Privacy Policy

How Hook Architects Co., Ltd. collects, uses, discloses and protects your personal data on this website

Effective date: September 10, 2026

Last updated: November 10, 2026

This Privacy Policy explains how Hook Architects Co., Ltd. (“the Company”, “we” or “us”) collects, uses, discloses and protects your personal data when you visit hook.co.th and use the forms on this website. The Company is a company registered in Thailand, and our data processing activities are governed by the Personal Data Protection Act B.E. 2562 (“PDPA”).

1. Scope of this notice

This notice applies to the hook.co.th website and to personal data collected through the forms on this website only: the contact form, the BIM quotation/RFP request flow, the partner registration form, the supplier pre-qualification form, and the job application process.

This notice does not cover other software systems or platforms that the Company operates to serve its clients, vendors or staff once they sign in (such as a client portal, the vendor portal for approved suppliers, or internal staff systems). Those systems are governed by separate arrangements and do not yet have a separate public privacy notice.

2. Data controller

Hook Architects Co., Ltd. is the data controller for personal data collected through this website.

Address: 106 Soi Ramkhamhaeng 26/1, Hua Mak, Bang Kapi, Bangkok 10240

Privacy enquiries: enquiry@hook.co.th

3. Personal data we collect

We collect personal data only to the extent necessary, depending on which form you use on this website:

Contact form

Full name
Email address
Phone number
Company name
Subject and message you choose to send us (optional)

BIM quotation/RFP request flow

Requester type (individual or organisation), company name, and tax identification number where you request a quotation on behalf of an organisation
The name, email address, phone number, job title and address of the contact person or company representative
The project details and scope of services you provide, used to generate an indicative price estimate

Partner registration form

Company name (in English and Thai), website, industry, organisation type, the services and expertise you offer, a description of the company, and a logo if you upload one
The name, position, email address and phone number of the contact person

Supplier pre-qualification form

The name and email address you give to start the form, and your acceptance of the non-disclosure agreement (NDA), recorded with its time, your IP address, your browser’s user agent, and the language and version of the NDA text you accepted
The name and position of the person who signs for the supplier, with an image of the signature and of the company seal
Company details: entity type, company name, address, phone number, email address, tax identification number (or foreign registration number), contact person and mobile number, business registration details, date of establishment, type of business, registered capital and parent company
The bank account we pay to (bank, branch and account number), a copy of the bank book, and payment evidence: a copy of the national ID card of the account holder for an individual supplier, or the company affidavit and the ID card of the authorised director for a company. Please cover the religion and blood type on an ID card copy before you upload it — we do not need them
Business and financial information: bankruptcy history, products, current and past projects (including client names and contract values), related businesses, scope of work, departments and headcount, software and equipment, quality, health, safety and environment (QHSE) information, financial statements, certificates, and any other documents you attach

Job application process

The email address and password you create to access the application system
Name, nickname, phone number, country and province of residence, age range, and provinces you are willing to relocate to
Work history, education, skills, expected salary, interview availability and earliest start date, together with any supporting documents you attach
Answers to the tests and questionnaires used in our selection process, which may include skills and English-language test results, answers about personality and working style, and — for certain roles — physical-fitness information relevant to that role's requirements

When you browse this website, we also automatically collect technical and usage data, such as IP address, browser type and version, pages visited, and information collected through cookies (see section 7). When you send the contact form, the quotation/RFP request or the partner registration form, we may also record how you reached the website: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the page you first landed on and — only if you have accepted marketing cookies — the ad click identifier that Google Ads (gclid, gbraid, wbraid) or ChatGPT ads (oppref) added to that link.

4. Sensitive personal data in the job application process

Only for applicants who reach the final stage of our job application process — the HR-legal stage — we request additional information that Thai law classifies as sensitive personal data: national ID card number, religion, blood type and health information such as chronic conditions (where applicable), together with your registered home address, military service status, and emergency contact details. This information is used to prepare employment documentation required by Thai labour and social security law.

We collect and process this sensitive personal data on the basis of your explicit consent under Section 26 of the PDPA. You may choose not to provide some of this information, but withholding information that the law requires an employer to hold may mean the Company cannot proceed with your employment.

We do not collect sensitive personal data through the contact form, the BIM quotation/RFP request flow, the partner registration form or the supplier pre-qualification form. Please avoid including this type of information in the free-text fields of those forms or in the documents you attach, and cover the religion and blood type on any ID card copy (see section 3).

5. Sources of personal data

We collect personal data from the following sources:

Directly from you, when you complete the contact form, the BIM quotation/RFP request flow, the partner registration form, the supplier pre-qualification form, or the job application form on this website.
Automatically, as you use this website, through cookies, your browser’s storage, server logs, and website analytics and advertising tools (see section 7).
From the link you followed to reach this website: campaign tags, and the ad click identifiers that Google Ads and ChatGPT ads add to the links in their ads.

6. Purposes and legal bases for processing

We process personal data only where a legal basis under the PDPA applies. Our main purposes and legal bases are:

Performance of a contract or steps prior to entering into a contract (PDPA Section 24(3))

Responding to your BIM quotation/RFP request and preparing a project proposal
Handling the enquiries you submit through the contact form
Reviewing your partner registration and, if it is approved, showing your company name, logo, description and services on the partner pages of this website
Pre-qualifying suppliers and subcontractors, and setting up approved suppliers for requests for proposals, purchasing and payment
Processing your job application, from registration through to selection

Legitimate interests (PDPA Section 24(5))

Maintaining the security of the website and preventing fraud or misuse of our forms — for example, using Google reCAPTCHA to check that a form is not being submitted by an automated program
Analysing and improving website content and user experience, based on aggregated usage data
Understanding which campaigns and websites bring enquiries, from the campaign tags in the link you followed (not the ad click identifiers, which we keep only with your consent)

Consent (PDPA Sections 19 and 26)

Setting analytics or marketing cookies that are not necessary for the website to function, and the measurement they allow: Google Analytics (including Google signals), and Google Ads conversion tracking and remarketing (see section 7)
Keeping the ad click identifier from the link you followed and sending it with your form, and sending Google your email address and phone number in hashed form for enhanced conversions, when you have accepted marketing cookies (see section 7)
Collecting and processing sensitive personal data at the final stage of the job application process (see section 4)

Compliance with a legal obligation (PDPA Section 24(6))

Preparing employment documentation required by Thai labour, social security and tax law for successful candidates
Responding to lawful requests from government agencies, courts, or regulators

7. Cookies and similar technologies

We use cookies and similar technologies (such as your browser’s local and session storage) to make the website work, remember your preferences, measure how the website is used, and measure our advertising.

Strictly necessary cookies are required for the website to function and do not require consent. Analytics and marketing cookies are only set once you give your consent through the cookie banner on this website. You can change or withdraw your choice at any time with “Manage Cookies” below or in the website footer, or through your browser settings. Withdrawing consent does not affect processing carried out before you withdrew it.

The tools we use, and the consent each one needs:

Google Tag Manager (Google LLC) loads and manages the tags below. It runs on every page but does not itself set analytics or advertising cookies.
Google Analytics 4 (analytics cookies) measures visits, the pages viewed, the forms sent, and the website or campaign that brought you here. If you also accept marketing cookies, Google Analytics can use Google signals: Google may associate this data with the Google accounts of signed-in users who have turned on ad personalisation, for reports and audiences across devices.
Google Ads (marketing cookies) measures whether a visit that started with a click on one of our ads leads to an enquiry, a quotation request or a partner registration (conversion tracking), and lets us show our ads again to people who have visited this website (remarketing). For this, Google stores the ad click identifier (gclid, gbraid or wbraid) in a first-party cookie.
Enhanced conversions (marketing cookies): when you send the contact form, the quotation request or the partner registration form, your browser sends Google your email address and phone number in hashed form (SHA-256), so that Google can match the form to an interaction with our ads. Hashing turns them into a code that cannot be read as such, but it is still personal data.
Vercel Web Analytics (analytics cookies) counts page views and events. It is loaded only after you accept analytics cookies.
Consent Mode: before you choose, and if you decline analytics or marketing cookies, Google’s tags set no analytics or advertising cookies, but they can still send Google cookieless pings — for example, that a page was viewed or a form was sent, with technical information such as the time, the page address and the browser — which Google uses for aggregated measurement and modelling.

We also keep a few values in your browser’s session storage, for the current tab only and deleted when you close it: whether an AI assistant (such as ChatGPT) or a campaign link brought you to the website, and — only with marketing consent — the ad click identifier from that link, so that it can be sent with your form. You can also limit ad personalisation for your Google account at adssettings.google.com (My Ad Center).

9. Cloud infrastructure and international transfers

This website and its forms run on cloud infrastructure operated by reputable international third-party providers. These providers act as data processors under our instructions only, and do not use your data for their own purposes.

Using these cloud services may mean your personal data is processed or stored on servers located outside Thailand. Where this occurs, we ensure it is carried out in accordance with the requirements for cross-border transfer of personal data under Section 28 of the PDPA.

Google’s measurement and advertising services described in section 7 are not part of this cloud infrastructure: Google processes that data under its own terms and may process it in the United States and other countries outside Thailand. Where this is a cross-border transfer of personal data, we carry it out in accordance with the requirements of the PDPA.

10. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this notice, including for as long as applicable law — such as labour, social security, and tax law — requires records to be kept.

When personal data is no longer necessary for these purposes, we delete, anonymise, or securely destroy it.

11. Security measures

We implement technical and organisational measures appropriate to the risk to protect personal data against loss, alteration, unauthorised disclosure, or unauthorised access. These measures include transmitting data over encrypted connections (HTTPS/TLS), restricting access to personal data to personnel who need it to perform their duties, and using reputable infrastructure providers.

No method of transmission or storage is completely secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we are required to notify the Office of the Personal Data Protection Committee as required under Section 37(4) of the PDPA, and to notify affected data subjects where the law requires us to do so.

12. Your rights as a data subject

Subject to the provisions and exceptions under the PDPA, you have the following rights in relation to your personal data:

Right of access — request confirmation of and a copy of the personal data we hold about you (PDPA Section 30)
Right to rectification — request that we correct inaccurate or incomplete data (PDPA Section 35)
Right to erasure — request deletion of your personal data once it is no longer necessary for the purposes it was collected for, or after you withdraw consent (PDPA Section 33)
Right to restriction of processing — request that we limit how your personal data is used in circumstances specified by law (PDPA Section 34)
Right to data portability — receive your personal data in a structured, machine-readable, commonly used format (PDPA Section 31)
Right to object — object to processing carried out on the basis of legitimate interests (PDPA Section 32)
Right to withdraw consent — withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before withdrawal (PDPA Section 19)
Right to lodge a complaint — with the Office of the Personal Data Protection Committee, if you believe we have failed to comply with the PDPA (PDPA Section 73)

To exercise these rights, please contact us using the details in section 16. We will act on your request within a reasonable time and in accordance with the timeframes required by law, and we may need to verify your identity before doing so.

13. Privacy of minors

The contact form, the BIM quotation/RFP request flow, the partner registration form and the supplier pre-qualification form on this website are intended for business enquiries and are not directed at minors. For the job application process, if an applicant is under 20 years of age — a minor under the Thai Civil and Commercial Code — we will seek consent from a parent or legal guardian as required under Section 20 of the PDPA before proceeding.

If you believe a minor has provided us with personal data without the required consent, please contact us at enquiry@hook.co.th so that we can take appropriate action.

14. Third-party links and content

Our website may contain links to, or embedded content from, third parties (such as social media posts). Clicking these links or interacting with this content may allow the relevant third party to collect information about you, under their own privacy policy. We do not control third-party services and are not responsible for their privacy practices.

15. Changes to this notice

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The “last updated” date above indicates when this notice was last revised. Your continued use of this website or its forms after an update constitutes acknowledgement of the revised notice.

16. Contact us

If you have any question, request, or complaint about this notice, or wish to exercise your rights over your personal data, please contact us:

Hook Architects Co., Ltd.
106 Soi Ramkhamhaeng 26/1, Hua Mak, Bang Kapi, Bangkok 10240
Email: enquiry@hook.co.th

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee of Thailand, under Section 73 of the PDPA.

← Back to Home