PDPA Notice
This notice is issued by Modal Creative Studio Co., Ltd. in accordance with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") of the Kingdom of Thailand. It informs you of how we handle your personal data and describes your rights as a data subject.
⚠️ This notice is provided in English. A Thai-language version is available upon request at hello@modalstudio.co.
1. Data Controller
Modal Creative Studio Co., Ltd.
Bangkok, Thailand
Email: hello@modalstudio.co
We are registered as a data controller under the PDPA and are responsible for the personal data we collect and process.
2. Categories of Personal Data Collected
We may collect and process the following categories of personal data:
Identity data: Full name, title, nationality
Contact data: Email address, phone number, physical address
Business data: Company name, job title, project brief, contractual information
Financial data: Bank account details for payment purposes (handled securely; card data processed by certified third-party providers)
Technical data: IP address, browser type, device identifiers, cookies
Communications data: Records of emails, messages, and meeting notes
We do not collect sensitive personal data (as defined in Section 26 of the PDPA, including race, health data, biometric data, criminal records, and sexual orientation) without your explicit prior consent, except where permitted by law.
3. Purposes & Legal Basis for Processing
This is some text inside of a div block. | This is some text inside of a div block. |
|---|---|
This is some text inside of a div block. | This is some text inside of a div block. |
This is some text inside of a div block. | This is some text inside of a div block. |
This is some text inside of a div block. | This is some text inside of a div block. |
This is some text inside of a div block. | This is some text inside of a div block. |
This is some text inside of a div block. | This is some text inside of a div block. |
This is some text inside of a div block. | This is some text inside of a div block. |
This is some text inside of a div block. | This is some text inside of a div block. |
4. Your Rights as a Data Subject
Under the PDPA, you have the following rights. You may exercise them free of charge by contacting us as set out in Section 9 below.
Right to be Informed
You have the right to be informed about how your personal data is collected and used. This notice fulfils that obligation.
Right of Access (S.30)
You may request a copy of the personal data we hold about you and information about how it is being processed.
Right to Data Portability (S.31)
Where processing is based on consent or contract, you may request your data in a structured, machine-readable format, or ask us to transfer it directly to another controller.
Right to Object (S.32)
You may object to processing based on legitimate interests or for direct marketing purposes at any time.
Right to Erasure (S.33)
You may request deletion of your personal data where it is no longer necessary, consent has been withdrawn, or processing was unlawful.
Right to Restriction (S.34)
You may request that we restrict processing of your data while accuracy is contested or while an objection is being considered.
Right to Rectification (S.35)
You may ask us to correct inaccurate personal data or complete incomplete data without undue delay.
Consent Withdrawal (S.19)
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
5. Data Retention Periods
Client contracts & financial records: 10 years (Thai Revenue Code requirement)
Project files & deliverables: 3 years after project completion
Website enquiries: 2 years
Marketing contact lists: Until withdrawal of consent or unsubscribe
Employment applicant data: 1 year from application date
6. Disclosure to Third Parties
We disclose personal data only where necessary. Recipients include cloud service providers, payment processors, accounting software, and professional advisors — all bound by data processing agreements or equivalent protections. We do not sell your data.
7. Cross-Border Data Transfers
Some processors operate outside Thailand. Pursuant to PDPA Section 28, we ensure adequate protection measures are in place for any cross-border transfers, including contractual clauses approved by the Personal Data Protection Committee ("PDPC") where required.
8. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the PDPC within 72 hours of becoming aware and will notify affected data subjects without undue delay, in accordance with PDPA Section 37.
9. How to Exercise Your Rights
Submit a written request to our Data Protection Contact:
Email: hello@modalstudio.co
Subject line: PDPA Rights Request
We will acknowledge your request within 7 days and respond fully within 30 days. We may ask you to verify your identity before processing the request.
10. Right to Lodge a Complaint
If you believe we have not handled your personal data in accordance with the PDPA, you have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand. Contact details are available at the Office of the PDPC website.
11. Updates to This Notice
We review this notice periodically and update it to reflect changes in the law or our practices. The effective date at the top of this page shows when the current version was issued.
