Privacy policy
What we collect when you use this site, why we collect it, who else handles it, how long we keep it, and what you can tell us to do about it. Written to Thailand's Personal Data Protection Act B.E. 2562 (2019).
1. Who we are
PJJ Solutions Co., Ltd. is the data controller for the personal data described here. That means we decide what is collected and why, and we are the ones answerable for it under the Personal Data Protection Act B.E. 2562 (2019), which this page calls the PDPA.
- Company: PJJ Solutions Co., Ltd.
- Registered office: [registered address — to confirm]
- Company registration number: [registration no. — to confirm]
- Email: solarbuddies@pjjsolutions.tech
We have not appointed a Data Protection Officer. Our processing is small in scale, is not systematic monitoring, and does not involve the sensitive categories of data in section 26 of the PDPA, so section 41 does not require one. Enquiries about this policy go to the email address above and are handled by a person, not a queue.
2. What we collect
Everything on this list is here because the site actually collects it. There is nothing collected that is not on this list.
| What | Where it comes from | Is it optional? |
|---|---|---|
| Full name | The feasibility request form on the home page | Required by the form |
| Work email address | The same form | Required — it is how we send the report back |
| Company name | The same form | Required |
| Your consent, and the time you gave it | The tick box on the form, recorded with a timestamp | Required, and recorded because the PDPA obliges us to be able to show that consent was given |
| Anything you write to us | Email you send us, and our replies | Entirely up to you |
| Electricity bills and site data | Files you send us so we can model your site — see section 5 | Entirely up to you |
| Standard server logs | Our hosting provider records IP address, time, page requested, browser type for every visit, as any web server does | Not optional — a server cannot answer a request without receiving it |
We do not ask for and do not want your national ID number, financial account details, or any of the sensitive data in section 26 of the PDPA — health, religion, political opinion, biometrics and the rest. Please do not send them. If you send them anyway we will delete them rather than file them.
3. Why, and on what legal basis
The PDPA requires us to have a lawful basis for each purpose, not just a reason we find convincing. Here they are, one row each.
| Purpose | Data used | Legal basis (PDPA s.24) |
|---|---|---|
| Preparing the feasibility assessment you asked for, and sending it to you | Name, email, company, anything you send us | Your consent — s.19, recorded by the tick box |
| Replying to you, and the conversation that follows | Name, email, company, correspondence | Your consent, and steps taken at your request before entering a contract — s.24(3) |
| Keeping the site up and defending it from abuse | Server logs | Legitimate interest — s.24(5). Running a web server securely is a narrow interest that does not override your rights |
| Meeting tax, accounting and legal obligations if you become a client | Contract and billing records | Legal obligation — s.24(6) |
We do not use your data for marketing, we do not add you to a newsletter, and we do not profile you. If we ever want to, we will ask you first, separately, and a refusal will cost you nothing.
4. The consent tick box
The form will not submit until you tick the box that says you consent to us processing the information to prepare a feasibility assessment. That tick is our legal basis for the first two purposes in the table above, so it matters that it means something.
What you are agreeing to: that we may hold your name, work email and company name, use them to build and send you a feasibility assessment, and contact you about it. Nothing else.
You can withdraw it at any time, and withdrawing is meant to be as easy as giving it: email solarbuddies@pjjsolutions.tech and say so. You do not have to give a reason. We will stop, and delete what we hold unless the law requires us to keep a record of a transaction that already happened.
Withdrawing consent does not undo the processing we did while it was valid, and it cannot recall a report already sent. It also means we can no longer work on your assessment, which we will tell you plainly rather than treat as a penalty.
5. The bills you send us
Our whole offer is "send us twelve months of billing data", so this deserves its own section rather than a line in a table.
Electricity bills and load data are mostly commercial information about a site, not personal data about a person. But they often carry some personal data along with them — the name of the account holder, a site address, the name and mobile number of whoever signed the meter agreement. We treat the whole file as if it were personal data, because separating it is more error-prone than protecting it.
- We use it to model your site, and for nothing else.
- We do not publish it, and we do not show it to other clients.
- Figures from an engagement only ever appear publicly in an anonymised, aggregated form, and only with your written agreement first. The pilot site described on our home page is anonymised at that client's request, which is the standard we hold ourselves to.
- If you want it deleted once the assessment is delivered, say so and we will delete it and confirm that we have.
6. Who else handles it
We are a small company and we use ordinary tools. Three third parties touch this data as our processors. There are no others, and none of them is an advertising network.
| Who | What they do with it |
|---|---|
| Vercel Inc. | Hosts this website. Receives and logs the technical details of every request — IP address, time, page, browser — as part of serving the page to you. |
| Google LLC (Workspace, Sheets, Apps Script) | Your form submission is written to a spreadsheet in our Google Workspace account and emailed to us. Our email also runs on Google Workspace, so anything you send us is stored there. |
| Google Fonts | The typeface on this page is loaded from Google's font servers, which means your browser tells Google your IP address and roughly what browser you are using when the page loads. This happens on any page you open, before you interact with anything. We will remove this dependency by serving the font ourselves; until we do, it is listed here because it is true. |
We do not sell personal data, we do not rent it, and we do not share it with anyone for their own purposes. If we ever engage a processor not on this list, this page changes before they receive anything.
7. Where it goes
Vercel and Google both run global infrastructure, so your data is stored and processed on servers outside Thailand, including in the United States and the European Union. Section 28 of the PDPA requires us to tell you this and to have a basis for it.
Ours is your consent, given with knowledge of the transfer — which this section is here to give you — together with the contractual safeguards those providers commit to for international transfers. If you are not comfortable with that, say so before you send us anything and we will agree another way to work.
8. How long we keep it
| What | Kept for |
|---|---|
| Form submissions and the correspondence around them | 24 months from our last contact with you, then deleted |
| Bills and site data, where no engagement follows | Deleted once the assessment is delivered and the conversation has closed, or sooner if you ask |
| Records relating to an actual engagement | The life of the engagement, plus the period Thai tax and accounting law requires — five years for accounting records |
| Server logs | The retention period of our hosting provider, which is short and measured in days rather than years |
Deleted means deleted from the spreadsheet and the mailbox. Backups held by our providers age out on their own cycles, which we do not control and will not claim to.
9. What we don't do
A privacy policy is more useful for what it rules out than for what it permits, so: as of the date on this page, this website
- sets no cookies at all — none, not even functional ones;
- has no analytics: no Google Analytics, no Meta pixel, no session recording, no heatmaps;
- has no advertising or retargeting trackers;
- stores nothing in your browser's local storage;
- makes no automated decisions that produce legal effects for you. Our models forecast electricity loads, not people;
- does not enrich your details from data brokers or scrape your company for contacts.
This is verifiable rather than a promise: open your browser's developer tools on any page of this site and look. If that ever stops being true, this section changes in the same commit that makes it untrue.
10. Your rights
Sections 30 to 36 of the PDPA give you the following rights over your own data. They are yours whether or not you are a client, and using any of them costs nothing.
- Access — ask what we hold about you, and get a copy of it.
- Portability — get it in a machine-readable form, or have it sent to someone else, where that is technically possible.
- Object — tell us to stop a particular use of your data.
- Erasure — have it deleted, including when you have withdrawn consent and we have no other basis to hold it.
- Restriction — have us suspend use of it while something is being sorted out.
- Rectification — have it corrected if it is wrong, or completed if it is partial.
- Withdraw consent — at any time, as described in section 4.
- Complain — to the Office of the Personal Data Protection Committee, as described in section 15.
11. How to use them
Email solarbuddies@pjjsolutions.tech and say what you want. There is no form to fill in and no portal to sign into.
- We will acknowledge within a few working days.
- We will act on it within 30 days, the period the PDPA sets for access requests, and we apply the same deadline to the others.
- We may ask you to confirm your identity — usually just by replying from the address you originally used. This is to stop someone else requesting your data, not to make you work for it.
- If we refuse a request, we will tell you why in writing, and tell you that you can complain to the PDPC about the refusal.
12. Security
The honest version: we protect this data with the security of the platforms we have chosen and a small number of practices of our own.
- The site is served over HTTPS, and form submissions travel encrypted.
- Submissions land in a Google Workspace account protected by two-factor authentication, accessible to the handful of people at PJJ who need it and no one else.
- The form carries a spam trap so automated submissions do not fill the record with other people's junk.
- The page runs no third-party scripts, which is the largest single source of leaks on most company websites.
No system is perfect. If a breach occurs that is likely to affect your rights, the PDPA requires us to notify the PDPC within 72 hours of becoming aware of it, and to notify you where the risk is high. We will do both, and we will tell you what happened rather than issue a statement about how seriously we take your privacy.
13. Children
This site sells industrial energy systems to factories. It is not directed at children and we do not knowingly collect data from anyone under 20, the age at which a person can give consent for themselves under Thai law. If you believe a minor has sent us their details, tell us and we will delete them.
14. Changes
When this policy changes, the version and date at the top of the page change with it, and the previous version stays in the public history of the repository this site is built from. We will not quietly edit it.
If a change materially affects data we already hold — a new purpose, a new processor, a longer retention period — we will contact the people affected rather than rely on you re-reading this page.
15. Contact and complaints
Any question about this policy, any request about your data, and any complaint: solarbuddies@pjjsolutions.tech.
We would rather hear it from you first and fix it. But it is your right to go straight to the regulator, and we are not going to bury that: you can complain to the Office of the Personal Data Protection Committee (PDPC), the authority responsible for enforcing the PDPA in Thailand, at pdpc.or.th.