This policy explains how DDES Accounting collects, uses, keeps and protects personal data when you visit ddes-accounting.com, contact us, or use our services. We follow Thailand’s Personal Data Protection Act B.E. 2562 (2019), the PDPA.
Who we are
DDES Accounting is the trade name of Dream Destiny Co., Ltd. (บริษัท ดรีม เดสทินี จำกัด), a company registered in Thailand under number 0125559019908. Our office is at Sethiwan Tower, 17th Floor, No.139 Pan Road, Silom, Bang Rak, Bangkok 10500. Under the PDPA, we are the data controller for the personal data described here, except the data we handle on a client’s behalf (see below).
For any question or request about your personal data, email cs@ddes-accounting.com, call +66 (0)2 165 0541 (Monday to Friday, 9:00–18:00), or use our contact form.
What we collect
When you use our contact form, we receive your first and last name, your email address, and, if you give them, your phone number and your message. We also receive the address of the page you sent the form from. To keep spam out, the form uses Cloudflare Turnstile, which checks your browser and IP address to tell people from robots.
When you call, email or message us (including on WhatsApp or LINE), we receive what you choose to share. WhatsApp and LINE also process your messages under their own privacy policies.
When you become a client, we collect what the service needs: names and contact details of owners, directors and staff, copies of ID cards or passports, and, depending on the service, salary, tax and social security details of your employees, and documents for company registrations, visas and work permits. We do not ask for sensitive data such as health or religion; if a document you send shows it, we keep it only as part of that document. If you do not give us the data a service needs, we may not be able to provide that service.
When we run payroll or make filings for a client, we handle its staff’s data on the client’s behalf and follow its instructions. The client remains responsible to its staff for that data.
When you browse the website, you need no account and we do not track you. Our hosting provider, Cloudflare, processes the technical data needed to deliver the pages and protect the site, such as your IP address, browser type and the pages you request.
Why we use it, and on what legal basis
- To answer your message or prepare a quote: steps you ask for before a contract (PDPA section 24(3)) and our legitimate interest in answering enquiries (section 24(5)).
- To provide our services: our contract with you or your company (section 24(3)).
- To make filings with the authorities and keep the records the law requires: legal obligation (section 24(6)).
- To keep the website secure and the contact form free of spam: legitimate interest (section 24(5)).
We do not sell personal data, and we do not use it for marketing without your consent.
Who receives it
- Cloudflare, Inc. (United States, servers worldwide) hosts the website, runs Turnstile, and forwards contact form messages by email to cs@ddes-accounting.com.
- PlanetHoster (Canada) hosts our email.
- Xero, the cloud accounting software we use for our clients’ books.
- Government agencies when we file for you, such as the Revenue Department, the Department of Business Development, the Social Security Office, the Department of Employment, the Immigration Bureau and the Board of Investment, and banks when we help you open an account.
- Auditors and other professional advisers when a service needs them, such as the licensed auditor who audits your accounts.
Transfers outside Thailand
Cloudflare, PlanetHoster and Xero store or process data outside Thailand. We rely on these providers’ data protection terms for these transfers, as sections 28 and 29 of the PDPA allow.
How long we keep it
- Messages and enquiries that do not lead to an engagement: 2 years after our last exchange.
- Client records: for the whole engagement, then 5 years from the end of the accounting period they cover, the period the Accounting Act B.E. 2543 (section 14) sets for accounting records, or up to 7 years when an official requires it. Payroll records are kept the same way, which also covers the 2 years the Labour Protection Act (section 114) requires for wage records.
- Technical logs at Cloudflare: a few days, under Cloudflare’s own retention rules.
After that, we delete the data or make it anonymous.
Cookies
The website sets no cookies of its own. It uses no analytics, advertising or social media cookies, so there is no cookie banner. If Cloudflare has to check that a visitor is not a robot, it may set a strictly necessary security cookie. We may count visits with Cloudflare Web Analytics, which works without cookies and does not identify you. You can block or delete cookies in your browser settings at any time.
Your rights
Under the PDPA, you can:
- ask for access to your data and a copy of it;
- receive your data in a usable format, or have it sent to another organisation;
- object to how we use your data;
- have your data deleted or made anonymous;
- have its use restricted;
- have inaccurate data corrected;
- withdraw your consent at any time, where we rely on consent.
To use these rights, email cs@ddes-accounting.com. We answer within 30 days. If you think we have not respected your rights, you can complain to the Office of the Personal Data Protection Committee (PDPC): www.pdpc.or.th.
Security
We protect personal data with reasonable technical and organisational measures: encrypted connections (HTTPS) on the whole website, spam protection on the form, and access to our mailboxes and client files limited to the staff who need it. No online system is completely secure, however.
Links to other websites
Our website links to other sites, such as Facebook, LinkedIn, LINE, WhatsApp and Google Maps. Their own privacy policies apply when you visit them.
Children
Our website and services are for businesses. We do not knowingly collect data from children.
Changes to this policy
We update this policy when the law or our practices change. The date at the top shows the current version.