Legal

Privacy notice

Last updated: 28 October 2026

This notice explains how Neo Leaf Co., Ltd. (“Neo Leaf”, “we”) handles personal data collected through our websites (neoleaf.co.th, including its manufacturing and products sections, neoleaf-manufacturing.com and neoleaf-products.com) and through the enquiries you send us.

Who we are

Neo Leaf Co., Ltd. is the data controller. Registered in Thailand, registration number 0105568140285. Head office: 299/4 Kanchanapisek Rd Soi 61, Dok Mai, Prawet, Bangkok 10250, Thailand. Privacy questions: info [at] neoleaf-manufacturing.com · .

What we collect

When you send an enquiry or request a sample: your first and last name, email address and country, and if you give them, your company, phone number and anything you write in your message. For a sample, the delivery address and the courier account number you give us.
When you subscribe to news: your email address, only if you tick the separate box.
When you visit the sites: technical data that reaches our hosting provider with every request, such as IP address, browser type, the page requested and the time. We count visits without cookies and without building a profile of you.
Bot protection: our forms use a check that tells people from automated programs. It looks at technical signals from your browser when you use the form.

What you must give us, and why

Name, email address and country are needed to answer an enquiry; without them we can't reply. For a sample we also need a delivery address, or we can't send it. Everything else is optional.

Sensitive data

We don't ask for sensitive data, such as health information. Please don't include it in your messages. If you send it anyway, we use it only as far as needed to answer you, or delete it.

Why we use it, and on what basis

We don't sell personal data and don't use it for automated decisions about you.

To answer your enquiry, prepare a quotation, send samples and do business with you: if you act for yourself, to take steps at your request before a contract and to perform it (PDPA s.24(3)); if you act for a company, our legitimate interest in dealing with that company (s.24(5)).
To keep a record of our contact with customers and prospective customers, and to protect the sites and forms against misuse: our legitimate interests (s.24(5)).
To send you news, only if you ask for it: your consent (s.19). You can withdraw it at any time with the link in every email or by writing to us.
To keep accounting and tax records: legal obligation (s.24(6)).

Who sees it

Our own team.
Service providers working for us under their data processing terms, and only to provide their service: website hosting and visit statistics (Vercel), database, email and file storage (Amazon Web Services), and bot protection (Cloudflare).
Others who use data under their own responsibility: couriers when we send samples, banks for payments, our accountants and auditors, and authorities where the law requires it.

Transfers outside Thailand

Enquiry data is stored mainly in Singapore. Our hosting and bot-protection providers run global networks, so technical data from your visit may also be processed in other countries. We use providers that commit in their data processing terms to protect personal data, and we transfer data only on a basis the PDPA allows.

How long we keep it

Enquiries and related correspondence: 3 years after our last contact with you.
If an enquiry leads to business: with the customer record for as long as the relationship lasts, then as long as Thai accounting and tax law requires for contracts and invoices.
News: until you unsubscribe.
Technical logs: only as long as our hosting provider keeps them to run and secure the service, normally days to a few weeks.

Your rights

You may ask us to give you access to your data or a copy of it, correct it, delete it or make it anonymous, restrict how we use it, or send it to you or another organisation in a common format. You may object to our use of it and withdraw consent you gave. Some of these rights apply only in certain circumstances set by law. Write to us at the contact above; we reply within 30 days. If you think we have handled your data wrongly, you may complain to Thailand's Personal Data Protection Committee (PDPC). If you are in the EU or UK, you may also contact your local data protection authority.

Children

Our sites are for businesses. We don't knowingly collect data from anyone under 20 (the age of majority in Thailand). If we learn we have, we delete it.

Changes

We update this notice when our practices change. The date at the top shows the latest version.