Privacy Policy

Legacywell ("we", "us", "our") is committed to protecting the personal information of the people who use our services. This policy explains what data we collect, how we use it, and the choices you have. It applies to our website at https://legacywell.blog and to our service engagements with clients.

Our services involve visiting private households and working with personal documents and items. We take privacy seriously as a matter of professional practice, not just compliance. Any questions about this policy can be sent to [email protected].

1. What Personal Data We Collect

We collect personal data only to the extent necessary to provide our services and communicate with clients. The categories of data we may collect include:

• Contact information: name, email address, telephone number — collected via our website enquiry form or by telephone.
• Address and location details: provided by clients booking on-site services, used solely to schedule and conduct service visits.
• Service-related notes: brief records of what was agreed and completed during an engagement. These do not include the content of client documents.
• Website usage data: collected via cookies and analytics tools (see Section 5 and our Cookie Policy).

We do not collect, copy, photograph, or retain any content from client documents. Our on-site work involves organising documents in the client's home; we do not remove or digitise them.

Legal Basis for Processing

We process personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). The legal bases we rely on are: (a) the performance of a contract — to deliver the services you have requested; (b) your consent — for marketing communications and non-essential cookies; and (c) our legitimate interests — to maintain business records and improve our services.

Retention Periods

• Client contact records: retained for three years after the end of an engagement, then deleted.
• Invoice and payment records: retained for seven years in accordance with Thai accounting requirements.
• Website analytics data: retained for 14 months as configured in the analytics platform.

2. How We Use Your Data

Personal data collected from clients and website visitors is used for the following purposes:

• Responding to enquiries and booking requests
• Delivering the service you have engaged us for
• Sending service-related communications (appointment confirmations, follow-up notes)
• Maintaining our business records for accounting and legal purposes
• Improving our website and understanding how visitors use it

We do not sell personal data. We do not share it with third parties for marketing purposes.

We may share data with service providers who assist us in operating our website (hosting, analytics), and with professional advisers (accountants, legal counsel) where required. These parties are bound by confidentiality obligations and may only use data for the purposes we specify.

3. How We Protect Your Data

• Our website uses HTTPS encryption for all data in transit.
• Client records are stored on password-protected systems with access limited to the team members who need them.
• Paper records, where held, are kept in a locked filing system at our Bangkok office.
• In the event of a personal data breach affecting your rights and freedoms, we will notify you and the Office of the Personal Data Protection Committee (PDPC) within 72 hours of becoming aware.

4. Cookies

Our website uses cookies to function correctly and to understand how visitors use it. Essential cookies cannot be disabled. Analytics and preference cookies can be managed via the cookie banner or our Cookie Policy page.

For full details of the cookies we use and how to manage them, please read our Cookie Policy.

5. Your Rights Under the PDPA

Under Thailand's Personal Data Protection Act, you have the following rights in relation to your personal data:

• Right to access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure: you can ask us to delete your data where there is no longer a legitimate reason to retain it.
• Right to data portability: you can request your data in a structured, machine-readable format.
• Right to object: you can object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint: you can make a complaint to the Office of the Personal Data Protection Committee (PDPC) at pdpc.or.th.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

6. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend reading their policies before submitting personal data.

7. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at [email protected].

8. Changes to This Policy

We may update this policy from time to time. Material changes will be indicated by a revised "Last Updated" date at the top of this page. Continued use of our website or services after a change constitutes acceptance of the revised policy.

9. Contact for Data Enquiries

For any question or request relating to your personal data: