Privacy Policy

This Privacy Policy explains how STORYBOARD Co., Ltd. (Head Office) (“STORYBOARD”, “we”, “us” or “our”) collects, uses, discloses, stores and otherwise processes personal data in connection with the public website at storyboard.co.th (the “Site”). It applies to visitors to the Site and to people who contact us using the contact details published on the Site.

This Policy describes the Site as it operates on the date shown above. It does not describe functions that have merely been proposed, including accounts, newsletter subscriptions, workshop registration, payments, analytics, advertising or content-management integrations. If those functions are introduced, this Policy will be reviewed and updated before or when the relevant processing begins.

Personal data

Information relating to an identifiable individual, directly or indirectly, as understood under applicable personal-data protection law.

Processing

Any operation performed on personal data, including collection, recording, organization, storage, use, disclosure, transmission, restriction and deletion.

Service provider

An organization that supplies infrastructure or services used to operate or deliver the Site and that may process data in connection with those services.

For the processing described in this Policy, the responsible company is:

Tax ID: 0105559096309

Email: info@storyboard.co.th
LINE: @storyboard.co.th

The current Site does not provide or operate:

• user accounts, login, authentication or member profiles;
• contact, registration, newsletter or payment forms;
• a customer, workshop, payment or marketing database;
• analytics, advertising pixels, behavioral profiling or session replay;
• application-created cookies, local storage or session storage; or
• automated decisions that produce legal or similarly significant effects.

We therefore do not intentionally collect names, postal addresses, telephone numbers, payment details, account credentials or marketing preferences through an input field on the current Site.

5.1 Ordinary technical requests

When a website is requested, technical information is necessarily transmitted between the visitor’s device and the servers delivering it. Depending on the final production-hosting configuration, this may include an IP address, date and time, requested URL, referring page, browser and device headers, response status, diagnostic information and security events. The current application contains no database or application logic that creates visitor profiles from this information.

5.2 Media streaming and content delivery

The Site’s moving-image work is delivered through a third-party media-streaming and content-delivery provider. A visitor’s browser sends requests directly to that provider’s infrastructure for video playlists and segments. The provider may process technical delivery information such as an IP address or anonymized IP data, request time, requested media URL, referrer, user agent, request identifier, country and serving edge location. It may also process stream-quality, error and buffering information needed to deliver and optimize the media.

5.3 Embedded social-media content

Some workflow pages may contain embedded Instagram posts that load automatically when the page is opened. When embedded content loads, the visitor’s browser connects directly to Instagram, a service operated by Meta, to retrieve and display the content.

The provider may receive technical information such as your IP address, request date and time, the requested content, referring page, browser and device information, and may use cookies or similar technologies under its own policies. STORYBOARD does not control the provider’s independent data practices. An accompanying external link may also take you directly to the third-party service, where the third party’s own notices apply.

5.4 Voluntary communications

If you contact STORYBOARD by email or through the messaging service listed on our Contact page, we may receive the information you choose to provide, such as your name, organization, email address or messaging-service identifier, message, attachments, inquiry history and any other information included in the communication. These communications occur through your chosen email or messaging service, not through a form hosted on the Site.

Personal data described in this Policy may come from:

• you, when you communicate with us voluntarily;
• your browser or device when it requests the Site or video media;
• the future production-hosting provider through operational and security logs; and
• the third-party media-streaming and content-delivery provider in connection with media delivery, performance, security and diagnostics.

We do not currently purchase visitor profiles or obtain advertising-audience data for the Site.

Where applicable law requires a legal basis, processing may be undertaken for the following purposes:

• to deliver requested pages and media, maintain reliable operation, diagnose errors and protect the Site against misuse, based on our legitimate interests in operating a secure public website where those interests are not overridden by your rights;
• to receive, assess and respond to communications you initiate, including taking steps at your request before entering into an agreement where applicable;
• to comply with legal, regulatory, accounting or dispute-resolution obligations; and
• to establish, exercise or defend legal claims where necessary and permitted.

We do not rely on consent for analytics or advertising on the current Site because those technologies are not implemented. If a future feature requires consent, it should not be activated until an appropriate consent process and updated notice are in place.

Personal data or technical information may be disclosed only as reasonably necessary to:

• the media-streaming and content-delivery provider for video storage, streaming, content delivery, performance and security;
• the production-hosting provider once selected and configured;
• the social-media provider when embedded social-media content loads on a workflow page;
• email and messaging service providers when you use those channels;
• professional advisers, auditors or insurers under appropriate confidentiality duties;
• competent regulators, courts or authorities where required or permitted by law; or
• a successor in a lawful corporate transaction, subject to appropriate safeguards.

We do not sell personal data and do not disclose Site-visitor data to data brokers or advertising networks for their independent marketing use.

The media-streaming and content-delivery provider uses globally distributed infrastructure, so technical media requests may be routed to or processed outside Thailand. Email or messaging-service communications may also involve infrastructure outside Thailand according to the service selected by the sender and the provider’s own operations.

Where cross-border transfer requirements apply, STORYBOARD will assess and use an appropriate lawful transfer basis and safeguards required by applicable law. No statement in this Policy guarantees that all processing occurs in Thailand.

We intend to retain personal data only for as long as reasonably necessary for the purpose for which it was processed, including responding to an inquiry, maintaining security and operational records, satisfying legal or accounting obligations, and resolving disputes. Data should then be deleted, anonymized or securely isolated unless continued retention is required or permitted by law.

Retention periods may differ by category. Correspondence may need to be retained while an inquiry or business relationship remains active and for an appropriate period afterward. Infrastructure logs may have shorter operational or security periods controlled by the relevant provider configuration.

STORYBOARD will use reasonable administrative, technical and organizational measures appropriate to the nature and risk of the data processed. These may include access controls, secure configuration, software maintenance, encrypted transport where supported, provider due diligence, incident handling and deletion practices.

No internet transmission or storage system can be guaranteed completely secure. Visitors should avoid sending sensitive or unnecessary personal data through ordinary email or messaging services unless an appropriate secure channel has been agreed.

Subject to the conditions, exceptions and verification requirements under Thailand’s Personal Data Protection Act B.E. 2562 (2019) and other applicable law, you may have rights to:

• request access to and a copy of your personal data;
• request correction of inaccurate or incomplete data;
• request deletion, destruction or anonymization in appropriate circumstances;
• request restriction of processing;
• object to certain processing;
• request data portability where the legal requirements are met;
• withdraw consent where processing is based on consent, without affecting prior lawful processing; and
• lodge a complaint with the competent personal-data protection authority.

To make a request, email info@storyboard.co.th. We may need to verify your identity and clarify the request. A right may be limited where an applicable exception permits or requires us to retain or continue processing particular information.

The public Site is a portfolio and information site and is not designed to collect information from children. It currently has no account, registration or submission feature. If you believe a child has provided personal data to STORYBOARD through a contact channel without appropriate authorization, please contact us so that the circumstances can be reviewed and appropriate action taken.

The current application does not intentionally set first-party cookies and does not use analytics, advertising or personalization cookies. It also does not use localStorage or sessionStorage. Video files are requested from third-party media-delivery infrastructure, which may create technical server or content-delivery logs even where no browser cookie is set. More detail is provided in ourCookie Policy.

STORYBOARD does not currently sell Site-visitor personal data, build advertising profiles from Site activity, or use Site data to make solely automated decisions producing legal or similarly significant effects. If this position changes, the relevant processing, legal basis, choices and safeguards must be disclosed before or when that processing begins.

The Site links to members.storyboard.co.th for existing students. That member site is technically and functionally separate from this public main-site repository and may operate accounts, cookies or other processing under its own applicable notices. Other external services reached through links are also governed by their own terms and privacy practices. This Policy does not describe processing performed independently on those separate services.

Newsletter capture, workflow publishing and content-management integrations, workshop registration, payments, authentication, analytics and advertising are not part of the current Site. Before adding a feature that changes how personal data is processed, STORYBOARD should complete an implementation and legal review, update this Policy and the Cookie Policy, identify relevant providers and retention periods, and obtain consent where required.

We may update this Policy to reflect changes in the Site, law, providers or business operations. The revised version will be posted here with a new “Last updated” date. If a change materially affects how existing personal data is used, we will provide any additional notice or choice required by applicable law.

Questions, privacy requests or complaints may be sent to info@storyboard.co.th or to the postal address in Section 3. You may also have the right to complain to Thailand’s competent personal-data protection authority.

The following facts remain intentionally unresolved and must be confirmed before public launch:

1. the production-hosting provider, infrastructure locations and subprocessors;
2. hosting log fields, access controls and retention periods;
3. media-streaming and content-delivery provider logging, anonymization, cookie, region, retention, DPA and subprocessor settings;
4. the lawful cross-border transfer mechanism and supporting contractual safeguards;
5. approved retention periods for email and messaging-service correspondence; and
6. whether a dedicated privacy contact or data protection officer is legally required or appointed.