This Privacy Policy explains how BorderNex collects, uses, stores and protects personal data when you visit bordernex.com (the "Website"), submit a consultation request, or subscribe to our newsletter. Please read it together with our Terms & Conditions.
1. Who we are
BorderNex provides Market Expansion as a Service for international brands entering Southeast Asia. The Website is operated jointly by two companies, which act as data controllers for the personal data described in this Policy:
- Thailand: [TO CONFIRM: legal entity name], registration no. [TO CONFIRM: registration no.], registered address [TO CONFIRM: registered address], Bangkok, Thailand.
- Vietnam: [TO CONFIRM: legal entity name], registration no. [TO CONFIRM: registration no.], registered address [TO CONFIRM: registered address], Ho Chi Minh City, Vietnam.
Together these companies are referred to as "BorderNex", "we", "us" or "our". Services in the Philippines and the United Arab Emirates are delivered through partner networks; BorderNex has no company of its own in those markets. Where a partner processes your data for a project, we will inform you at that time.
2. What personal data we collect
We collect only the data that you provide to us and a small amount of technical data needed to run the Website safely.
2.1 Consultation form
When you submit the consultation form on the Website, we collect:
| Category | Data |
|---|---|
| Identity and contact | Full name, business email address, WhatsApp number (optional) |
| Company | Company name, company website (optional), country |
| Enquiry | Target market, services of interest, project details you choose to describe |
| Consent | Your consent checkbox selection and the time it was given |
| Technical | Hashed IP address (SHA-256, used for rate limiting), browser user agent, page URL, timestamp |
2.2 Newsletter
When you subscribe to BorderNex market insights, we collect your email address, the consent text shown to you and the time you accepted it, a hashed IP address, your browser user agent and your chosen language.
2.3 Technical data and cookies
The Website does not set analytics or advertising cookies today. Your chosen language is stored in your browser's localStorage so the Website can show the same language on your next visit. This value stays in your browser and is not sent to us. See section 6 for details.
We do not knowingly collect sensitive personal data (such as health, religion, biometric or criminal data). Please do not include such data in the project details field.
3. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your consultation request, assessing whether we can help, and preparing a proposal | Steps taken at your request before entering into a contract; our legitimate interest in responding to business enquiries |
| Sending you market insights by email | Your consent, which you can withdraw at any time |
| Keeping a record of the consent you gave | Legal obligation to demonstrate consent |
| Protecting the Website from spam, abuse and automated submissions (rate limiting) | Our legitimate interest in keeping the Website secure |
| Establishing, exercising or defending legal claims | Legitimate interest; legal obligation |
Under the Thailand Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and Vietnam Decree 13/2023/ND-CP ("Decree 13"), the bases above correspond to contract performance, consent, legal obligation and legitimate interest as defined in those laws.
4. How we use consultation-form data
Your consultation request is stored in our secure database and sent to the BorderNex team by email. We use it to:
- reply to you and arrange a discovery call;
- understand your brand, target market and services of interest so we can qualify the enquiry;
- prepare a tailored proposal or scope of work.
We do not add consultation-form contacts to the newsletter unless you tick the newsletter option or subscribe separately. We do not sell personal data.
5. How we use newsletter data
If you subscribe, we send BorderNex market insights a few times a year. Every email contains an unsubscribe link. You can also unsubscribe at any time at bordernex.com/unsubscribe/. When you unsubscribe, we stop sending emails immediately and keep only a short suppression record so that we do not email you again by mistake.
6. Cookies and local storage
- Cookies: the Website does not currently set analytics, advertising or tracking cookies. Our hosting provider may set strictly necessary technical cookies to deliver the Website securely.
- localStorage: we store one value, your chosen language (for example "en", "vi" or "th"), in your browser. You can remove it by clearing your browser's site data.
- Future analytics: the Website contains a technical hook (a "dataLayer") that would allow analytics to be added later. No analytics tool is active. If we activate analytics in the future, we will update this Policy and, where required, ask for your consent before any such tool is loaded.
7. Processors and international transfers
We use a small number of service providers (processors) to run the Website. Each one acts on our instructions and under a written agreement.
| Provider | Role | Location |
|---|---|---|
| Supabase | Database and serverless functions that store and process form submissions | Singapore (AWS region ap-southeast-1) |
| Resend | Transactional email delivery (notifications to our team, confirmations to you) | United States, with regional infrastructure |
| Cloudflare Pages | Website hosting and content delivery network | Global edge locations, including the EU and USA |
| Google Fonts | Delivery of web font files; your browser requests the fonts directly from Google servers, which receive your IP address | Global (Google LLC, USA) |
Because of these providers, your data may be transferred to, or accessed from, countries outside Thailand and Vietnam, including Singapore, the United States and EU edge locations. Where the law of your country requires it, we rely on appropriate safeguards such as the providers' standard contractual clauses and data processing agreements. Cross-border transfers from Vietnam are carried out in accordance with Decree 13, and from Thailand in accordance with the PDPA.
8. How long we keep your data
- Consultation requests (leads): kept while your enquiry is being handled and for [TO CONFIRM: 24 months] after our last contact, so that we can follow up and keep a record of the discussion. After that period the data is deleted or anonymised.
- Newsletter data: kept until you unsubscribe. After you unsubscribe we keep only a short suppression record (your email address and the date) for [TO CONFIRM: retention of suppression record] so that we do not contact you again.
- Technical logs (hashed IP, user agent, timestamp) are kept together with the record they belong to and deleted with it.
We may keep data longer where the law requires it or where it is needed for a legal claim.
9. How we protect your data
- All traffic between your browser and the Website is encrypted with HTTPS.
- IP addresses are hashed with SHA-256 before storage; we do not store raw IP addresses.
- Our database uses row-level security (RLS). Submitted records can only be read with a server-side service role; the public website cannot read them.
- Access to the database and email tools is limited to BorderNex team members who need it for their work.
No system is completely secure. If we become aware of a data breach that affects you, we will notify you and the relevant authority as required by law.
10. Your rights
Depending on where you live and which law applies to you, you have the following rights in relation to your personal data:
- Access — ask for a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, subject to legal retention duties.
- Restriction — ask us to limit how we use your data in certain cases.
- Objection — object to processing based on legitimate interest, including direct marketing.
- Portability — receive the data you gave us in a structured, machine-readable format.
- Withdraw consent — at any time, without affecting processing that took place before withdrawal.
- Complain — lodge a complaint with a supervisory authority: in Thailand, the Personal Data Protection Committee (PDPC); in Vietnam, the Department of Cybersecurity and High-Tech Crime Prevention (A05) under the Ministry of Public Security; in the EU or UK, your local data protection authority.
These rights are provided under the PDPA (Thailand), Decree 13 (Vietnam) and, where applicable to visitors from the European Economic Area or the United Kingdom, the GDPR and UK GDPR. To exercise a right, contact us using the details in section 13. We may need to verify your identity before responding. We aim to respond within 30 days, or sooner where the applicable law requires it.
11. Children
The Website and our services are directed at businesses and are not intended for anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
12. Changes to this Policy
We may update this Policy from time to time, for example when we add a new tool or change a provider. The "Last updated" date at the top shows the current version. If a change is significant, we will give notice on the Website or, for newsletter subscribers, by email.
13. Contact
For any question about this Policy or to exercise your rights, please contact us:
- Website contact form: bordernex.com/contact/
- Email: [email protected] [TO CONFIRM: mailbox active]
- Data protection contact: [TO CONFIRM: DPO / data protection contact]
BorderNex has not appointed a formal Data Protection Officer at this time. We will update this Policy if that changes.
Questions about your data?
Use the contact form and we will come back to you. Requests to exercise your rights are handled by the BorderNex team directly.