Privacy policy

This site is a re-publisher of public Thai government data. It does not run advertising, does not run analytics, and does not maintain a user account system. This page explains what little personal data is involved, where it came from, and what rights the Thai Personal Data Protection Act B.E. 2562 (PDPA) gives you over it.

1. Data controller ผู้ควบคุมข้อมูลส่วนบุคคล

The data controller under the PDPA is the natural person who operates the site:

Name

Dr Non Arkaraprasertkul (ดร. นนท์ อัครประสิทธิ์กุล)

Address

Bangkok, Thailand

Contact

non@nonarkara.org

For Thai PDPA purposes, this is a small-scale processing operation. The PDPA does not require us to appoint a Data Protection Officer (DPO) for the kind of static-data re-publication we do.

2. What personal data we hold ข้อมูลส่วนบุคคลที่เราถือ

The site holds two categories of personal data.

2.1 Producer data re-published from the source

For each record in the public OTOP registry, the source CSV published by the Department of Community Development on data.go.th contains one or more of the following fields. The site re-publishes them with the source attribution on every record page.

We do not collect or hold any sensitive personal data (racial origin, religious belief, health data, criminal record, sexual behaviour, etc.) under PDPA Section 26.

2.2 Visitor data we may incidentally process

When you load a page, our hosting provider (Cloudflare) processes your IP address for the technical purpose of serving the page, blocking abuse, and routing you to the nearest edge node. This is a side effect of using the internet, not something we choose. Cloudflare's privacy policy applies to that processing; we do not receive that data in a way that identifies you. We do not set cookies, do not run analytics scripts, and do not maintain logs keyed to your identity beyond the short retention window Cloudflare uses for security.

3. The lawful basis for re-publishing ฐานทางกฎหมายในการเผยแพร่อีกครั้ง

We rely on PDPA Section 24(1) (preparation of historical documents or archives, study, research, or statistics for public interest, with appropriate safeguards) and on Section 24(5) (legitimate interest of the data controller, except where the data subject’s fundamental rights override it) as the lawful bases for our re-publication of producer data that we did not collect directly from the data subject.

We do not rely on Section 24(4) or Section 24(6). Section 24(4) covers a task carried out in the public interest by the data controller or official authority vested in the data controller; we are a private operator and hold no such authority. Section 24(6) covers compliance with a law to which the data controller is subject; no law requires us to publish this registry. We say so here because a privacy notice that claims the wrong basis is worse than one that claims a narrow one.

The balancing test under Section 24(5) การชั่งน้ำหนักประโยชน์

Section 24(5) is not automatic. It requires the controller to weigh its interest against the data subject’s rights and to record the result. Ours:

1. The interest. Making a fragmented public registry legible — deduplicated, attributed, and searchable — so that buyers, researchers, and the producers themselves can see what the state has recorded.
2. Necessity. The purpose cannot be achieved with less data. A directory without a producer name or an administrative area is not a directory. We publish no field that the purpose does not need, and we add none.
3. The balance. The data was already published by the state for public re-use; the fields are business-facing rather than intimate; we add no inference about a person; and any producer can have their record removed on request. Against that, the residual intrusion is the continued visibility of a business listing the state had already made public. We judge the balance to favour publication — and we accept that a data subject who disagrees may object under Section 32, which ends the matter for that record.

These bases apply because:

1. The data was already made public by a Thai state agency (the Department of Community Development) on an open data portal operating under the EGA Open Government License.
2. Our use is a registry-intelligence read — a public-interest function analogous to research and statistics — and is not a marketing, profiling, or automated-decision use.
3. We add appropriate safeguards: we do not re-identify records with other datasets, we do not sell the data, we provide a public takedown mechanism, and we limit liability through our disclaimer.

Being public is not, by itself, a lawful basis. The Thai PDPA — unlike some regional statutes — contains no exemption for personal data that is already publicly available. Data that identifies a person stays personal data whether it sits on an open portal or not. We state this plainly because the opposite assumption is the common one, and it is wrong.

What prior publication actually does is weigh in the balancing test above: the OGD licence and the Official Information Act B.E. 2540 establish that the source publication was lawful, which lowers the marginal intrusion of our re-publication. That is a factor in our favour under Section 24(5). It is not a substitute for having a basis at all.

4. What we do not do สิ่งที่เราไม่ทำ

• We do not collect new personal data from you. There is no registration, no contact form, no newsletter, no survey.
• We do not run advertising networks, retargeting pixels, or social-media tracking.
• We do not sell, license, or sub-license the data to any third party.
• We do not re-identify the data with other datasets (for example, we do not link the registry to social-media profiles or to commercial data brokers).
• We do not make automated decisions about any data subject on the basis of the data.

5. Cross-border processing การส่งหรือโอนข้อมูลไปต่างประเทศ

The site is hosted on Cloudflare Pages. Cloudflare serves content from edge nodes in many countries, including outside Thailand. The PDPC's subordinate regulation of 25 December 2023 exempts data transit and data storage (cloud computing) from the cross-border transfer rules where appropriate technical safeguards are in place. Cloudflare is on the PDPC's accepted adequate-jurisdiction list. We do not, of ourselves, transfer the data to a third country for new processing purposes; the cross-border element is incidental to the hosting.

6. Data retention ระยะเวลาในการเก็บรักษาข้อมูล

The producer data on the site is held for as long as the source remains publicly available on data.go.th. We refresh the data when the source is updated; we remove a record when (a) the source removes it, (b) a producer or authorised representative asks for it removed under the takedown procedure, or (c) we discover, through our own audit, that the record is duplicate, fabricated, or otherwise unfit for the registry.

Visitor-side logs at Cloudflare are retained for the short window Cloudflare requires for security and abuse prevention (typically 30 days), and are not under our control.

7. Your rights under the PDPA สิทธิของคุณตามกฎหมาย

If you are a producer in the registry, or any other data subject whose personal data appears on this site, the PDPA grants you the following rights. We will honour them within the statutory windows.

8. Security ความปลอดภัย

The site is served over HTTPS. The site does not collect credentials, does not maintain a user database, and does not store visitor data beyond the short-window Cloudflare security logs described above. The site source code is published; the data pipeline is auditable.

9. Changes to this policy การเปลี่ยนแปลงนโยบาย

We may revise this policy. The "Last updated" date at the bottom of the page will change. Material changes (a change in the lawful basis, a change in the data controller, a change in the cross-border posture) will be flagged with a banner on the site for at least thirty days before they take effect.

10. Contact ติดต่อ