PRIVACY NOTICE
Last Updated: 7 September 2026
XDMAND COMPANY LIMITED (“XDmand”, “we”, “us” or “our”) respects the privacy, confidentiality and business information of our clients, prospective clients, partners and website visitors.
This Privacy Notice explains how we collect, use, disclose, store and protect personal information when you visit our website, contact us, request information or consultation, communicate with us, or engage with our professional services.
For the purposes of applicable data protection laws, including the Thailand Personal Data Protection Act B.E. 2562 (2019) (“PDPA”), XDMAND COMPANY LIMITED acts as the data controller where we determine the purposes and means of processing personal data.
Depending on how you interact with XDmand, we may collect personal information including:
We encourage website visitors not to submit confidential financial information, sensitive personal data or commercially sensitive documents through the general website contact form unless specifically requested by XDmand.
Contractual Necessity — Processing may be necessary to take steps at your request before entering into a contract or to perform obligations under an existing agreement.
Legitimate Interests — We may process information where reasonably necessary for legitimate business purposes, including responding to business enquiries, managing client relationships, improving our services and protecting our business, provided that such interests do not improperly override the rights of individuals.
Legal Obligations — Certain information may be processed or retained where required by applicable laws, accounting requirements, tax regulations or other legal obligations.
Consent — Where required by law, we may request your consent before processing personal information for a specific purpose. Where processing is based on consent, you may withdraw your consent subject to applicable legal requirements.
Information submitted through the XDmand website is generally used to understand and respond to your enquiry.
A professional client engagement may involve significantly different types of information, including operational, financial and accounting, logistics and supply chain, technology or system information, business strategies, commercial information, process documentation, project data, and information concerning employees, suppliers, vendors or customers.
Where confidential or sensitive information is required for a project, appropriate confidentiality, access and data-handling requirements should be agreed separately as part of the engagement.
XDmand recognizes that professional advisory and transformation projects may involve commercially sensitive and confidential business information. Client confidential information is treated separately from ordinary website information.
We do not intentionally publish or disclose client financial, accounting, commercial or operational data, internal reports, business strategies, project documentation, system information, proprietary materials, or identifiable project results without appropriate authorization.
Where required, confidentiality obligations may also be established through Non-Disclosure Agreements (NDAs), service agreements, project agreements, data-processing arrangements, or other contractual confidentiality provisions.
XDmand may describe project experience in anonymized form where client identity and commercially sensitive information have been removed. We will not intentionally identify a client publicly through a case study, testimonial or marketing material without appropriate authorization.
Some XDmand engagements may involve artificial intelligence, automation, cloud platforms, software systems or other third-party technologies. XDmand does not assume that every project requires confidential client information to be processed through an AI system.
Our approach is to use technology only where it supports the agreed business objective and where an appropriate operating and data-handling approach can be established. Client confidential information will not intentionally be submitted to AI platforms or third-party systems outside the agreed scope of an engagement.
Where AI or third-party technology is proposed to process client information, relevant considerations may include purpose of processing, type and sensitivity of information, required data fields, access permissions, system architecture, storage location, user access, security requirements, data retention, human review and approval requirements, and appropriate confidentiality controls. These requirements may be discussed and agreed with the client before implementation where appropriate.
In certain consulting, technology or transformation engagements, XDmand may process personal information under the instructions of a client. In such circumstances, the client may remain the relevant data controller while XDmand acts as a data processor or provides supporting services, depending on the nature of the engagement.
Responsibilities may be further defined through the applicable contract, project agreement, data-processing agreement or other relevant documentation. Where XDmand acts as a processor, we will process personal information within the agreed scope and instructions of the relevant client, subject to applicable legal requirements.
XDmand may disclose personal information where reasonably necessary to parties including technology providers supporting our business, website hosting and cloud service providers, email and communication providers, professional advisers, accountants or auditors, project partners, specialist consultants involved in an agreed engagement, service providers supporting XDmand operations, and government agencies, regulators or authorities where required by applicable law.
Where service providers process information on our behalf, we expect appropriate confidentiality and data-protection requirements to apply. XDmand does not intentionally disclose client confidential information for unrelated commercial purposes.
Some cloud, technology, hosting, communication or professional service providers may operate systems or infrastructure outside Thailand. Where personal information is transferred or processed internationally, XDmand will consider applicable legal requirements and appropriate safeguards relevant to such transfer.
For projects involving material, financial, operational or sensitive information, international data-processing requirements may also be considered as part of the project architecture and data-handling arrangements.
XDmand applies reasonable organizational and technical measures appropriate to the nature of the information being processed, which may include limiting access to authorized personnel, providing access only where required for a specific engagement, applying confidentiality obligations, defining appropriate information-handling requirements, managing access to project information, using appropriate technology and communication platforms, and reviewing data-handling requirements for sensitive engagements.
Projects involving financial, accounting, operational, technology or other sensitive information may require additional security requirements agreed with the client. While XDmand takes reasonable measures to protect information, no internet transmission, cloud platform, communication system or information system can be guaranteed to be completely secure.
XDmand retains personal information only for as long as reasonably necessary for the purpose for which it was collected, managing an existing or potential business relationship, completing a professional engagement, maintaining appropriate contractual and business records, accounting and tax requirements, legal and regulatory obligations, resolving disputes, and establishing or defending legal claims.
Different categories of information may therefore have different retention periods. When personal information is no longer reasonably required, it may be securely deleted, destroyed or anonymized, subject to applicable legal, regulatory and contractual requirements. Specific retention requirements for project information may also be agreed with the client as part of the applicable engagement.
The XDmand website may use technologies necessary for the operation, security and performance of the website. We may also use analytics or similar technologies to understand how visitors interact with our website where applicable, which may collect IP address, device type, browser information, pages visited, approximate usage information and website interaction information.
Where non-essential cookies or similar technologies require consent under applicable law, XDmand may provide an appropriate cookie notice or preference mechanism.
Where permitted by applicable law, XDmand may contact existing or prospective business contacts regarding relevant professional services, business information, events or updates. Where consent is legally required, such communication will be based on appropriate consent.
You may request that XDmand stop sending marketing communications at any time by contacting us at contact@xdmand.com or by using an available unsubscribe mechanism. Service-related, contractual or administrative communications may continue where necessary.
If you provide XDmand with personal information relating to another individual, such as an employee, colleague, supplier, vendor, customer or business contact, you should ensure that you are authorized or otherwise legally permitted to provide such information where required. You should also avoid providing unnecessary personal information to XDmand.
XDmand does not generally require sensitive personal data through the public website. Please do not voluntarily submit sensitive personal information through the general contact form unless it is necessary and specifically requested.
Where processing of sensitive personal data is necessary for an engagement, XDmand will consider the appropriate legal basis and additional safeguards required under applicable law.
Subject to applicable law and the circumstances of the processing, you may have rights including the right to request access to your personal information, receive a copy of certain personal information, request correction of inaccurate or incomplete information, request deletion or erasure in applicable circumstances, request restriction of processing, object to certain processing, withdraw consent where processing is based on consent, request data portability where applicable, and lodge a complaint with the competent data protection authority.
The exercise of certain rights may be subject to applicable legal exceptions or limitations. XDmand may need to verify your identity before responding to certain requests in order to protect your information and the information of others.
If you wish to exercise your personal data rights or have questions regarding how XDmand handles personal information, please contact XDMAND COMPANY LIMITED at contact@xdmand.com. Please provide sufficient information to allow us to identify the relevant information and understand your request. We will respond in accordance with applicable legal requirements.
For questions regarding this Privacy Notice, confidentiality, personal information or data-protection matters, please contact:
XDMAND COMPANY LIMITED
920 Soi Lat Phrao 47
Saphan Song Subdistrict
Wang Thonglang District
Bangkok 10310, Thailand
Email: contact@xdmand.com
XDmand may review or update this Privacy Notice periodically to reflect changes in our services, technology, business operations, website functionality, or legal or regulatory requirements.
Any updated version will be published on the XDmand website together with the date of the latest revision. Where changes materially affect the way personal information is handled, additional notice may be provided where appropriate.
XDMAND COMPANY LIMITED
Privacy Notice — Last Updated 7 September 2026