Version 1 · Effective from 1 June 2022 · Last updated 4 September 2026
Holistic Development Center Co., Ltd. (the “Company”, “we” or “HDC”) is committed to protecting your personal data. This Privacy Notice explains how we collect, use, disclose and safeguard your personal data, and the rights available to you under the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the “PDPA”).
HDC provides training, people development and organisational consulting services. This Notice applies to personal data we collect through our website www.holistic.co.th, our online and offline contact channels, our training courses and development activities, and our business dealings with client organisations, trainers, consultants and suppliers.
1Who this Notice applies to
This Notice covers five groups of data subjects:
visitors and users of the Company’s website;
contact persons and representatives of client organisations, including prospective clients;
participants in training courses and activities organised or co-organised by the Company;
trainers, consultants, subject-matter experts and applicants seeking to work with the Company; and
suppliers, service providers and representatives of legal entities that transact with the Company.
2Personal data we collect
The categories of personal data we collect depend on your relationship with the Company, and generally comprise the following:
| Data subject group | Personal data collected |
|---|---|
| Website visitors | IP address, browser type and version, operating system, pages visited, date and time of visit, and data obtained through cookies. |
| Client organisation contacts | Full name, job title, department, organisation name, email address, telephone number, and records of correspondence. |
| Training participants | Full name, job title, department, contact email and telephone number, signature on attendance sheets, photographs and video recordings taken during training, pre- and post-test results, competency or self-assessment results, feedback given in satisfaction surveys, and information appearing on certificates. |
| Trainers, consultants and applicants | Full name, educational and employment history, portfolio and experience, profile photograph, contact details, taxpayer identification number, and bank account details for payment of fees. |
| Suppliers and service providers | Name and job title of representatives, contact details, information contained in contractual documents, and information necessary for payment. |
We do not knowingly collect personal data from children under the age of 20 without the consent of a person exercising parental authority. If you become aware that a child under your care has provided personal data to us without such consent, please contact us so that we may delete it.
3Sensitive personal data
As a general principle, the Company does not seek to collect sensitive personal data. However, where necessary for the delivery of training, we may collect:
health data, such as food allergies, underlying medical conditions or physical limitations, in order to arrange catering and on-site facilities safely;
religious information, only where you notify us of dietary requirements such as halal or vegetarian meals; and
disability information, in order to arrange suitable venues and learning materials.
We will collect and use such data only with your explicit consent, and only to the extent necessary for the purpose notified to you. You may decline to provide such data, in which case we may be unable to provide certain accommodations.
Where the Company provides potential assessments or psychological assessment instruments to client organisations, assessment results are kept confidential and disclosed only to the assessed individual and to persons designated in writing by the client organisation.
4Sources of personal data
Directly from you, for example when you complete a form, register for a course, send us an email, speak with us by telephone, or complete an assessment during training.
From the organisation you work for, where your organisation provides us with participant lists or contact details.
Automatically when you use our website, through cookies and similar technologies.
From publicly available sources, such as organisation websites or professional platforms, to the extent necessary for business contact.
5Purposes and lawful bases for processing
| Purpose | Lawful basis |
|---|---|
| Preparing and presenting service proposals, responding to enquiries and conducting business correspondence. | Contract; legitimate interests |
| Performing training and consulting service agreements, including course preparation, registration, venue arrangements and issuance of certificates. | Contract |
| Evaluating learning outcomes, preparing training summary reports and improving course quality. | Contract; legitimate interests |
| Taking photographs and video recordings during training, for inclusion in deliverable reports to client organisations and for promoting the Company’s services. | Contract (for deliverable reports); consent (for promotional use) |
| Preparing accounting, tax and payment records. | Legal obligation |
| Maintaining the security of our information systems and website, and retaining computer traffic data as required by law. | Legal obligation; legitimate interests |
| Sending news, new course announcements and marketing information that may be of interest to you. | Consent |
| Establishing, exercising or defending legal claims. | Legitimate interests |
Where we process your personal data on the basis of consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
6Cookies
Our website uses cookies to ensure the website functions correctly, to remember your preferences and to understand how the website is used overall. The cookies we use fall into two categories:
Strictly necessary cookies — required for the basic operation of the website and which cannot be disabled.
Analytics cookies — which help us understand which pages are visited so that we can improve our content and user experience.
You may configure your browser to refuse or delete cookies at any time. Refusing certain cookies may however cause parts of the website to function incompletely.
7Disclosure of personal data
We do not sell your personal data. We disclose personal data only to the extent necessary, and only to the following recipients:
the organisation you work for or which engaged the training, limited to data necessary for reporting, such as participant lists, test results and training summary reports;
trainers and consultants engaged by the Company, for the preparation and delivery of training;
external service providers acting for the Company, such as training venue providers, information technology and online meeting platform providers, print service providers, and our accounting firm;
professional advisers, such as auditors and legal counsel; and
government or regulatory authorities, where we are under a legal obligation to disclose.
We require all external service providers to maintain confidentiality and to process personal data only on our instructions and within the framework of the PDPA.
8Cross-border transfers
The Company may use cloud, email or online meeting services whose servers are located outside Thailand. In such cases, we will ensure that adequate personal data protection measures are in place as required by the PDPA, for example by entering into standard contractual clauses with the service provider, or by transferring only to countries with an adequate level of protection.
9Retention periods
We retain personal data for as long as necessary for the purposes notified to you, or as required by law. Our indicative retention periods are as follows:
| Category of data | Retention period |
|---|---|
| Accounting, tax and contractual documents | 10 years from the end of the contract or the date of the document, in line with accounting legislation, the Revenue Code and applicable limitation periods. |
| Training participant data and summary reports | 5 years from the end of the course. |
| Client organisation contact data | For the duration of the business relationship and for a further 2 years. |
| Applications from unsuccessful candidates | 1 year from the date the application is received. |
| Photographs and video recordings used for promotion | Until you withdraw your consent. |
| Website computer traffic data | At least 90 days, as required by the Computer-Related Crime Act. |
Upon expiry of these periods, we will delete, destroy or anonymise the personal data.
10Security measures
We maintain appropriate organisational, technical and physical security measures to prevent loss, unauthorised access, use, alteration, correction or disclosure of personal data. These include restricting access to personal data to those who need to know, password controls, storage of documents in controlled areas, and confidentiality obligations imposed on our staff, trainers and external service providers.
In the event of a personal data breach, we will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you.
11Your rights as a data subject
Subject to the conditions set out in the law, you have the following rights:
the right to withdraw consent, where we process your data on the basis of consent;
the right to access and obtain a copy of your personal data, and to request disclosure of how personal data was obtained without your consent;
the right to data portability;
the right to object to the collection, use or disclosure of your personal data;
the right to request erasure, destruction or anonymisation of your personal data;
the right to request restriction of the use of your personal data;
the right to request rectification so that your personal data is accurate, up to date and not misleading; and
the right to lodge a complaint with the Office of the Personal Data Protection Committee if you consider that we have not complied with the law.
You may exercise these rights using the contact details in section 14. We will consider your request and inform you of the outcome within 30 days of receipt. We may refuse a request where permitted by law, in which case we will give you our reasons.
12Where the Company acts as a data processor
In providing training and consulting services to client organisations, the Company in some cases acts as a data processor on the instructions of the client organisation, which is the data controller — for example, where we receive a list of employees attending a course from the organisation’s human resources function.
In those cases, the organisation you work for determines the purposes of processing and is responsible for providing you with its own privacy notice. If you wish to exercise your rights as a data subject, please contact that organisation in the first instance. We will cooperate with the organisation in responding to your request.
13Consequences of not providing personal data
Certain personal data is necessary for the performance of a contract or is required by law. If you do not provide it, we may be unable to deliver training services, issue certificates, process payment of fees, or comply with legal obligations relating to you.
14How to contact us
If you have any questions, wish to exercise your rights as a data subject, or wish to make a complaint about the protection of your personal data, please contact us at:
| Data controller | Holistic Development Center Co., Ltd. |
|---|---|
| Address | 94 Soi Phaholyothin 32, Phaholyothin Road, Chan Kasem, Chatuchak, Bangkok 10900, Thailand |
| Taxpayer identification number | 0105558018894 |
| sataporn@holistic.co.th | |
| Telephone | +66 (0)9 8552 6355 |
| Website | www.holistic.co.th |
You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) if you consider that our processing of your personal data does not comply with the law.
15Changes to this Notice
We may review and update this Notice from time to time to reflect changes in the law and in our business. The current version will be published on our website together with its effective date. We encourage you to review this Notice periodically.