Privacy Policy

Last updated: 16 October 2026

Who we are

MERCIL Solution Co., Ltd. ("MERCIL", "we", "us"), of 1077/38 Siamese Ratchakru Building, Phahonyothin Road, Samsen Nai, Phaya Thai, Bangkok 10400, Thailand, is the data controller for the personal data described in this notice.

If you have a question about this notice or your personal data, or want to use any of your rights, email privacy@mercil.co.th or call +66 2 278 1259.

This notice explains how we handle personal data collected through this website, under Thailand's Personal Data Protection Act B.E. 2562 (2019) (the "PDPA"). For cookies and similar technologies, see our Cookie Policy. It does not cover other websites we link to, including our product LOOCA at looca.io, which has its own privacy notice.

What we collect

You can browse this website without telling us who you are. We collect personal data when you send us one of the forms below or contact us directly and, only if you accept analytics cookies, information about how you use the website (see "Website analytics" below).

Consultation form

your name
your work email address
your phone number (optional)
the name of your organization
the service you are interested in
your message
your consent, with the date and time you gave it and the version of the consent text you agreed to

Job application form

your name
your email address
your phone number (optional)
the position you are applying for
your message
a link to your portfolio, LinkedIn profile or CV, if you give one
your consent, with the date and time you gave it and the version of the consent text you agreed to

Email, phone and Messenger

If you email or call us, or message us on Facebook Messenger, we receive what you choose to send, such as your name, contact details, message and any documents (for example a CV), and we handle it in the same way as an enquiry or, if it is about a job, an application. Messages on Messenger are also handled by Meta under its own privacy policy.

With both forms we also record the page the form was sent from and the language of the site, so that we can reply in the right context, and we keep the status of your enquiry or application and our notes on it.

We do not store your IP address, browser details or the page you came from. To protect the forms from spam, our server uses a scrambled (hashed) form of your IP address in its memory to limit repeated submissions; it is never saved, and it is discarded 10 minutes after your last submission.

We do not ask for sensitive personal data, such as health, religious or criminal-record information. Please do not include it in your message or links.

Website analytics

If you select "Accept analytics" in our cookie notice, we use Google Analytics 4 to see how the website is used: the pages you view, how you arrived (for example from a search engine), clicks on our email, phone and consultation links, whether you started filling in a form and whether it was sent (never what you wrote), and general information about your device, browser and approximate location (city or country). Google Analytics gives your browser a random identifier in a cookie. It does not store your IP address, and we never send it your name, email address or anything you type into our forms. We look at this data only in summarised form, to improve the website. If you choose "Essential only", or make no choice, Google Analytics does not load at all.

With the same consent, we also use Hotjar to record how visitors scroll, click and move through our pages, so we can see where the website is confusing. Recordings never show our forms (they appear as blank blocks) or anything you type, and Hotjar does not store your full IP address.

Why we use it and the basis we rely on

To reply to your enquiry and discuss the services you asked about. We rely on your consent, which you give by ticking the box on the form (PDPA Section 19), and on taking steps at your request before entering into a contract (Section 24(3)).
To consider your job application for the position you applied for and contact you about it. We rely on your consent and on taking steps at your request before entering into an employment contract (Section 24(3)). We do not use your application for other positions; you are welcome to apply again.
To keep a record of your consent and of our replies, so that we can show how we handled your data and deal with any dispute. We rely on our legitimate interest (Section 24(5)).
To protect the forms from spam and abuse. We rely on our legitimate interest in keeping the website working and secure (Section 24(5)).
To understand how the website is used and improve it, with Google Analytics and Hotjar session recordings, only if you accept analytics cookies. We rely on your consent (Section 19), which you can withdraw at any time in "Cookie settings" at the bottom of every page.

We do not sell your personal data, send you marketing emails, or make automated decisions about you. Google's advertising and personalisation features are switched off. We will not use your personal data for an unrelated purpose without telling you first and, where the law requires it, asking for your consent.

How long we keep it

Enquiries: up to 2 years after our last contact with you. If you become our client, we keep what the contract needs, and what accounting and tax law require, for as long as they require.
Job applications: up to 1 year after the position is filled or closed. If you join MERCIL, your application becomes part of your employee record.
Emails: copies of your enquiry or application in our email, and emails you send us directly, are deleted on the same schedule.
Backups: our encrypted database backups are deleted automatically after 30 days.
Website analytics: Google Analytics keeps this data for 14 months, and Hotjar keeps recordings for up to 12 months; both then delete it automatically.

After these periods we delete your personal data or make it anonymous. If you withdraw your consent or ask us to delete your data sooner, we will do so unless we have another lawful reason to keep it, such as a legal obligation or a legal claim.

We share your personal data only with:

Amazon Web Services, which hosts this website, its database and backups for us;
Amazon Simple Email Service (part of Amazon Web Services), which sends us an email notice of each enquiry or application;
our business email provider, which holds those notices and our replies to you;
Google LLC, which provides Google Analytics, only if you accept analytics cookies;
Hotjar Ltd, which provides session recordings, only if you accept analytics cookies;
professional advisers or public authorities, where the law requires it or where it is needed to establish, exercise or defend legal claims.

Our service providers act on our instructions under data processing terms, and may not use your data for their own purposes.

Transfers outside Thailand

The website, its database and backups are stored in Thailand (Amazon Web Services, Bangkok region). The email notices are sent through Amazon Simple Email Service in Singapore, and our business email provider may store email in other countries. If you accept analytics cookies, Google Analytics processes that data in the United States and other countries, and Hotjar stores recordings in the European Union (Ireland). When personal data leaves Thailand, we do so only as permitted by Sections 28 and 29 of the PDPA, relying on our providers' data processing terms and safeguards.

Keeping your data secure

We protect your personal data with security measures that suit the risk, as required by Section 37 of the PDPA. Data is encrypted in transit (HTTPS), our backups are encrypted, and access is limited to the MERCIL staff who need it for the purposes above, each with their own account.

If a personal data breach is likely to put your rights at risk, we will notify the Office of the Personal Data Protection Commission within 72 hours of becoming aware of it and, where the risk is high, tell you without delay.

Your rights

Under the PDPA (Sections 30 to 36) you have the right to:

access your personal data and get a copy of it, and ask how we obtained data you did not consent to (Section 30);
receive or transfer your data in a commonly used electronic format, where this is technically possible (Section 31);
object to our collection, use or disclosure of your data, including where we rely on legitimate interest (Section 32);
ask us to delete or destroy your data, or make it anonymous, for example when it is no longer needed or you withdraw your consent (Section 33);
ask us to restrict the use of your data, for example while we check a correction request (Section 34);
ask us to correct data that is inaccurate, out of date or incomplete (Sections 35 and 36).

These rights are subject to the conditions and exceptions in the PDPA. To use any of them, email privacy@mercil.co.th. We may need to confirm your identity first. We respond within 30 days, free of charge.

You can withdraw your consent at any time by emailing privacy@mercil.co.th; for analytics cookies, use "Cookie settings" at the bottom of every page. Withdrawing is as easy as giving consent, and it does not affect what we did with your data before you withdrew. If you withdraw while your enquiry or application is still in progress, we may not be able to continue with it.

If you are under 20

If you are under 20 (a minor under Thai law), please ask a parent or guardian before sending us your personal data, as their consent may be required (Section 20).

Complaints

If you think we have not handled your personal data in line with the PDPA, please contact us first so we can try to put it right. You also have the right to complain to the Office of the Personal Data Protection Commission (PDPC) (Section 73).

Changes to this notice

We may update this notice from time to time. The date of the latest version is shown at the top of this page. If a change affects how we use data you have already given us, we will tell you before it applies.