Privacy Policy

We collect the following categories of personal data:

• Identity Data: Name, job title, company name, and professional role.
• Contact Data: Email address, phone number, LINE ID, and business address.
• Technical Data: IP address, browser type, device information, operating system, and referral source.
• Usage Data: Pages visited, time spent on pages, click patterns, and interaction with our content.
• Service Data: Project details, business requirements, documents, and data you provide during consulting engagements.
• Payment Data: Billing address, tax identification number, and payment transaction records. We do not store credit card numbers directly.
• Communication Data: Messages, emails, and correspondence exchanged with us.

We use your personal data for the following purposes:

• To deliver AI consulting, implementation, and digital product services you have engaged us for.
• To process and respond to your inquiries and service requests.
• To issue tax invoices, process payments, and manage billing.
• To communicate project updates, deliverables, and service-related information.
• To improve our website, services, and user experience through analytics.
• To comply with legal obligations, including tax and regulatory requirements.
• To send marketing communications, only with your explicit consent.

Under the PDPA, we process your personal data based on the following legal grounds:

• Contractual Necessity: Processing required to perform our consulting agreements and deliver digital products.
• Consent: For marketing communications, non-essential cookies, and any processing beyond what is necessary for service delivery. You may withdraw consent at any time.
• Legitimate Interest: For website analytics, service improvement, and fraud prevention, where such interests do not override your rights.
• Legal Obligation: For tax filings, regulatory compliance, and responding to lawful requests from authorities.

As an AI implementation services provider, we use artificial intelligence tools to deliver our services. This includes:

• Third-party AI APIs: We may process your data using AI services from providers including OpenAI (USA), Anthropic (USA), and Google Cloud (USA/Singapore). These providers act as sub-processors under our Data Processing Agreements.
• Purpose limitation: Your data is sent to AI services only for the specific task or service you have engaged us for. We do not use your data to train AI models.
• Human oversight: AI-generated outputs that have significant effects on individuals are reviewed by a human before delivery or implementation.

All AI sub-processors have executed Data Processing Agreements that include Standard Contractual Clauses and explicit prohibitions on using your data for model training.

To deliver our AI-powered services, your personal data may be transferred to and processed in countries outside Thailand, including the United States and Singapore.

We ensure adequate protection for cross-border transfers through:

• Standard Contractual Clauses (SCCs) executed with each overseas data recipient.
• Data Processing Agreements with minimum standards including 72-hour breach notification obligations.
• Data minimization: We only transfer the minimum data necessary for the specific task. Where feasible, we anonymize or pseudonymize data before transfer.

We do not transfer Thai national identification numbers, health data, or other sensitive personal data to overseas AI services without your explicit, separate consent and appropriate safeguards.

Our website uses cookies and similar technologies. We categorize them as:

• Strictly Necessary: Required for the website to function. These do not require consent.
• Analytics: Help us understand how visitors interact with our website. Activated only with your consent.
• Marketing: Used to deliver relevant content and measure campaign effectiveness. Activated only with your consent.

All non-essential cookies default to OFF until you provide explicit consent. You can manage your cookie preferences at any time through our cookie settings panel. You may also configure your browser to reject cookies.

We retain your personal data only for as long as necessary:

• Client project data: Duration of engagement plus 3 years, or as required by applicable law.
• Tax and financial records: 5 years as required by Thai Revenue Code.
• Website analytics data: 26 months from collection.
• Marketing consent records: Duration of consent plus 1 year after withdrawal.
• Inquiry data (non-clients): 12 months from last contact.

When the retention period expires, your data is securely deleted or anonymized.

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Deletion: Request deletion of your data when it is no longer necessary for the purpose it was collected.
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interest or for marketing purposes.
• Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Object to Automated Decisions: Request human review of decisions made solely by automated means, including AI, that significantly affect you.

To exercise any of these rights, contact us using the details in Section 13. We will respond within 30 days.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS) and at rest.
• Access controls limited to authorized personnel.
• Regular security assessments of our systems and sub-processors.
• Incident response procedures with 72-hour breach notification.

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal data.

Our services are designed for businesses and are not directed at individuals under the age of 20. We do not knowingly collect personal data from children. If we discover that we have inadvertently collected data from a child, we will delete it promptly.

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or services. Material changes will be communicated via our website. The "Last updated" date at the top indicates the most recent revision.

For questions about this Privacy Policy, to exercise your data rights, or to file a complaint:

• Company: BCIS Company Limited (operating as 1% EVO)
• Email: privacy@1percentevo.com
• Address: 11/23 Moo 2, Tambon Tha Sa-an, Amphoe Bang Pakong, Chachoengsao 24130, Thailand

If you are unsatisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.