Privacy Policy

Last updated: 21 August 2026

1. About this Privacy Policy

This Privacy Policy explains how CandiDuck Co., Ltd. (“CandiDuck”, “we”, “us” or “our”) collects, uses, discloses and protects personal data when you visit our website, contact us, or submit an enquiry through our website.

This Privacy Policy primarily covers information collected through our website. Where you become a client of CandiDuck, additional terms, confidentiality obligations or privacy notices may apply depending on the nature of the services provided.

2. Who is responsible for your personal data?

CandiDuck Co., Ltd. acts as the data controller for personal data collected through this website.

CandiDuck Co., Ltd.
319 Chamchuri Square Building, 24th Floor, Room 24133
Phayathai Road, Pathumwan Sub-district
Pathumwan District, Bangkok 10330, Thailand

Email: contact@candiduck.com
Telephone: 084-133-3962

3. Personal data we may collect

Depending on how you interact with us, we may collect personal data including:

• Your name;
• Your email address;
• Your telephone number, where provided;
• Information contained in enquiries, messages or other communications you send to us;
• Information relating to your company, organisation or professional role, where relevant;
• Technical information such as IP address, browser type, device information and basic website usage information;
• Any other information you voluntarily provide to us.

Please avoid providing sensitive personal data through the general website contact form unless it is necessary for your enquiry.

4. Why we use your personal data

We may collect and use personal data for the following purposes:

• To receive and respond to your enquiries;
• To communicate with you regarding legal, business or consulting services;
• To take steps requested by you before entering into an engagement or service agreement;
• To provide services where you become a client;
• To manage our business operations and client relationships;
• To maintain the security and proper operation of our website;
• To comply with applicable laws, regulations and legal obligations;
• To establish, exercise or defend legal rights where necessary.

5. Legal basis for processing

Depending on the circumstances, CandiDuck may process your personal data on one or more lawful bases permitted under the PDPA, including:

• Your consent, where consent is required;
• Taking steps at your request before entering into a contract or performing a contract with you;
• Compliance with our legal obligations;
• Our legitimate interests in operating our business, communicating with clients and prospective clients, maintaining our website and protecting our legal rights.

Where processing is based on consent, you may withdraw your consent at any time, subject to applicable law.

6. Contact form and enquiries

When you submit the contact form on our website, we collect the information you provide, such as your name, email address and message, for the purpose of reviewing and responding to your enquiry.

Providing information through the contact form is voluntary. However, if you do not provide sufficient contact information, we may not be able to respond to your enquiry.

7. Disclosure of personal data

We do not sell your personal data.

Where necessary, personal data may be disclosed to:

• CandiDuck employees, lawyers and consultants;
• IT, website hosting, email and other technology service providers acting on our behalf;
• Professional advisers or service providers where necessary for the relevant matter;
• Government authorities, regulators, courts or other persons where disclosure is required or permitted by law.

We limit disclosure to what is reasonably necessary for the relevant purpose.

8. Third-party services and embedded content

Our website may contain embedded content or services provided by third parties, including Google Maps and links to social media platforms.

When you interact with third-party content, those providers may collect technical information such as your IP address, device information or cookies in accordance with their own privacy policies. CandiDuck does not control the privacy practices of third-party websites or services.

9. Cookies and website technologies

Our website may use cookies and similar technologies that are necessary for website functionality, security and performance. Third-party embedded services may also use their own cookies or similar technologies.

If CandiDuck introduces non-essential analytics, advertising or marketing cookies, appropriate information and consent mechanisms will be provided where required by applicable law.

10. International transfers

Some technology, hosting or online service providers used by CandiDuck may process or store information outside Thailand. Where personal data is transferred internationally, we will take appropriate steps required under applicable data protection law to protect that information.

11. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to comply with applicable legal, regulatory, contractual and professional obligations.

General website enquiries that do not result in a client engagement may normally be retained for up to two years after the last communication, unless a longer retention period is necessary or required by law.

Where an enquiry becomes a client matter, information may be retained for a longer period in accordance with applicable legal, professional and record-keeping requirements.

12. Security of your personal data

CandiDuck takes reasonable administrative, technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.

However, no method of transmitting information over the internet or electronic storage system can be guaranteed to be completely secure.

13. Your rights under the PDPA

Subject to applicable law and relevant exceptions, you may have the right to:

• Request access to your personal data;
• Request a copy of personal data held about you;
• Request correction of inaccurate or incomplete data;
• Request deletion or destruction of personal data;
• Request restriction of processing;
• Object to certain processing of your personal data;
• Request data portability where applicable;
• Withdraw consent where processing is based on your consent;
• Lodge a complaint with Thailand’s Personal Data Protection Committee where you believe your rights have been violated.

To exercise any of these rights, please contact us at contact@candiduck.com .

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, website practices or applicable laws. The latest version will be published on this page together with the date of the most recent update.

15. Contact us

If you have any questions regarding this Privacy Policy or CandiDuck’s handling of personal data, please contact:

CandiDuck Co., Ltd.
Email: contact@candiduck.com
Telephone: 084-133-3962