Privacy Policy

Heirloom Lab operates as an estate organising workshop studio based in Bangkok, Thailand. Our registered address is 54 Soi Lat Phrao 15, Chatuchak, Bangkok 10900. We can be reached by telephone at +66 84 517 6293 or by email at [email protected].

For the purposes of data protection, Heirloom Lab acts as the data controller for personal information collected through this website and in the course of delivering our workshops, inventory sessions, and membership community.

We may collect the following categories of personal information when you use our website or engage with our services:

Contact and Enquiry Information — Your name, email address, telephone number, and the content of any message you send us through our enquiry form or directly by email or telephone. This is collected only when you choose to reach out.

Workshop Booking Details — Information needed to confirm and manage your attendance at a session, such as your name, contact details, and any relevant access or scheduling notes you share with us voluntarily.

Membership Information — For Legacy Stories Membership participants, we hold the contact and billing details needed to manage your ongoing access and send relevant community updates.

Website Usage Information — When you visit our website, we may collect standard technical information such as your IP address, browser type, referring page, and pages visited. This is used in aggregate to help us understand how the site is being used and to improve it.

Cookie Data — Subject to your consent where required, we use cookies and similar technologies on this site. Our Cookie Policy explains this in detail.

We do not collect any special categories of personal data (such as health information or financial account details) through our website or workshops unless you choose to share them with us in conversation, in which case we treat them with heightened discretion.

We use the personal information we collect for the following purposes, and only where we have a lawful basis for doing so:

To respond to enquiries — When you contact us, we use your details to get back to you in a timely and helpful way. Our lawful basis is legitimate interest in responding to communications directed to us.

To deliver workshops and sessions — We use booking information to confirm arrangements, send joining details, and follow up after a session with any materials discussed. Our lawful basis is the performance of an agreement with you.

To manage membership — For Legacy Stories Members, we use contact and billing details to manage your subscription and communicate relevant community updates. Our lawful basis is the performance of an agreement with you.

To improve our website — Aggregated, non-identifiable usage data helps us understand which pages are helpful and where we can do better. Our lawful basis is legitimate interest in operating an effective web presence.

To send occasional updates — With your consent, we may send you information about upcoming workshops, seasonal programmes, or community news. You may withdraw consent at any time by contacting us or using the unsubscribe link in any email.

We do not use your information for automated decision-making that produces legal or significant effects, and we do not engage in profiling for marketing purposes.

Thailand's Personal Data Protection Act B.E. 2562 (PDPA) applies to our handling of personal data. Under the PDPA, we rely on the following legal bases:

Consent — Where we ask for your agreement before collecting or using data, such as for optional marketing communications or non-essential cookies.

Contractual necessity — Where processing is needed to carry out a workshop booking or membership agreement you have entered into with us.

Legitimate interests — Where processing is reasonably necessary for our operating interests and does not override your rights. We carry out a balancing assessment when relying on this basis.

Legal obligation — Where Thai law requires us to retain or process certain records.

You may contact us at any time to ask which legal basis applies to a particular use of your data.

We do not sell, rent, or trade your personal information to third parties. We share information only in the following limited circumstances:

Service providers — We use a small number of trusted third-party tools for functions such as email delivery, website hosting, and payment processing. These providers act as data processors and are contractually bound to use your data only for the purposes we specify.

Legal requirements — We may disclose personal information where required to do so by Thai law, court order, or a lawful request from a public authority.

With your consent — For any sharing not described above, we will ask you first.

Where data is transferred outside Thailand, we take reasonable steps to ensure that appropriate safeguards are in place consistent with the PDPA's cross-border transfer requirements.

We keep personal information only for as long as it is needed for the purpose it was collected, or as required by law:

Enquiry records — Kept for up to 12 months after the enquiry, unless it results in a booking or membership.

Workshop booking records — Kept for up to 3 years after the session date to allow for any reasonable follow-up or administrative queries.

Membership records — Kept for the duration of membership and for up to 3 years thereafter.

Financial records — Retained for the period required under applicable Thai tax and accounting law.

After retention periods expire, personal information is deleted or anonymised in a secure manner.

Under the Thai PDPA, you have the following rights in relation to your personal data held by Heirloom Lab:

Right to be informed — To know how your data is being used, which this policy addresses.

Right of access — To request a copy of the personal data we hold about you.

Right to rectification — To ask us to correct any inaccurate or incomplete information.

Right to erasure — To request that we delete your data where there is no legitimate reason to continue holding it.

Right to restrict processing — To ask us to pause processing of your data in certain circumstances.

Right to data portability — To receive a copy of your data in a structured, commonly used format where technically feasible.

Right to object — To object to processing based on legitimate interests, including for direct marketing.

Right to withdraw consent — Where we process data based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please write to us at [email protected] or contact us by phone at +66 84 517 6293. We will respond within 30 days. There is no charge for making a request, though we may charge a reasonable fee for requests that are manifestly unfounded or repetitive.

If you are not satisfied with our response, you may have the right to lodge a complaint with Thailand's Office of the Personal Data Protection Committee (PDPC). Their details are available at pdpc.go.th.

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, or misuse. These include access controls, secure data storage practices, and periodic review of our data handling procedures.

While no system is entirely without risk, we take our responsibility to protect your information seriously and review our practices regularly. If you have concerns about the security of your information, please contact us directly.

Our website uses cookies to support basic functionality and, where consent is given, to understand how visitors use the site. Full details of the cookies we use, their purposes, and how to manage your preferences are set out in our Cookie Policy.

Our workshops and services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal information, please contact us and we will take prompt steps to remove it.

Our website may occasionally include links to external resources or organisations that we believe may be helpful. We are not responsible for the privacy practices of those sites and encourage you to review their policies before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after an update constitutes acceptance of the revised terms.

If you have any questions about this Privacy Policy or about how we handle your personal information, please do not hesitate to reach out. We are happy to help: