Privacy policy

Last updated: 31 August 2026

Conceptduo Co., Ltd. respects your privacy and takes the protection of personal data seriously.

This Privacy Policy explains how we collect, use, store and disclose personal information when you visit concepduo.com, contact us, request a quotation or use our services.

It also explains the rights available to you under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and other applicable data protection law.

1. Who We Are

The Data Controller responsible for personal data covered by this Privacy Policy is:

Conceptduo Co., Ltd.
Company Registration and Tax Identification Number: 0105569079172

Conceptduo Co., Ltd. is a limited company registered in Thailand and operates under the name Concepduo. Both names refer to the same company.

Registered Address:
119/61 Soi Phraya Suren 23, Bang Chan, Khlong Sam Wa, Bangkok 10510, Thailand

Email: hello@concepduo.com
Telephone: +66 65 429 2825
Website: https://concepduo.com

Data Protection Contact

We are not required to appoint a Data Protection Officer under Section 41 of the PDPA, as we do not carry out large scale monitoring or process large volumes of sensitive personal data.

All questions and requests about personal data should be sent to hello@concepduo.com.

2. Personal Data We May Collect

The information we collect depends on how you interact with us.

Contact information

This may include:

• your name
• email address
• telephone number
• company name
• job title
• and other contact details you provide

Project and business information

When you request a quotation or work with us, we may collect:

• information about your company
• project requirements
• website information
• branding information
• marketing objectives
• budgets
• technical requirements
• login or access credentials where necessary for the project
• and information you provide as part of the project

Communication information

We may retain communications sent through:

• contact forms
• email
• telephone
• messaging platforms
• video meetings
• project management tools
• and other business communication channels

Transaction and billing information

Where you become a Client, we may process information necessary for:

• quotations
• contracts
• invoices
• accounting
• payments
• refunds
• and financial records

Payments are handled by external providers, including banks and card payment providers. Those providers process your payment details under their own privacy terms. We do not collect or store full payment card numbers.

Website and technical information

When you visit our website, certain information may be collected automatically, including:

• IP address
• browser type
• device type
• operating system
• pages visited
• referring website
• approximate location derived from technical information
• date and time of access
• and website interaction information

This information may be collected through server logs, cookies, analytics tools or similar technologies.

If you do not provide personal data

Some information is necessary for us to respond to an enquiry, prepare a quotation or provide our services. Where you choose not to provide it, we may be unable to respond to your request or deliver the service.

3. How We Collect Personal Data

We may collect personal information:

• directly from you
• when you submit a website form
• when you contact us
• when you request a quotation
• when you become a Client
• during a project
• through website technologies such as cookies
• from publicly available business sources
• from a company or representative acting on your behalf
• or from a referral where the person providing your details is entitled to do so

4. Why We Use Personal Data

We use personal data only where there is an appropriate purpose and legal basis.

Responding to enquiries

We use contact and project information to respond when you contact us or request information about our services.

Preparing quotations and proposals

We use information you provide to understand your requirements, assess a potential project and prepare a quotation or proposal.

Providing contracted services

If you become a Client, we process information necessary to:

• manage your project
• communicate with you
• provide the agreed services
• provide support
• manage revisions and approvals
• deliver work
• and administer the commercial relationship

Billing and accounting

We process information necessary to issue invoices, record transactions, manage payments and meet accounting and tax obligations under Thai law.

Operating and protecting our website

Technical information may be used to:

• operate the website
• diagnose technical problems
• protect against fraud or abuse
• maintain security
• understand website performance
• and improve usability

Improving our business and services

We may use business and usage information to understand how our services are used and improve our website, services and internal operations.

Marketing

We send direct marketing only where you have given consent, or where you are an existing Client and the communication relates to services similar to those we have already provided to you.

You may withdraw consent or ask us to stop marketing communications at any time. See Section 17.

Legal and regulatory requirements

We may process information where necessary to:

• comply with applicable law
• maintain tax and accounting records
• establish or defend legal claims
• respond to lawful requests from public authorities
• prevent fraud
• and protect our legal rights

5. Legal Bases for Processing

Depending on the circumstances, we process personal data on one or more of the following grounds under the PDPA.

Contract (Section 24(3))

Processing may be necessary to take steps at your request before entering into a contract, or to perform a contract with you.

Legal obligation (Section 24(6))

We process information where required to meet an obligation imposed by Thai law, including tax, accounting and company law obligations.

Legitimate interests (Section 24(5))

We process information where reasonably necessary for our legitimate business interests, provided those interests do not override your fundamental rights. Examples include:

• responding to business enquiries
• maintaining website security
• preventing fraud
• maintaining business records
• improving our services
• and managing business relationships

Consent (Section 19)

Where the law requires consent, we ask for it before carrying out the relevant processing. This applies to non essential cookies and to direct marketing.

If processing relies on your consent, you may withdraw that consent at any time, and withdrawal is as easy as giving it. Withdrawal does not affect processing that was lawfully carried out before consent was withdrawn.

6. Sensitive Personal Data

We do not need sensitive personal data as defined in Section 26 of the PDPA to provide our services. This includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, criminal records, health data, disability, trade union membership, genetic data, biometric data or sexual orientation.

Please do not send us sensitive personal information.

If sensitive personal data is provided to us unnecessarily, we will delete it.

7. Children’s Data

Our website and services are intended for businesses and adults.

Under Section 20 of the PDPA, a person under 20 years of age is treated as a minor in Thailand, and processing their personal data generally requires the consent of a parent or legal guardian.

We do not knowingly collect personal data from anyone under 20. If you believe we have done so, contact us at hello@concepduo.com and we will delete it.

8. Sharing Personal Data

We do not sell personal data.

We may share limited personal information where reasonably necessary with service providers and professional partners that support our business. These may include:

• hosting providers
• cloud service providers
• email providers
• analytics providers
• website technology providers
• payment providers
• accountants
• legal advisers
• developers
• designers
• writers
• contractors
• technical specialists
• and other service providers involved in delivering a project

Only information reasonably required for the relevant purpose is shared.

We may also disclose information where required by law, a court, regulatory authority or other legally authorised body.

9. Contractors and Project Partners

Some projects involve independent specialists or external service providers.

Where they need access to personal information to perform work for Concepduo, we require them to use the information only for the required purpose, to keep it confidential, and to apply appropriate security measures. We remain responsible for their handling of that data.

10. Client Systems and Personal Data Processed for Clients

During website development, maintenance, SEO, technical support or similar services, Concepduo may have access to personal data held in a Client’s website or systems.

In those circumstances the Client is the Data Controller and Concepduo acts as a Data Processor on the Client’s behalf.

Where we act as a Data Processor, and as required by Section 40 of the PDPA:

• we process personal data only on the Client’s instructions
• we apply appropriate security measures
• we require our staff and subcontractors to keep the data confidential
• we notify the Client without undue delay after becoming aware of a personal data breach affecting that data
• we assist the Client, so far as reasonable, in responding to requests from data subjects
• and we delete or return the data at the end of the service, unless we are required by law to retain it

The Client remains responsible for its own privacy notice and for its obligations as Data Controller.

Where a project involves substantial processing of personal data, a separate Data Processing Agreement may be signed.

This Privacy Policy describes personal data for which Conceptduo Co., Ltd. acts as the Data Controller.

11. International Data Transfers

Some technology and service providers we use may process or store information outside Thailand. This may include hosting, cloud storage, email, analytics and payment services.

Where personal data is transferred outside Thailand, we comply with Sections 28 and 29 of the PDPA. We transfer data only where one of the following applies:

• the destination country has adequate data protection standards
• the transfer is necessary to perform a contract with you, or to take steps at your request before entering a contract
• appropriate safeguards are in place with the recipient, such as contractual data protection terms
• you have given consent after being informed of the standards in the destination country
• or another lawful ground under the PDPA applies

You may ask us which providers process data outside Thailand by contacting hello@concepduo.com.

12. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Cookies are small files stored on your browser or device which help websites function properly and provide information about how they are used.

Essential cookies

Some cookies are necessary for:

• website security
• basic website functionality
• navigation
• forms
• and remembering essential preferences

These are used because the website cannot function properly without them, and they do not require consent.

Analytics cookies

Analytics technologies help us understand:

• which pages are visited
• how visitors reach the website
• how visitors interact with pages
• and whether technical problems occur

Marketing and third party cookies

Where we use advertising, embedded content or other technologies that require additional cookies, these are controlled through our cookie consent banner.

Analytics, marketing and other non essential cookies are not activated until you have given consent. You can change or withdraw your cookie choices at any time through the cookie settings on our website.

You may also control cookies through your browser settings. Disabling some cookies may affect website functionality.

13. How Long We Keep Personal Data

We do not keep personal data indefinitely. We keep it only for as long as necessary for the purpose for which it was collected, or for as long as the law requires.

The following periods apply as a general guide:

Where a longer period is needed to establish or defend a legal claim, we retain the relevant information until the matter is resolved and any limitation period has expired.

When information is no longer required, we delete it, securely destroy it or anonymise it.

14. Data Security

We take reasonable organisational and technical steps to protect personal data against unauthorised access, loss, misuse, alteration, destruction and unauthorised disclosure. These measures include:

• encrypted connections (HTTPS) on our website
• access controls and individual accounts for staff and contractors
• limiting access to personal data to those who need it
• regular software and security updates on systems we manage
• regular backups
• and confidentiality obligations for staff and contractors

No internet connected system can be guaranteed to be completely secure. We cannot promise absolute security, but we take precautions appropriate to the information being processed and the nature of our business.

Data Breach Notification

Where a personal data breach occurs, we will notify the Personal Data Protection Committee without undue delay and within 72 hours of becoming aware of it, where required by Section 37(4) of the PDPA.

Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.

15. Your Rights

Subject to the conditions and exceptions in the PDPA, you have the following rights over your personal data.

Right of access (Section 30). You may request access to personal data we hold about you and request a copy.

Right to correction (Section 36). You may ask us to correct information that is inaccurate, incomplete, misleading or out of date.

Right to deletion (Section 33). You may request deletion, destruction or anonymisation of personal data where the law provides that right.

Right to restrict processing (Section 34). You may ask us to suspend the use of your personal data in the circumstances the law provides.

Right to object (Section 32). You may object to certain processing, including processing based on legitimate interests and processing for direct marketing.

Right to data portability (Section 31). Where applicable, you may request personal data in a machine readable format, or ask us to send it to another controller.

Right to withdraw consent (Section 19). Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing lawfully carried out before it.

Right to complain (Section 73). You may submit a complaint to the Personal Data Protection Committee if you believe your personal data has been handled unlawfully.

Office of the Personal Data Protection Committee
Ministry of Digital Economy and Society
Website: https://www.pdpc.or.th

Some rights are subject to legal conditions and exceptions. We may need to verify your identity before responding.

16. How to Exercise Your Rights

To make a request concerning your personal data, contact:

Email: hello@concepduo.com

Please provide enough information for us to identify the relevant data and understand your request.

We may ask for additional information where reasonably necessary to verify your identity or to protect information from unauthorised disclosure.

We will respond within 30 days of receiving a valid request, as required by the PDPA. Where a request is complex, we may extend this period and will tell you the reason.

There is no charge for a request. Where a request is manifestly unfounded or repetitive, we may charge a reasonable fee or decline it, and we will explain why.

17. Marketing Communications

You can ask us to stop sending direct marketing communications at any time. You may do so by:

• using the unsubscribe option in the message
• or contacting hello@concepduo.com

We will act on the request without delay.

Stopping marketing communications does not prevent us from sending necessary communications relating to an active enquiry, project, contract, invoice or service.

18. Third Party Websites

Our website may contain links to websites operated by other organisations.

Their privacy practices are outside our control.

We recommend reviewing the privacy information provided by those websites before submitting personal information to them.

19. Changes to This Privacy Policy

We may update this Privacy Policy when:

• our services change
• the technologies we use change
• our processing activities change
• or legal requirements change

The latest version will be published on concepduo.com and the “Last updated” date will be revised.

Where a change materially affects how we use your personal data, we will tell you before the change takes effect, and obtain your consent where the law requires it.

20. Applicable Law

This Privacy Policy operates in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (2019).

Where another mandatory data protection law applies to a particular processing activity, we handle that activity in accordance with the requirements applicable to it.

21. Contact Us

For questions about this Privacy Policy, our handling of personal data or a request concerning your personal data, contact:

Conceptduo Co., Ltd. (operating as Concepduo)
119/61 Soi Phraya Suren 23, Bang Chan, Khlong Sam Wa, Bangkok 10510, Thailand
Email: hello@concepduo.com
Telephone: +66 65 429 2825
Website: https://concepduo.com