Privacy Policy

1. Who controls your data

VR All Accounting Service Co., Ltd., company registration number 0105558110081, is the data controller under this policy. It covers our services across all three offices and your use of the vrallact.com website.

2. What personal data we collect

We collect only what we need to serve you and to reply to you, grouped by how we received it.

• From the contact form on this website — your name, phone number, the topic you selected, and any details you chose to write.
• From other channels — the messages and information you send us via LINE, Facebook, email or telephone.
• From delivering our services — company records, accounting and tax documents, bank statements, details of directors and shareholders, and your employees' details to the extent needed for payroll and social security work.
• From visiting the website — IP address, device and browser type, pages viewed, time of visit, and where the visit came from, collected through cookies and analytics tools (see section 4).

We do not set out to collect sensitive data under section 26 of the PDPA, such as health or criminal records. If documents you send happen to contain such data, we use it only where the law requires us to.

3. Why we process your data, and on what legal basis

We process your personal data for the following purposes and legal bases.

• Replying to your enquiry and preparing a quote — steps taken at your request before entering a contract.
• Providing bookkeeping, audit, tax filing and registration services — performance of our contract with you.
• Preparing and submitting documents to government agencies, and retaining records as required — compliance with a legal obligation.
• Keeping our systems secure, preventing misuse, and improving the website — our legitimate interests.
• Analysing website use through non-essential cookies, and sending news or promotions — your consent, which you may withdraw at any time.

4. Cookies and website analytics

This website uses cookies that are necessary for it to work, and Google Analytics via Google Tag Manager to see which pages people visit. That data is aggregate statistics and is not used to identify you personally.

• Strictly necessary cookies — required for the site to function; these cannot be switched off.
• Analytics cookies — visit statistics used to improve the site's content and speed.

You can block or delete cookies in your browser settings, though disabling some types may stop parts of the site from working properly.

5. Who we share data with

We do not sell or trade your personal data for marketing purposes. We disclose it only as far as necessary, to the following.

• Government agencies connected to the work you have engaged us for, such as the Department of Business Development, the Revenue Department, and the Social Security Office.
• The Certified Public Accountant who audits and certifies your financial statements.
• Service providers we rely on to operate, such as our web hosting provider, email provider, and website analytics provider.
• Authorities with legal power to require it, on a lawful order or warrant.

We select providers that meet acceptable security standards and permit them to process data only on our instructions.

6. Transfers outside Thailand

The website platform and analytics tools we use may process or store data on servers located outside Thailand. We choose providers that maintain data protection safeguards at the level the law requires.

7. How long we keep data

We keep data for as long as needed for the purposes stated above, or for as long as the law requires — whichever is longer.

• Client accounting records and documents — kept for at least 5 years from the closing date, as required by the Accounting Act B.E. 2543 (2000).
• Contact form submissions from people who have not become clients — kept no longer than 1 year from the last contact.
• Website usage statistics — kept for the standard retention period of the analytics tool in use.

Once those periods end, we delete, destroy, or anonymise the data.

8. How we keep data secure

We maintain appropriate measures to prevent unauthorised access, use, alteration or disclosure.

• Access is limited to staff who need the data for their work.
• The website's admin system requires authentication and separates permissions by role.
• The website is served over an encrypted connection (HTTPS) throughout.
• Paper records are stored in access-controlled premises.

9. Your rights

Under the Personal Data Protection Act B.E. 2562 (2019), you have the right to:

• Access your personal data and obtain a copy of it.
• Have your data transferred to another data controller.
• Object to the collection, use or disclosure of your data.
• Request that your data be deleted, destroyed or anonymised.
• Request that use of your data be suspended.
• Have inaccurate, outdated or misleading data corrected.
• Withdraw consent you previously gave, at any time.

Some rights may be limited by law — for example, accounting records we are legally required to retain for a set period. If we cannot act on a request, we will tell you why.

10. Changes to this policy

We may update this policy when the way we work or the legal requirements change. The date at the top of this page always shows when it was last revised. If a change is significant, we will notify you through an appropriate channel.

11. Contacting us and making a complaint

To exercise your rights, ask about this policy, or raise a data protection concern, contact us using the details below. Please put “PDPA request” in the subject line so we can route it to the right person, and we will respond within 30 days of receiving your request.

If you believe we are not complying with data protection law, you have the right to lodge a complaint with Thailand's Personal Data Protection Committee.