Privacy Notice

• Our site sets no cookies and uses no tracking or analytics tools.
• We only get details like your name and email address when you email us yourself.
• Our hosting provider keeps technical data, such as your IP address, in server logs for security and reliability.
• The Google map only loads if you click the button to show it.
• We don’t sell personal data and don’t use it for automated decision-making.
• You can use your PDPA rights at any time. Just write to contact@catherinefarm.com.

The data controller for this website and for email contact is Catherine Farm, Bang Yi Rong, Bang Khonthi District, Samut Songkhram, Thailand.

Contact email: contact@catherinefarm.com

Catherine Farm has not appointed a Data Protection Officer (DPO). Please send any question or request about personal data straight to the email above.

Our site sets no cookies and uses no other tracking technology, such as advertising pixels or analytics. That’s why there is no cookie banner for you to click.

If you choose to show the Google map, Google may set its own cookies or use similar technology under its own policies (see “Maps and links to other sites” below).

We use personal data only for the purposes below, each based on a legal basis in Section 24 of the PDPA.

• Replying to your questions and messages, for example about our fruit or a farm visit — legitimate interest (Section 24(5)): you wrote to us and expect an answer.
• Answering order requests and handling orders agreed by email — performance of a contract, or steps you ask us to take before entering into one (Section 24(3)).
• Keeping accounting and tax records if a sale takes place — legal obligation (Section 24(6)).
• Keeping basic records of our conversations, so we can follow up on what we discussed — legitimate interest (Section 24(5)).
• Keeping the site secure and working, through server logs — legitimate interest (Section 24(5)).

We don’t disclose your personal data to anyone except the following, and only as far as needed:

• Our web hosting provider, which processes server logs as a data processor, on our instructions and on our behalf.
• Our email service provider, which receives, sends and stores email on our behalf as a data processor.
• A delivery service: only the name, address and phone number needed for delivery, and only when we have agreed to send an order to you.
• Government authorities or officials, when the law requires it or under a lawful order.
• Google (only if you click to show the map): we don’t send your data to Google ourselves, but when you do, your browser sends technical data such as your IP address straight to Google, and Google uses it under its own privacy policy.

Our hosting and email providers may process or store data on servers outside Thailand.

When that happens, we follow Sections 28 and 29 of the PDPA, for example by choosing providers that store data in destination countries with adequate personal data protection standards, or providers bound by contract terms with appropriate safeguards, so that your data keeps the level of protection the PDPA requires.

If you click to show the map, your browser connects straight to Google, and Google may process that data outside Thailand under its own policies.

The farm map on this site doesn’t load until you click the button to show it. Once you do, your browser loads content directly from Google, and Google may receive data such as your IP address. Google’s Privacy Policy ↗ (opens in a new tab) applies to that processing.

Our site links to other websites, such as Google Maps and source material from the ReCAP project and GIZ. When you follow those links you leave our site, and the other site’s privacy policy applies. We don’t control how those sites collect data.

We keep data only as long as we need it:

• Emails and enquiries — for as long as our conversation needs, and no longer than 2 years after our last contact, unless the law requires us to keep them longer.
• Sales records needed for accounting and tax — for the period required by Thai accounting and tax law.
• Server logs — only as long as needed for security and troubleshooting, in line with our hosting provider’s retention period, or longer only where the law requires it.
• After that, we delete or destroy the data, or make it anonymous so it can no longer identify you.

We use measures that fit the size of our business to protect data against loss and against unauthorised access, use, change or disclosure. For example:

• the site is served over an encrypted connection (HTTPS)
• access to our mailbox is limited to the people who need it to reply to you
• we choose service providers with appropriate security measures
• we keep only the data we need

This site is not aimed at collecting personal data from minors (in Thailand, generally anyone under 20 who has not yet reached legal age). If you are a minor, please contact us with the consent of a parent or guardian, or ask them to contact us for you.

If we learn that we have received a minor’s data without the consent the law requires, we will delete it.

Under the PDPA you have the following rights. Some of them come with conditions or exceptions set by law.

• Access your personal data and get a copy of it.
• Data portability: receive or transfer your data in a commonly used, machine-readable format.
• Object to the collection, use or disclosure of your data, in particular where we rely on legitimate interest.
• Erasure: ask us to delete or destroy your data, or make it anonymous.
• Restriction: ask us to stop using your data for a time.
• Rectification: ask us to correct your data so it is accurate, up to date, complete and not misleading.
• Withdraw consent where we rely on your consent, without affecting processing done before you withdrew it.
• Complain to the PDPA Expert Committee, through the Office of the Personal Data Protection Committee (PDPC), if you believe we have not complied with the PDPA. See www.pdpc.or.th ↗ (opens in a new tab).

• Email your request to contact@catherinefarm.com. Tell us which right you want to use, and give us something that helps us find your data, such as the email address you used to contact us.
• We may ask for a little more information to confirm who you are before we act, so your data never goes to the wrong person.
• We will act without undue delay and reply within 30 days of receiving your request. If we turn a request down, we will tell you why.

We may update this notice when our site or the way we work changes, or when the law changes. The latest version is always on this page, with the date it was last updated.

If we ever start using cookies or analytics, or collect data in a new way, we will update this notice before we start, and ask for your consent where the law requires it.

If the Thai and English versions of this notice differ, the Thai version prevails.