Privacy Policy

Backlink Hut respects your privacy and handles personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and, where applicable, the EU General Data Protection Regulation ("GDPR") for visitors and clients in the European Economic Area and the United Kingdom.

Effective date: 2026-05-21. This policy supersedes all prior versions.

Backlink Hut Co., Ltd., 49/41 Phatthaya Tai 12 Alley, Pattaya City, Bang Lamung District, Chon Buri 20150, Thailand. For any privacy matter — including access, correction, deletion, or complaint — contact our Data Protection contact at service@backlinkhut.com or +66 87 773 7715 (Mon–Fri 09:00–18:00 ICT).

• Contact information you submit voluntarily via forms, email, WhatsApp, LINE, or phone — name, business name, phone number, email address, country, and the project details you choose to share.
• Engagement records — invoices, quotes, meeting notes, project artifacts, and correspondence we exchange with you.
• Analytics data — anonymized page views, click events, referring URLs, approximate location at country/region level, device type, and browser language, collected via cookies and similar technologies.
• Server logs — IP address, request timestamp, user-agent string, and the URL requested. Standard web-server logs are retained for security and abuse-prevention purposes.
• Payment metadata — transaction reference numbers and amounts. We do not store payment-card numbers; those are handled by our licensed payment processors (PromptPay, Omise, Stripe).

We rely on the following legal bases under PDPA Section 24 and GDPR Article 6:

• Contractual necessity — to deliver the services you have requested, send quotes, issue invoices, and respond to support enquiries.
• Legitimate interest — to operate, secure, and improve the website; to detect and prevent fraud, spam, and abuse; to send transactional messages about active engagements.
• Consent — where required (for example, optional marketing emails, non-essential analytics cookies). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation — to comply with Thai tax, accounting, and anti-money-laundering requirements.

• Reply to enquiries and deliver the services you have engaged us for.
• Generate invoices, accept payment, and meet our tax-reporting obligations.
• Improve the website and understand which services interest visitors most (in aggregate, anonymized form).
• Send service-related notifications such as project updates, schedule changes, or security notices.
• Detect, prevent, and respond to fraudulent activity, abuse, or breaches of these Terms.

We do not sell, rent, or trade personal data. We do not use personal data to make automated decisions that produce legal or similarly significant effects on you.

We share personal data only with the limited set of third parties needed to operate the business. Each is bound by a written data-processing agreement or, where the third party is in another jurisdiction, by appropriate transfer safeguards.

• Hosting and infrastructure — Hostinger (Lithuania / Asia), Cloudflare, Google Cloud where used for storage or email delivery.
• Analytics — Google Analytics 4 (anonymized IP, no cross-site tracking enabled).
• Payment processors — Omise (Thailand), PromptPay (Thailand), Stripe (USA, with Standard Contractual Clauses).
• Communications — WhatsApp Business / Meta and LINE for client messaging at your initiation.
• Professional advisors — accountants and legal counsel where strictly necessary and under confidentiality obligation.
• Law enforcement — when required by valid Thai legal process, in which case we will notify you unless legally prohibited.

Some of our processors operate outside Thailand. Where personal data is transferred outside Thailand, we rely on adequacy decisions, Standard Contractual Clauses, or the recipient country's own protections that meet PDPA's adequate protection standard. You may request a copy of the transfer mechanism we rely on for any specific processor.

• Active client records — for the duration of the engagement plus seven (7) years thereafter, to meet Thai tax-record retention requirements.
• Prospect contact information — up to two (2) years from last contact; deleted on request.
• Web analytics — aggregated data retained indefinitely; raw event-level data retained for fourteen (14) months.
• Server logs — retained for ninety (90) days unless required longer for security investigation.

When we no longer need personal data, we delete it or anonymize it so it can no longer identify you.

Under PDPA and GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectify — ask us to correct inaccurate or incomplete data.
• Erase — ask us to delete your data, subject to legal-retention requirements.
• Restrict — limit how we process your data while a dispute is resolved.
• Object — object to processing based on legitimate interest, including direct marketing.
• Withdraw consent — at any time, for any processing based on consent.
• Portability — receive your data in a structured, machine-readable format.
• Complain — to Thailand's Personal Data Protection Committee (PDPC) at pdpc.or.th, or to your local EU supervisory authority.

To exercise any of these rights, email service@backlinkhut.com. We respond within thirty (30) days. We may need to verify your identity before acting on a request.

Our services are intended for businesses and individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, contact us and we will delete it.

We protect personal data with reasonable technical and organizational measures including TLS encryption for all website traffic, role-based access controls on our internal systems, encrypted storage for sensitive records, regular software updates, and staff training on data protection. No system is perfectly secure; we cannot guarantee absolute protection against every threat, but we work continuously to maintain a high standard of care.

We use a minimal set of cookies described in our Cookie Policy. Strictly necessary cookies are set without consent because the site cannot function without them; all other cookies require your active consent through the banner on first visit.

We may update this policy from time to time. Material changes will be announced by updating the Effective date and, for active clients, by email notification at least fourteen (14) days before they take effect. Continued use of the site after the effective date constitutes acceptance.

Email service@backlinkhut.com or write to us at the address above. You always have the right to complain directly to Thailand's Personal Data Protection Committee at pdpc.or.th.