{"id":12097,"date":"2026-06-07T21:56:18","date_gmt":"2026-06-07T14:56:18","guid":{"rendered":"https:\/\/ruk-com.cloud\/informing-citizens-of-their-rights-and-responsibilities-under-the-pdpa-personal-data-protection-act\/"},"modified":"2026-06-07T23:16:11","modified_gmt":"2026-06-07T16:16:11","slug":"informing-citizens-of-their-rights-and-responsibilities-under-the-pdpa-personal-data-protection-act","status":"publish","type":"post","link":"https:\/\/ruk-com.cloud\/en\/informing-citizens-of-their-rights-and-responsibilities-under-the-pdpa-personal-data-protection-act\/","title":{"rendered":"Informing citizens of their rights and responsibilities under the PDPA (Personal Data Protection Act)."},"content":{"rendered":"
Informing customers of their rights and responsibilities under the Personal Data Protection Act.<\/h5>\n

Referring to the Personal Data Protection Act B.E. 2562 (2019), Rakcom Co., Ltd. (“the Company”) places importance on compliance with the law, including providing material information to service users. Therefore, the Company would like to inform you of the following:<\/p>\n

This document applies to all of the company’s services, including Web Hosting, WordPress Hosting, VPS Hosting, Platform as a Service (PaaS), and Infrastructure as a Service (IaaS).<\/p>\n

definition<\/h6>\n\n\n\n\n\n
Service provider<\/strong><\/td>\nRakcom Company Limited<\/td>\n<\/tr>\n
Service recipient<\/strong><\/td>\nUsers of the company’s services may be individuals or legal entities.<\/td>\n<\/tr>\n
customer<\/strong><\/td>\nUsers of the service recipient (third parties who own the personal data that the service recipient has collected).<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
1. From the service provider’s perspective.<\/h5>\n
    \n
  1. The company provides services based on the type chosen by the client. The characteristics of each service are as follows:
    \n\n\n\n\n\n\n\n\n
    serve<\/th>\nService characteristics<\/th>\n<\/tr>\n<\/thead>\n
    Web Hosting \/ WordPress Hosting<\/strong><\/td>\nThis service model allows clients to host their websites on the provider’s servers, enabling them to be online on the internet 24\/7. Website data, databases, emails, etc., are stored on the web server, which then displays the website pages to visitors via the domain name at all times.<\/td>\n<\/tr>\n
    VPS Hosting<\/strong><\/td>\nA virtual private server (VPN) service model where the client can manage the system themselves, providing clients with online service via the internet 24 hours a day.<\/td>\n<\/tr>\n
    Platform as a Service (PaaS)<\/strong><\/td>\nThis service provides a platform for software and application developers, with the provider supplying and maintaining the necessary infrastructure, operating systems, and resources such as database servers and web application development, ensuring readiness for use. This allows users to focus on developing and managing their applications and data.<\/td>\n<\/tr>\n
    Infrastructure as a Service (IaaS)<\/strong><\/td>\nThe service provides computing infrastructure in the form of virtual resources such as central processing units (CPUs), memory, storage, and networking, allowing subscribers to install and manage operating systems, software, and applications themselves.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
  2. The service provider has duties and responsibilities as a “data processor”<\/strong> under the Personal Data Protection Act B.E. 2562 (2019). The company has implemented security measures according to the type of service as follows:
    \n\n\n\n\n\n\n\n
    serve<\/th>\nMeasures provided by the service provider.<\/th>\n<\/tr>\n<\/thead>\n
    Web \/ WordPress \/ VPS Hosting<\/strong><\/td>\nA web application firewall (WAF) that is regularly patched for vulnerabilities and undergoes vulnerability assessments at least once a week.<\/td>\n<\/tr>\n
    Platform as a Service (PaaS)<\/strong><\/td>\nMaintaining the security of servers, operating systems\/platforms, networks, and connections.<\/td>\n<\/tr>\n
    Infrastructure as a Service (IaaS)<\/strong><\/td>\nThe security of physical infrastructure, virtualization systems, and core networks is the responsibility of the service provider. The service provider is responsible for the security of the operating system and above.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    All of the company’s services run on enterprise-standard equipment and are provided in high-standard data centers located in Thailand and Singapore.<\/li>\n

  3. The company cannot access, view, and\/or know about anything the service recipient has uploaded, imported, and\/or stored on the company’s servers, including accessing confidential, business, commercial, or any other customer information of the service recipient. This is because such information is under the control of the service recipient, and the company will not use such information for any other purpose, especially for advertising or marketing, unless it has obtained the consent of the service recipient or is in compliance with the law.<\/li>\n<\/ol>\n
    2. From the perspective of the service recipient.<\/h5>\n
      \n
    1. The service recipient has the duty and responsibility as a “Data Controller”<\/strong> under the Personal Data Protection Act B.E. 2562 (2019), as the service recipient has the authority to make decisions regarding the personal data collected or processed in the company’s services. Therefore, it is the service recipient’s responsibility to comply with the Personal Data Protection Act B.E. 2562 (2019) and\/or any other relevant regulations and laws.<\/li>\n
    2. Service providers are responsible for controlling their customers’ data and maintaining appropriate security standards commensurate with the nature of their services. This includes, but is not limited to, data classification, data encryption, access control management, data risk assessment, data custodial, and security authentication . For VPS Hosting, Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) services:<\/em> because service providers manage their own systems, the required level of security depends on the design of their service processes and procedures.<\/li>\n
    3. The service recipient must submit back to the company the type and list of data they have entered into the service, specifying which type of data the company defines in clause 3, and signed and certified by the service recipient’s data controller.<\/li>\n<\/ol>\n
      3. Types of personal data.<\/h5>\n
      Type 1<\/h6>\n