What this site collects, and what it does not

Who holds this, and who to ask

Premium Flexible Packaging Co., Ltd. owns this website and answers for everything it collects. The company works from two places: the plant in Phetchaburi, where the presses are, and the office in Salaya.

Thailand's Personal Data Protection Act asks a company to name the person a question about your data goes to, and to give a way of reaching them directly. Ours is xxx, reached at xxx. Neither has been settled, and both will be printed here when they are rather than pointed at the switchboard.

• Plant — 137 Moo 4, Phetkasem Rd., Tubkhang, Khao Yoi, Phetchaburi 76140
• Office — 88/8 Moo 5, Salaya, Phutthamonthon, Nakhon Pathom 73170
• Phone — 02-429-8414, the number the footer of every page carries
• LINE — @pfppack
• Data protection questions — xxx, which needs a person's name or a job title, and a phone number or an email address that reaches them

The enquiry form

The form asks for your name and email address, and lets you add a phone number, a company, a message and artwork files. That is the whole list. Nothing is gathered alongside it that you did not type or attach.

None of it is required by law and none of it is required by a contract. Name and email are required by the form itself, for the plain reason that without them there is nobody to reply to. Everything else is optional, and leaving it out costs you nothing but a slower first answer.

What you send goes to the people who quote jobs, so that someone can answer you. We do not sell it, and we do not hand it to anyone whose job is not answering your enquiry.

• Name — so a reply can be addressed to a person
• Email address — so there is somewhere to reply to
• Phone number, if you give one — for enquiries that are quicker to answer by phone
• Company, if you give one — so a quote is written to the right buyer
• Message, if you write one, including the answers the pouch configurator sends along with it
• Artwork files, if you attach them — PDF, AI, EPS, PNG, JPEG, TIFF or ZIP, up to 4 MB together (the pouch configurator takes one file instead — PDF, AI, EPS, PNG, JPEG, WEBP, TIFF or ZIP, up to 25 MB)

The artwork files, and who can open them

Files attached to the contact form travel inside the enquiry itself. They arrive in our mailbox as attachments to one email and are not kept anywhere on this website — no file store, no link. Whoever can read that mailbox can open them; nobody else is given an address for them.

The pouch configurator works differently, because it takes a file of up to 25 MB — bigger than a form submission is allowed to be. There your browser puts the file straight into our file store and sends us only the address it landed at.

A file in that store can be opened by anyone holding its address. Every name gets a random suffix, so the address cannot be guessed — but it is a link, not a login, because whoever answers your enquiry has to be able to open your artwork without holding a password.

If a file is confidential, say so when you send it, or send it another way and we will arrange one.

Why we are allowed to hold it

The Act wants a reason before personal data is held, not merely permission. Ours is that you asked a commercial question and it cannot be answered without knowing who is asking and where to reply — the same reason that lets a supplier take a quotation request at all.

That reason covers your enquiry and the quotation that follows it, and stops there. It does not cover marketing you did not ask for. Nothing on this site signs you up to a mailing list, because there is no mailing list.

Who else sees it

Inside the company: the people who quote jobs. Outside it: only the services that carry this website. They hold what passes through them in order to run it; they are not handed a copy to use for themselves.

An enquiry may also be forwarded into whatever system the sales side uses to keep track of leads. Which system that is has not been settled — xxx. It is named here instead of the phrase every policy uses. That phrase says data may be shared with third parties as necessary.

• Vercel — serves this website, keeps its server records, and stores the artwork files sent through the pouch configurator. Files from the contact form pass through it on their way to our mailbox and are not kept.
• The mail service behind our pfppack.com mailbox — where enquiries from the contact form, and their files, arrive as email
• The lead system enquiries are forwarded to — xxx, which needs the name of the service, or a line saying enquiries stay in a mailbox and go nowhere else

Cookies

One thing is stored on your device: your answer to the cookie banner, kept in your browser's local storage under the name cookie-consent-v1. It is what stops the banner asking again on every page.

The banner offers an analytics category and a marketing category. Both are switched off and nothing sits behind either of them — no advertising pixel and no cross-site tracker is installed here. The switches exist so that permission is asked for before something is added rather than after.

Clearing this site's data in your browser removes that answer, and the banner asks again.

Counting page visits

This site does count how often each page is opened, using Vercel's own measurement. It sets no cookie, leaves no identifier on your device and cannot follow you to another website — which is why it was the one chosen, and why it is not one of the switches on the banner above.

What comes out of it is a count of pages, not a record of a person. It is there so that a change to this site can be argued from numbers instead of from taste.

Hosting and server records

The site is served by Vercel. Like any web host it keeps short-lived request records — the address a request came from, the page it asked for, the browser's own description of itself — because that is how a page gets delivered and how an attack gets noticed.

Those records are not used to build a picture of individual visitors.

It is stored outside Thailand

Vercel's servers are not in Thailand. An enquiry on its way to us, an artwork file from the configurator waiting to be opened and the server records above are all held abroad, mostly in the United States. Saying so is part of what the Act asks for. It is easier to say than to discover later.

Thailand has not declared any country's protection adequate, so a transfer like this one rests on the safeguards written into the contract with the service that receives it. Which safeguard this company relies on is xxx — the data processing terms it has accepted with Vercel, named here once they are confirmed.

Nothing here is sent to any country, company or person for a purpose other than running this website.

Keeping it safe

Your enquiry travels over an encrypted connection, and on from this website to our mailbox over an encrypted mail connection. The contact form takes only the seven file types listed above, no more than 4 MB of them, and passes them into one email without keeping a copy. The configurator's upload refuses file types that could be served back as something executable, gives every file a random name so one cannot overwrite another, and stops at 25 MB so the store cannot quietly become a free file host.

The one thing worth stating plainly rather than implying: a configurator artwork link is unguessable, but it is not password-protected. That is a trade, it is deliberate, and it is described two sections up.

How long it is kept

An enquiry is kept for as long as the conversation it belongs to is live, and for xxx after that. An artwork file runs on the same clock as the enquiry it arrived with.

That period has not been set. What it needs is a length of time — a number of months or years, decided once and applied to every enquiry — because the Act asks for a period a reader can hold us to, and a phrase like for as long as necessary is not a period. When it is decided it will be written here rather than left to habit.

Your rights

The Act gives you rights over what we hold about you. Ask by phone or through the form and we will answer; the law allows thirty days for that, and it is a limit rather than a target.

If you think your data has been handled wrongly and we have not put it right, you can complain to the Office of the Personal Data Protection Committee, the regulator the Act creates. That route exists whether or not you have asked us first.

• See it — ask what we hold about you, and get a copy
• Correct it — have anything wrong, out of date or incomplete put right
• Delete it — ask us to erase it where no reason to keep it is left
• Pause it — have us keep it but stop using it while a question about it is settled
• Object — tell us to stop using it for something you did not ask for
• Change your mind — withdraw a consent you gave, as easily as you gave it, without unsettling what was already done
• Take it with you — where we hold something because you consented or because a contract needs it, receive it in a form another company's system can read

When this page changes

This page is written from what the site does, so it changes when the site does. The date under the title is the day it last did, and a change that affects you will move that date rather than slip in under it.

The blanks marked xxx are the parts nobody has decided yet, left visible on purpose. A policy that invents a number to fill a gap reads better and is worth less than one that shows you the gap.