Privacy Policy

1. Who we are

Mack Media Co., Ltd. ("we", "us", "our"), a company registered in the Kingdom of Thailand (registration number 0105567080564), trades as Dopamine Digital. Our Malta studio is at Triq il-Maskli, Ta' Xbiex TXT 1362, Malta. Registered office: 142 Two Pacific Place, 17th Floor, Sukhumvit Road, Khlong Toei, Bangkok 10110, Thailand. Data controller contact: info@dopaminedigital.co.

We are the data controller for information you submit through our website, our client dashboards and our client-facing products. Because most of our clients are in Malta and the wider EU, we apply the EU General Data Protection Regulation (GDPR) as our baseline standard of care for all personal data, in addition to Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

2. What we collect

Information you give us: contact and demo-request form data (business name, town, WhatsApp number or email, what you sell, your current website), client onboarding details (billing details, project specifications, brand assets), and communications by email, WhatsApp or phone.

Information we collect automatically: server logs (IP address, request path, user agent, timestamp) retained for 30 days, and aggregate analytics with IP anonymisation. We use strictly necessary cookies only; see section 7.

Information from third parties: if we run outbound outreach we may store publicly available business information (company name, website, public email) from business directories or public pages.

3. Why we use it

Responding to your enquiry (legitimate interest and pre-contractual steps); delivering services under contract; sending invoices and service updates (contract and legal obligation); B2B outreach to publicly listed businesses (legitimate interest); marketing emails (consent); fraud prevention and security (legitimate interest); accounting and tax retention (legal obligation).

4. How long we keep it

Leads and prospects: 24 months from the last interaction, then deleted or anonymised. Active clients: the duration of the relationship plus 5 years for accounting records, or longer where EU law requires. Invoices and financial records: at least 5 years, 10 years where Malta-originated invoicing requires it. Server logs: 30 days. Demo sites built for prospects: 12 months unless the prospect becomes a client.

5. Who we share it with

We do not sell your data. We share it only with processors needed to run the business: Vercel (hosting and edge network, EU and US), Supabase (database), Resend (transactional email), Google (analytics and business tools), and payment and accounting providers where you become a client. Each processor is bound by a data processing agreement. For EU data subjects, cross-border transfers, including to our Thai operations, rely on Standard Contractual Clauses under Chapter V of the GDPR.

6. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest, including direct marketing, and withdraw consent at any time. Malta residents may complain to the Information and Data Protection Commissioner (IDPC), Level 2, Airways House, High Street, Sliema SLM 1549, idpc.org.mt. Thailand residents have equivalent rights under the PDPA and may complain to the Office of the Personal Data Protection Committee. To exercise any right, email info@dopaminedigital.co; we respond within 30 days.

7. Cookies

Strictly necessary cookies only (for example a session on a client dashboard). Our analytics anonymise IP addresses and set no cross-site tracking cookies. We do not use third-party advertising cookies. You can clear cookies at any time in your browser.

8. Security

All data is encrypted in transit (TLS 1.2 or later). Passwords are hashed. Access to production systems is protected with multi-factor authentication. Backups are encrypted at rest. Under the GDPR we notify the relevant supervisory authority within 72 hours of discovering a personal data breach likely to result in risk to rights and freedoms; under the PDPA we notify the PDPC within 72 hours where a breach is likely to result in high risk.

9. International transfers

Our operations span Malta and Thailand, so personal data is transferred internationally. All such transfers are covered by Standard Contractual Clauses under GDPR Article 46(2)(c) and equivalent PDPA safeguards.

10. Changes

We may update this policy. Material changes will be announced by email to clients and subscribers, and the date at the top of this page will change. The latest version always lives at dopaminedigital.co/legal/privacy.

11. Contact

Email info@dopaminedigital.co, or write to Mack Media Co., Ltd. (trading as Dopamine Digital), 142 Two Pacific Place, 17th Floor, Sukhumvit Road, Khlong Toei, Bangkok 10110, Thailand.