Privacy notice

This notice explains what personal data HundredEast Co., Ltd. collects through this website, why it is collected, how long it is kept, and what rights you have over it. It is written to meet the requirements of the Thai Personal Data Protection Act B.E. 2562 (2019).

Who is responsible

HundredEast Co., Ltd. is the data controller for personal data collected through this website. The company is based in Bangkok, Thailand. For anything relating to your personal data, write to marc@hundredeast.com.

HundredEast Co., Ltd. was founded by Marc Spiegel in 2026. It is registered with Thailand’s Department of Business Development, registration no. 0105569166539, incorporated 3 September 2026. Its services are Board Advisory, Market Entry & International Expansion, Setting Up in Thailand, China Plus One, Subsidiary Governance, and Turnaround & Restructuring.

What is collected

Two things, and nothing else.

• What you send by email. This site has no contact form. If you email marc@hundredeast.com directly, whatever you include is received in the ordinary course of that email, typically your name, email address, and whatever you write in the message.
• Standard technical data from the hosting provider. IP address, browser type, the pages requested and the time of the request. This is generated automatically by the web server and is used to keep the site running and to defend it against abuse.

This site does not use advertising cookies, analytics cookies, tracking pixels or third-party marketing tags. Page views, load times and basic visit details such as the referring page, browser and country are measured with Cloudflare Web Analytics, run by the website host. It sets no cookies, stores nothing on your device, and is not used for advertising or to track you across other sites.

Why it is collected, and on what basis

• To answer you. By emailing marc@hundredeast.com you provide your details for the purpose of getting a reply. Processing this correspondence is necessary to respond to a request you initiated, and you can ask for it to stop at any time.
• To take steps before entering a contract. Where a message leads to a discussion about an engagement, the correspondence is processed on the basis of taking steps at your request before a contract.
• Legitimate interest. Server logs are processed to keep the site secure and available.

Who else sees it

Personal data is not sold, rented or shared for marketing. It is handled by a small number of service providers acting on instructions.

• The website host, which serves these pages and holds the server logs.
• The email provider, which holds correspondence sent to marc@hundredeast.com.

Some of these providers operate servers outside Thailand, so your data may be transferred abroad. Where that happens the transfer is made under the safeguards required by the PDPA, and providers are chosen on the basis that they offer adequate protection.

Data will also be disclosed where Thai law requires it, for example in response to a lawful order from a court or a regulator.

How long it is kept

• Inquiries that do not lead anywhere. Deleted within 12 months of the last message.
• Correspondence connected to an engagement. Kept for the life of the engagement and then for the period required by Thai accounting and tax law, which is generally five years.
• Server logs. Retained for the short period set by the hosting provider, normally no more than 30 days.

Your rights

Under the PDPA you may ask to access your data or get a copy of it, correct anything inaccurate, have it deleted, restrict or object to how it is used, receive it in a portable form, and withdraw consent. Withdrawing consent does not affect processing that already took place while the consent was valid.

To exercise any of these, email marc@hundredeast.com. Requests are logged on receipt and answered within 30 days. There is no charge. If you are not satisfied with the outcome, the PDPA gives you the right to complain to the Expert Committee appointed under the Act, which is done through the Office of the Personal Data Protection Committee in Thailand.

Security

The site is served over HTTPS. Access to the mailbox holding this correspondence is restricted and protected by multi-factor authentication. No system is perfect. If a personal data breach happens, the Office of the Personal Data Protection Committee is notified without delay and, where feasible, within 72 hours of us becoming aware of it, unless the breach is unlikely to put anyone's rights and freedoms at risk. Where a breach is likely to put your rights and freedoms at high risk, you are told directly, without delay, along with what is being done about it.

Children

This site is aimed at businesses and is not intended for anyone under 20. Personal data is not knowingly collected from minors.

Links to other sites

Some pages link out to third-party sites, including sources cited in the writing. Those sites have their own privacy practices and this notice does not cover them.

Changes

Material changes will be posted here with a new date. We will contact affected people directly where we have their details and direct notice is warranted.