Privacy Policy

Last updated: 1 January 2025

1. Identity & Data Controller

This website, https://carusoconsulting.ltd, is owned and operated by Caruso Consulting Co Ltd ("we", "us", "our"). For privacy, compliance, and data-related enquiries, you may contact us at api@carusoconsulting.ltd. Our registered business address is 47 Moo 1, T. Nawoong, Meaung, Phetchaburi 76000, Thailand. We act as the data controller for personal information collected through this website, except where another party is expressly identified.

This Privacy Policy also covers our Australian entity: BuyFactory Direct Pty Ltd, Suite 307, 12 Century Circuit, Norwest Central, Norwest NSW 2153, Australia. ACN: 656 628 938 | ABN: 30 656 628 938. Phone: 0431 182 633.

2. What Data We Collect

We may collect the following categories of personal data:

• Identity data: first name, last name, company name.
• Contact data: email address, phone number, postal address.
• Communication data: messages you send us via contact forms or email.
• Technical data: IP address, browser type and version, time zone, cookie identifiers, pages visited, referring URLs — collected automatically when you visit our website.
• Usage data: information about how you use our website, products and services.
• Marketing data: your preferences in receiving marketing from us and our third parties, and your communication preferences.

We do not collect sensitive personal data (e.g. health, race, religion, political opinions) unless legally required or with your explicit consent.

3. How We Collect Your Data

We collect data through:

• Direct interactions — when you complete a contact form, email us, or call us.
• Automated technologies — cookies, server logs and similar technologies when you browse our website.
• Third-party analytics and advertising services — including Google Analytics, Google Ads, and Meta (Facebook) Pixel, subject to your consent via our cookie banner.

4. How We Use Your Data

We use your personal data for the following purposes, relying on the legal bases indicated:

• Responding to enquiries — Legitimate interests / contract performance.
• Operating and improving our website — Legitimate interests.
• Analytics and measurement — Consent (where required) / Legitimate interests.
• Advertising (Google Ads, Meta Ads) — Consent. We only activate advertising tracking after you accept cookies via our consent banner.
• Legal compliance — Legal obligation.

5. Cookies and Advertising Technologies

Our website may use the following cookies and tracking technologies, which are only activated upon your consent:

• Google Analytics — website usage analytics.
• Google Ads / Google Tag Manager — conversion tracking and remarketing.
• Meta (Facebook) Pixel — conversion tracking and advertising audience building.

You can manage or withdraw your consent at any time via our Cookie Policy page or by clearing your browser cookies. You may also opt out directly via Google Ad Settings and Meta Privacy Settings.

6. Data Sharing and Third Parties

We do not sell your personal data. We may share data with:

• Service providers acting as data processors on our behalf (e.g. hosting providers, email services).
• Advertising platforms (Google, Meta) — only anonymised or hashed data for advertising purposes, and only where you have consented to cookies.
• Legal authorities — where required by law.

All third-party processors are contractually bound to handle your data securely and in accordance with applicable privacy law.

7. International Data Transfers

Your data may be processed in Australia, Thailand, or countries where our service providers are located (including the United States and European Economic Area). Where data is transferred outside your jurisdiction, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent mechanisms.

8. Data Retention

We retain personal data only as long as necessary for the purposes it was collected, or as required by law. Contact enquiry data is retained for up to 3 years. Anonymised analytics data may be retained indefinitely.

9. Your Rights

Depending on your location, you may have the following rights:

• Access — request a copy of your personal data.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — request we restrict processing of your data.
• Portability — request your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any right, contact us at api@carusoconsulting.ltd. We will respond within 30 days.

If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection authority. Australian residents may complain to the Office of the Australian Information Commissioner (OAIC). Thai residents may contact the Personal Data Protection Committee (PDPC).

10. Children's Privacy

Our website is not directed at children under 13 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately.

11. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information. To submit a request, email api@carusoconsulting.ltd with the subject "CCPA Request".

12. Changes to This Policy

We may update this Privacy Policy periodically. The "Last Updated" date at the top of this page will reflect the most recent revision. Continued use of our website after changes constitutes acceptance of the updated policy.

13. Contact Us

For any privacy-related enquiries:

• Email: api@carusoconsulting.ltd
• Phone: +66 098 391 3877
• Post: CARUSO CONSULTING Co Ltd, 47 Moo 1, T. Nawoong, Meaung, Phetchaburi 76000, Thailand