Privacy Policy

Personal Data Protection Policy Notice of Craft23

Craft23 (“Craft23”, “we”, “us”, or “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose your personal information in accordance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA) and all related regulations, including the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes (No. 2) B.E. 2568 (2025).

This notice applies to all individuals who interact with Craft23, including:

1. Visitors, guests, and customers of Craft23's venue and website.
2. Employees, representatives, agents, shareholders, directors, and any persons associated with organisations that have dealings with Craft23.

1. Personal Data We Collect

1.1 General Personal Data

We may collect the following categories of personal data:

• Identity Data: Full name, gender, date of birth, age, and information contained in official documents such as national ID cards, passports, residence certificates, alien identification cards, work permits, social security cards, driving licences, vehicle registration documents, house registration documents, signatures, and taxpayer identification numbers.
• Contact Data: Home address, mailing address, email address, telephone numbers (home, mobile, fax), and usernames or identifiers used on digital platforms such as LINE, Google, Facebook, Instagram, WhatsApp, and WeChat.
• Financial Data: Payment records, transaction history, income and expenditure information, insurance or investment details, shareholder information, and data required for compliance with applicable financial regulations.
• Interaction Data: Records of communications with Craft23 via our venue, telephone, website, social media, email, or other digital channels. This may include written records, audio recordings, photographs, and CCTV footage.
• Technical Data: IP address, MAC address, device ID, browser type and version, operating system, cookies, plug-in data, geolocation data, API usage data, and other technical information collected when you use our website or digital services.
• Usage Data: Login credentials, search history, browsing activity on our website, timestamps, preferences, favourites, and log files.
• Behavioural Data: Information about your interests, preferences, and patterns of engagement with our services.

1.2 Sensitive Personal Data

We will only collect sensitive personal data — including biometric data (fingerprints, facial recognition, voice identification), health information, criminal records, or any other category designated as sensitive by the Personal Data Protection Committee (PDPC) — with your explicit prior consent, unless a legal exemption applies. We do not offer financial incentives in exchange for consent to process sensitive data.

2. How We Use Your Personal Data

We collect, use, and disclose your personal data only when we have a lawful basis to do so. These bases include:

• Contractual necessity — to fulfil a booking, reservation, membership, or service request you have made.
• Legal obligation — to comply with Thai law and regulatory requirements.
• Legitimate interests — for the operation, security, and improvement of our business, provided these interests do not override your rights.
• Vital interests — to prevent harm to life, body, or health.
• Public interest — where required for public tasks or the exercise of official authority.
• Consent — where you have given us clear, informed, and freely given consent.

Specific purposes include:

• Communicating with you about bookings, events, products, and services.
• Processing and managing reservations, orders, and payments.
• Verifying your identity (KYC) and preventing fraud.
• Managing customer relationships and maintaining service records.
• Complying with Thai law, tax obligations, and regulatory requirements.
• Operating CCTV for the safety and security of our venue and guests.
• Conducting internal audits, risk management, and business analysis.
• Sending marketing communications and promotional offers (where you have consented or where we have a legitimate interest, with an easy opt-out available at all times).
• Organising events, meetings, and on-site visits.
• Improving our website, digital services, and overall customer experience.
• Cloud storage and IT system operations.

3. Disclosure of Your Personal Data

We may share your personal data with the following categories of recipients, only to the extent necessary and with appropriate safeguards in place:

• Business Partners: Financial institutions, accounting firms, marketing agencies, logistics providers, telecommunications companies, health centres, insurance providers, and data analytics platforms.
• Service Providers: IT infrastructure providers, event organisers, legal and financial advisors, security firms, and other third-party vendors who process data on our behalf under binding data processing agreements.
• Regulatory Authorities and Government Agencies: Where required by law, court order, or government directive.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or asset transfer, your data may be disclosed to the relevant parties involved.
• Social Media Platforms: Such as Facebook, Google, and Instagram, where you interact with our content or where we use their advertising or analytics tools.

We do not sell your personal data to third parties.

4. Data Retention

We retain your personal data only for as long as is necessary for the purposes set out in this policy, or as required by applicable law.

In general:

• Customer and transaction records are retained for up to 10 years from the date your relationship with Craft23 ends, in line with Thai statutory limitation periods.
• CCTV footage is retained for 30 days unless required for an ongoing investigation or legal matter.
• Marketing consent records are retained for the duration of our marketing relationship with you, plus a reasonable period thereafter.

When data is no longer required, it is securely deleted or anonymised.

5. International Data Transfers

If it is necessary to transfer your personal data to a country outside Thailand, we will ensure that appropriate safeguards are in place — such as Binding Corporate Rules (BCR) approved by the PDPC, standard contractual clauses, or other mechanisms recognised under the PDPA — to ensure your data receives an equivalent level of protection.

6. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyse site traffic, and support our marketing activities.

Types of cookies we use:

• Strictly Necessary Cookies: Essential for the website to function. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors use our site (e.g., Google Analytics). These are only set with your consent.
• Marketing Cookies: Used to deliver relevant advertisements and track campaign performance. These are only set with your consent.

You can manage your cookie preferences at any time via the cookie settings banner on our website, or through your browser settings. Please note that disabling certain cookies may affect the functionality of our site.

7. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures apply to both physical records and electronic data.

In the event of a personal data breach, we will notify the PDPC within 72 hours of becoming aware of the breach. Where the breach poses a high risk to your rights and freedoms, we will also notify you directly without undue delay.

8. Your Rights as a Data Subject

Under the PDPA, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us using the details below. We will respond within 30 days of receiving your request and any required supporting documentation. We will not charge a fee for reasonable requests.

9. Children's Privacy

Our services are not directed at children under the age of 20. We do not knowingly collect personal data from minors without verifiable parental or guardian consent. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. The “Last Updated” date at the top of this page will always reflect the most recent version. We encourage you to review this policy periodically. Where changes are material, we will notify you via our website or by email.

11. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your personal data, please contact us: