This policy explains how Nordwork Technologies Company Limited ("we", "us"), a company registered in Thailand (Tax ID 0775562001067, registered address 38/195 Floor 2 Soi Moo Baan Tangrodfai Fangtawantok ,Phetchkasem Road, Hua Hin, Prachuabkirikhan, 77110, Thailand), processes personal data when you visit Thai Tender Atlas (thaitenderatlas.com), ask for a sample, buy a report or contact us. We are the data controller under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and, where it applies to you, the EU and UK General Data Protection Regulation ("GDPR"). Contact us about privacy at support@thaitenderatlas.com.
1. Data we collect
- Purchases: your email address, what you bought, the price, currency, date, an order reference and the payment reference Stripe gives us. Card payments are handled by Stripe; we never see or store your full card details.
- Free sample requests: your email address and, only if you tick the optional box, your consent to hear about new editions, stored with the exact wording you agreed to and the time.
- "Email me when available" sign-ups: your email address and your consent to that one notice, stored with the exact wording and the time.
- Messages to us: your email address, your message and our replies, whether you use the contact form or email.
- Technical data: your IP address and browser details, used briefly for security and rate limiting and not stored with your other data, and a random identifier kept in your browser so we can count visits and sign-ups without identifying you.
We do not buy personal data, and we do not sell or rent yours to anyone.
2. Why we use it and our legal bases
- To take your order, deliver the report and help with it afterwards: performance of a contract (PDPA s.24(3); GDPR Art. 6(1)(b)).
- To send a sample you asked for: your request (PDPA s.24(3); GDPR Art. 6(1)(b)). To tell you about new editions or that reports are available to buy: your consent (PDPA s.19; GDPR Art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link in every email.
- To answer your messages: your request, and our legitimate interest in running a responsive service (PDPA s.24(5); GDPR Art. 6(1)(f)).
- To keep accounting and tax records: legal obligation (PDPA s.24(6); GDPR Art. 6(1)(c)).
- To keep the service secure and prevent fraud and abuse: legitimate interests (PDPA s.24(5); GDPR Art. 6(1)(f)).
3. Automated processing and AI
We use an AI model provided by Anthropic, acting as our processor, to help answer support messages from our own help content and your order details. Requests about refunds, complaints, legal questions or your personal data are always passed to a person.
Your data is not used to train AI models.
4. Who we share data with
We share personal data only with service providers that process it for us under data-processing terms:
- Fly.io (application hosting and storage, servers in Singapore).
- Stripe (payments), which also acts as an independent controller for its own legal and anti-fraud obligations.
- Resend (sending and receiving email).
- Anthropic (AI processing, as described above).
We may also disclose data where the law requires it, for example to tax authorities. Some providers are located outside Thailand and outside the EU/UK (for example in the United States or Singapore). For these transfers we rely on appropriate safeguards such as standard contractual clauses and the PDPA's rules on cross-border transfers (PDPA s.28-29).
5. How long we keep it
- Thailand Hospital Procurement Map: your download access lasts 365 days after purchase. We hold no documents of yours.
- Order records needed for accounting and tax (reference, items, amount, date, email) are kept for the period Thai law requires, and then deleted.
- Sample requests without any consent to further emails are deleted after 30 days. If you consented to emails, we keep your address until you unsubscribe and delete it within 30 days after that.
- Unpaid, abandoned checkouts are deleted within 48 hours.
- Support messages are deleted 180 days after the last message in the conversation.
6. Security
Data is encrypted in transit (TLS) and sensitive fields and files are encrypted at rest. Order pages use private, expiring links instead of passwords, and administrative access is restricted.
7. Your rights
Under the PDPA and, where it applies, the GDPR, you can ask us for access to your personal data or a copy of it, to correct or delete it, to restrict or object to its use, and to receive it in a portable format. You can withdraw consent at any time, without affecting processing that took place before. Email support@thaitenderatlas.com; we will reply within 30 days. You can also complain to Thailand's Office of the Personal Data Protection Committee (PDPC) or, in the EU/UK, to your local data protection authority.
8. Children
Our services are for businesses and adults. They are not directed at children.
9. Changes and contact
We will post any changes on this page and update the date at the top. Questions: support@thaitenderatlas.com, Nordwork Technologies Company Limited, 38/195 Floor 2 Soi Moo Baan Tangrodfai Fangtawantok ,Phetchkasem Road, Hua Hin, Prachuabkirikhan, 77110, Thailand, or our contact page.