use your data only for the purposes below. If we want to use it for a new purpose, we will tell you first and ask for your consent where the law requires.

• To answer your questions from the contact form, chats, email or phone before any work is agreed. Legal basis: steps you asked for before we agree on any work. No consent is needed, and you do not have to tick any box for us to reply.
• To show the Maps Check result you ask for: your score out of 100, your band, your points for each area and your top 3 fixes (you can open the rest), on screen. Legal basis: providing the service you asked for.
• To keep the details you enter in the Maps Check with your result, send you the result, and contact you by phone or LINE about the result and related services (our Google Maps services). Legal basis: your consent (the consent box on the Maps Check page, which you must tick to see your result). We also record the version of the consent text you agreed to. The Maps Check page is in Thai. Its consent box says (our English translation): “I agree that Adscraft Digital may keep this information with my check result, to send me the check result and contact me by phone or LINE about the check result and related services. Consent can be withdrawn at any time via LINE @adscraftdigital, as set out in the Privacy Policy.” You can withdraw your consent at any time (see section 8).
• To send you news and offers about our services by LINE, phone or email. Legal basis: your consent. On the contact form this is a separate, optional box that is not ticked in advance; if you leave it unticked, we still answer your question. In chats and emails we ask before sending offers and record the date.
• To send broadcast messages from our LINE Official Account to people who added it as a friend. Legal basis: legitimate interest, because you chose to add us. You can stop them at any time by blocking the account or replying “STOP”.
• To work for you as a client, such as planning and running campaigns, reporting and billing. Legal basis: our contract with you. If we do not get the details we need, we may not be able to do the work.
• To do what the law requires, such as keeping tax and accounting records, or when a government body asks under the law. Legal basis: legal obligation.
• To measure our website and ads with analytics and ad cookies. We do not do this now. If we start, we will ask for your consent first through a banner. Legal basis: your consent.
• To keep the website and the Maps Check working and safe, such as keeping server and error logs, using necessary cookies and loading fonts so pages display correctly. Legal basis: legitimate interest. This means we have a reasonable business need that does not unfairly affect your rights and that you would expect. You can object to this use (see section 8).
• To build Bangkok Clinic Radar benchmarks and offer our services to clinics, using public information (see section 3). Legal basis: legitimate interest. You can object at any time.
• To keep a minimal record (contact channel, date, consent version) so we do not contact you again after you withdraw consent or object, and to show we complied with the law, including a log of rights requests we refused and why. Legal basis: legal obligation and legitimate interest.

5. Who receives your data, and transfers abroad

We share data only with the recipients below. Providers that process data for us (Namecheap, our email provider, and Google for Google Sheets, Google Apps Script and measurement tools) may use it only on our instructions and to provide their service to us. Platforms you choose to use (LINE, Meta, Fastwork), and Google when it serves fonts, handle data under their own policies. We do not sell your personal data.

Transfers abroad: several recipients below store or process data outside Thailand, mainly in the United States and Japan, and in other countries where they have servers. These countries may have lower data protection standards than Thai law. We transfer data abroad only where the PDPA allows it. The reason for each recipient is given in the list below.

Links to other sites: our website links to LINE, Facebook, Instagram, Threads, Fastwork and our other projects. When you click a link, that site's own privacy policy applies. We do not control those sites.

• Namecheap, Inc. (a US company): provides our web server space (hosting), including the Maps Check page, and stores server logs and, if our form plugin keeps them, copies of contact form messages in our website database. What you enter in the Maps Check is not stored at Namecheap. Our server is located in the United States. Reason for transfer abroad: needed to provide the service you ask for, under Namecheap's data processing terms.
• The email provider for adscraftdigital.com (United States): receives contact form messages and emails sent to vicky@adscraftdigital.com. Reason for transfer abroad (if any): needed to answer you, under the provider's data processing terms.
• Google LLC (United States), Google Sheets and Google Apps Script: when you submit the Maps Check form, your browser sends your details to Google Apps Script (a small program that runs in our Google account), which saves them as one row in our Google Sheet (for the list of data, see section 2). Google receives your IP address and browser details as part of the request and handles them under Google's terms. Google has servers in many countries. Reason for transfer abroad: Google Workspace's data processing terms, which set out safeguards for the data.
• Google LLC (United States), Google Fonts: when you open a page, your browser sends your IP address and browser details to Google in the US to load the fonts, as part of showing the page. Google handles this data under its own policy.
• Google LLC (United States), Google Tag Manager, Google Analytics 4 and Google Ads: only if we turn them on (see section 7). If we start using analytics or ad cookies, we will ask for your consent first, and the banner will say that data goes to the US.
• LY Corporation (Japan): runs LINE and our LINE Official Account. You send data to LINE yourself when you use the app, and your LINE chats with us are also covered by LY Corporation's privacy policy.
• Meta Platforms, Inc. (United States): runs Facebook, Messenger, Instagram and Threads. If you contact or follow us there, you share data with Meta under its terms, and Meta's privacy policy also applies.
• Fastwork (Thailand): if you hire us through Fastwork, Fastwork's own terms and privacy policy apply.
• Your phone network: carries calls and messages.
• Government bodies, courts or police: only when the law requires.

6. How long we keep your data

We keep data only as long as we need it for the purposes in section 4. When the time is up, we delete it, destroy it, or make it anonymous so it can no longer identify you. For Maps Check details, we delete your row from the Google Sheet.

• Maps Check details (contact details and result in the Google Sheet): until you withdraw consent, or 2 years from the date you submitted them, whichever comes first.
• Contact form messages (in our mailbox, and in our website database if our form plugin keeps them), chats and emails from people who do not become clients: 2 years from the date we received your last message.
• Contact details you agreed we may use for news and offers: until you withdraw consent, or 2 years from the date you gave consent, whichever comes first.
• Client records: 5 years after the project ends, or longer if the law requires.
• Server and error logs at our host: 90 days.
• Google Analytics data (if we turn it on): 2 months, as set in our Google Analytics account. Summary reports with no personal identifiers may be kept longer.
• Public clinic information in Bangkok Clinic Radar: 1 year from the date it was collected, or until you object, whichever comes first.
• Minimal record so we do not contact you again: for as long as we need it for that purpose. Consent and rights-request records: 3 years from the date the consent ended or the request was closed.
• Messages in LINE, Messenger and Instagram: what we keep follows the same period as contact form messages, or client records if you are a client. These platforms keep their own copies under their own policies.

7. Cookies and measurement tools

Cookies are small files that a website saves in your browser.

Necessary cookies: our WordPress site and hosting may set a few cookies that the site needs to work and stay secure: WordPress login cookies and hosting security cookies. These do not need your consent, and we rely on legitimate interest for them (see section 4).

Analytics and ad cookies: we do not currently use analytics or advertising cookies. If we start using Google Analytics or Google Ads, we will add a consent banner that lets you refuse as easily as you accept, and we will update this policy first.

Maps Check page: the page's own code sets no cookies, and no analytics or ad cookies are used on it. The page adds the usage events listed in section 2 to the dataLayer, but no measurement tool is loaded on it now. If we later add Google Tag Manager (the tool we use to add measurement code) or Google Analytics 4 to this page, the rules for analytics and ad cookies above apply.

Google Fonts sets no cookies, but your browser sends your IP address and browser details to Google to load the fonts. The Maps Check page and the ad budget calculator do not save anything in your browser's storage.

If you block cookies or measurement code, the website and the Maps Check still work as normal.

How to refuse or limit data:

• Block or delete cookies in your browser settings.
• Install Google's opt-out add-on for Google Analytics: https://tools.google.com/dlpage/gaoptout
• Manage your Google ad settings: https://myadcenter.google.com

8. Your rights and how to use them

Under the PDPA, you have the rights listed below. To use them, contact us through the channels in section 1: LINE, email, phone, registered mail, or in person at 8/665 Soi Ramkhamhaeng 60, Hua Mak, Bang Kapi, Bangkok 10240, Thailand (please book ahead if you can). Tell us what you want and the email, phone number or LINE ID you used with us.

We may ask you to confirm who you are before we act. We review your request within 15 days. If it is incomplete, we will give you at least 15 days to complete it. We then act within 30 days of a complete request, which may be extended by up to 30 days, and we will tell you why. Some rights have limits under the law. For example, we may need to keep certain records by law. If we cannot do what you ask, we will tell you why, and we will record your request and our reason.

When you withdraw consent, object or ask us to delete your data, we keep a minimal record (contact channel, date, consent version) so we do not contact you again and can show we complied with the law (see sections 4 and 6).

• Withdraw consent: at any time, in one step. Reply “STOP” (or “ยกเลิก”) to any message from us, or tell us by LINE @adscraftdigital or email. Every offer we send by email or LINE says how to stop. We act within 7 days, and we stop using and delete the data we hold based on that consent. Anything we did lawfully before you withdrew stays lawful. What withdrawing means: if you withdraw from offers only, we stop sending offers but can still answer your questions. If you withdraw your Maps Check consent, we stop contacting you about your result and related services, and delete your row from the Google Sheet. Our website does not currently use cookies that need your consent (see section 7).
• Access and copy: ask for a copy of your data, or ask us where we got data that you did not give us yourself.
• Data portability: ask for your data in a common electronic format, or ask us to send it to someone else where this is technically possible.
• Object: ask us to stop using your data based on legitimate interest (including data from other sources in section 3), or to stop sending you offers about our services (direct marketing). See section 4. For LINE broadcasts, you can block our account at any time.
• Delete: ask us to delete or destroy your data, or make it anonymous. For Maps Check details, we delete them from the Google Sheet and from our chats and emails with you, except the minimal record described above.
• Restrict: ask us to pause using your data for a time, for example while we check your request.
• Correct: ask us to fix data that is wrong, out of date or incomplete.
• Complain: if you think we have broken the PDPA, you can complain to the Office of the Personal Data Protection Committee (PDPC) at www.pdpc.or.th

9. How we keep your data safe

We take reasonable steps to protect your data, but no system is 100% secure. If a data breach happens, we will report it to the PDPC office as the law requires. If the risk to you is high, we will tell you too.

Steps we take include:

• The Maps Check sends your details and result to Google Apps Script over HTTPS, so they are encrypted on the way.
• Only the owner of Adscraft Digital and the providers in section 5 can access your data, and only as far as needed.

10. Children

Our services are for businesses and business owners. They are not meant for people under 20 years old, the age of legal adulthood in Thailand.

We do not knowingly collect data from people under 20. If you are under 20, please do not send us your personal data. If you are a parent or guardian and think your child has sent us data, please contact us and we will delete it.

11. Changes to this policy and effective date

We may update this policy when our services, tools or the law change. We will post the new version on this page and update the effective date.

If a change affects how we use data you gave us with consent, for example a new purpose, we will tell you and ask for your consent again where the law requires.

We keep past versions of this policy, and every version of our consent texts with the dates each was in use. Contact us if you want to see them.

This policy is in Thai and English. If they differ, the Thai version applies.

Effective date: 16 October 2026