Privacy policy

Who is responsible

The controller is S1968 Manpower Co., Ltd., registration number 0145563001881, registered at 16 Soi Sriburapha 16, Bang Kapi, Bangkok, Thailand. It holds overseas employment licence No. Tor.1250/2565 issued by the Department of Employment, Ministry of Labour, Thailand. Directors: Suchat Chantralak (Managing Director), Ratana Chuntaseng (Director).

S.1968 Manpower Europe is that company's own representation for Europe and a trading name of it. The Bangkok office and the European office are one legal person, which is why your enquiry is answered by one company and not passed between two.

For anything in this policy, write to [email protected]. We answer within one month, as Article 12(3) GDPR requires.

What we collect

From the enquiry form: your company name, business email address, country, sector, the number of people you need, your timeline, and whatever you write in the free-text field. Nothing on the form asks for a private individual’s data and you should not put any there.

From the salary guide and company profile requests: an email address, so we can send the file.

From your visit, if you agree to analytics: the pages you open, roughly where you are, and which site sent you. This comes from Google Analytics 4 and only runs after you press Accept.

From your visit, whether or not you agree: an anonymous count of page views, referrer and country through Cloudflare Web Analytics, which sets no cookies and identifies nobody. Cloudflare also keeps short-lived server logs, including IP addresses, to deliver the site and block attacks.

Why, and on what legal basis

To answer your enquiry and prepare an offer: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract. Without this data we cannot reply, which is the only consequence of not providing it.

To send the guide or profile you asked for: the same basis.

Google Analytics: Article 6(1)(a), your consent, which you gave by pressing Accept and can withdraw at any time from the link in the footer. Withdrawal does not affect what was lawful before it.

Cloudflare analytics and server logs: Article 6(1)(f), our legitimate interest in knowing whether the site works and in keeping it available. The data is aggregated and not used to build a profile of you.

We do not make automated decisions about you within the meaning of Article 22, and we do not profile you.

Cookies and browser storage

Nothing is written to your device before you choose. There is no "by continuing to browse you agree".

If you answer the analytics banner, one entry is kept in your browser’s local storage recording your answer, so we do not ask again. It contains the word granted or denied and nothing else, and it never leaves your browser. Storing it is covered by the strictly-necessary exemption in Article 5(3) of Directive 2002/58/EC, but we would rather tell you it exists than rely on that.

If you press Accept, Google Analytics sets its own cookies. Pressing "Turn analytics off" in the footer stops that.

For visitors in Germany, the storage rules above are those of §25 TDDDG.

Who else sees your data

Google (Ireland and the United States): the form endpoint, the spreadsheet your enquiry is stored in, and Google Analytics.

Zoho (United States and India): the mailbox behind [email protected].

Telegram: a notification that an enquiry arrived, containing the same fields as the form.

Cloudflare (United States): hosting and analytics.

Nobody else. Our Bangkok office is not on this list because it is not a third party: it is the same company. We do not sell data, and we do not share it for anyone else’s advertising.

Where your data is processed

We are a Thai company, so your data is held in Thailand from the moment you send it. This is not a transfer out of the European Union within the meaning of Chapter V of the GDPR: you give the data to us directly, and there is no European exporter in between. The European Data Protection Board states this expressly in Guidelines 05/2021 on the interplay between Article 3 and Chapter V. The GDPR applies to us in full all the same, because we offer services to people in the Union - Article 3(2)(a).

The providers listed above keep copies in the European Union and the United States. Google and Cloudflare are certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023, and they contract in addition on the standard contractual clauses of Commission Implementing Decision (EU) 2021/914. We use their published data-processing terms; write to [email protected] if you want to know which provider holds what.

How long we keep it

Enquiries and the correspondence that follows them: three years from our last contact with you, after which the row is deleted from the spreadsheet and the thread from the mailbox. If you become a client, the retention follows the contract and the tax rules that apply to it.

Analytics: Google Analytics retains event data for fourteen months. Cloudflare analytics is aggregated and holds nothing that identifies you.

Telegram notifications: deleted together with the enquiry.

Your rights

You may ask us for a copy of the data we hold about you (Article 15), to correct it (16), to delete it (17), to restrict what we do with it (18), and to receive it in a portable form (20).

You may object at any time to processing we base on legitimate interest, including the Cloudflare analytics (Article 21). Tell us and we will stop unless we can show compelling grounds that override your interests.

You may withdraw consent to Google Analytics at any time, from the link in the footer of every page (Article 7(3)).

You may complain to a data protection supervisory authority, in the member state where you live, work, or where you think something went wrong (Article 77). If you are in Germany, the authority is the one for your federal state; in Poland, the Urząd Ochrony Danych Osobowych; in Czechia, the Úřad pro ochranu osobních údajů.

Thailand: the PDPA

S1968 Manpower Co., Ltd. is a Thai company and is also a data controller under the Personal Data Protection Act B.E. 2562 (2019). This page serves as the notice required by section 23 of that Act.

The lawful bases relied on are section 24(3), steps at the data subject’s request prior to a contract, and section 24(5), legitimate interest, mirroring the GDPR bases above.

No data protection officer has been designated. The thresholds in the notification under section 41(2), in force since 13 December 2023, are not met: this site does not carry out large-scale systematic monitoring and sensitive data is not a core activity of it. Requests under the PDPA go to [email protected].

Changes

This policy was last changed on 2026-09-17. If we change it materially we will say so here and date the change, rather than editing quietly.