Privacy Policy

1. Who We Are

The data controller is Riverlume, located at 77 Convent Road, Silom, Bang Rak, Bangkok 10500, Thailand. For all data-related queries, contact us at [email protected].

We provide financial operations advisory services — budgeting setup, process reviews, and ongoing advisory engagements — on a non-regulated, operational basis.

2. Data We Collect

We collect personal data in the following ways:

• Contact form submissions: name, email address, and optionally phone number and a message.
• Session and engagement correspondence: emails, notes, and documents you share during an advisory engagement.
• Website analytics: anonymised usage data via cookies (see our Cookie Policy).
• Business information: operational figures and process documentation you share as part of a service engagement. This data relates to your business rather than your personal data, but may incidentally contain personal information.

3. Legal Basis for Processing

• Contract performance: processing your contact details to respond to enquiries and deliver services you request.
• Legitimate interest: maintaining records of completed engagements for quality and reference purposes.
• Consent: use of optional analytics cookies, where you have accepted them via the cookie banner.

4. How We Use Your Data

• Responding to enquiries and scheduling sessions
• Delivering the service you have engaged us for
• Sending written deliverables and session notes
• Maintaining engagement records for our internal quality purposes
• Improving our website based on anonymised analytics

We do not use your data for unsolicited marketing. If you wish to receive occasional updates from us, you may opt in at the point of contact — and opt out at any time.

5. Data Retention

We retain personal data for as long as reasonably necessary for the purposes described above:

• Contact enquiries that do not proceed to engagement: 12 months
• Engagement-related data (session notes, deliverables, correspondence): 5 years from the end of the engagement
• Cookie consent records: 13 months

You may request deletion at any time — see Section 7.

6. Data Sharing and Third Parties

We do not sell personal data. We may share limited data with the following categories of third party:

• Cloud storage and email providers: for secure storage and delivery of written outputs. We select providers with appropriate data security measures.
• Analytics services: anonymised website usage data only, where you have consented to analytics cookies.
• Legal or regulatory bodies: where disclosure is required by Thai law or a competent authority.

7. Your Rights Under PDPA

Under Thailand's Personal Data Protection Act, you have the following rights:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate data.
• Right to erasure: request deletion of your personal data where there is no lawful basis for us to retain it.
• Right to restriction: request that we limit how we use your data while a dispute is resolved.
• Right to data portability: receive your data in a structured, machine-readable format where technically feasible.
• Right to object: object to processing based on legitimate interest.
• Right to withdraw consent: withdraw consent at any time where consent is the legal basis for processing.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. If you believe your rights have not been respected, you may lodge a complaint with the Personal Data Protection Committee of Thailand.

8. Cookies

We use essential, analytics, and optional preference cookies. Full details, including how to manage your preferences, are in our Cookie Policy.

9. Security

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss or misuse. These include access controls, encrypted data transmission (HTTPS), and limiting who within our small team can access engagement records. In the event of a data breach that affects your rights, we will notify affected individuals as required under PDPA.

10. External Links

Our website may include links to external sites. We are not responsible for the privacy practices of those sites. We recommend reviewing their own privacy policies.

11. Children

Our services are directed at businesses and their representatives. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have done so, please contact us and we will delete the data promptly.

12. Policy Updates

We may update this policy from time to time. Material changes will be notified via our website. Continued use of our services after a change constitutes acceptance of the updated policy. The current version date is shown at the top of this page.

13. Contact

For any questions about this policy or to exercise your rights: