Data Controller
The data controller responsible for your personal data under this Privacy Policy is:
NextStep Engineering Software Solutions Co., Ltd.
689 Bhiraj Tower @ EmQuartier, Floor 30, Sukhumvit (Soi 35)
Khlong Tan Nua, Vadhana, Bangkok 10110, Thailand
Email: privacy@nextstep.engineer
Phone: +66 2 017 2700
This policy is written to meet the requirements of the Thai Personal Data Protection Act B.E. 2562 (2019) (PDPA), and serves as our global baseline for how we handle personal data from visitors anywhere in the world.
We have not appointed a separate Data Protection Officer. For any question, request, or complaint about this Privacy Policy or how we handle your personal data, please contact us using the details above or in the "How to contact us" section below.
Scope of this policy
This Privacy Policy covers only personal data processed through this website (nextstep.engineer), for example when you use our contact form. It does not cover personal data that NextStep may process while delivering software, consulting, or engineering services to clients under a separate services agreement; those engagements are governed by the terms agreed with the relevant client, not by this policy.
What data do we collect?
NextStep collects the following categories of personal data:
| Data | Source | Purpose |
|---|---|---|
| Name | Contact form | Identifying you and communicating with you |
| Business email address | Contact form | Responding to your inquiry |
| Company name | Contact form | Understanding the business context of your inquiry |
| Subject | Contact form | Directing and categorizing your inquiry |
| Message | Contact form | Understanding and responding to your inquiry |
| Technical/log data (e.g. IP address, device/browser information, request logs) | Website security provider (Cloudflare) | Website security |
We do not collect any special categories of personal data (for example, health, religious belief, or biometric data) through this website.
How do we collect your data?
You provide personal data directly when you complete and submit our contact form. We also receive, or enable our service providers to process, limited technical information automatically generated when you use the website, such as IP address, browser and device information, request timestamps, security-event data, and cookie-related information. We use this information to deliver, secure, and maintain the website.
Legal basis for processing
Under the Thai Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), we map each processing activity to the legal basis that applies to it, rather than relying on a single basis for everything:
| Processing activity | Purpose | Legal basis |
|---|---|---|
| Contact form (name, business email, company name, subject, message) | Responding to your inquiry | Legitimate interests – responding to inquiries you have chosen to send us. Where your inquiry concerns a prospective business engagement, we may instead rely on necessity for steps taken at your request prior to entering into a contract. |
| Technical/log data processed by Cloudflare | Website security | Legitimate interests – keeping the website secure and functioning correctly. |
| Retention of your contact-form submission for 3 months | Record keeping and business administration | Legitimate interests – maintaining a record of the inquiry and our response for that period. |
Where we rely on legitimate interests, we have considered that our interest in responding to your inquiry, securing the website, and keeping business records is proportionate to the limited data involved and does not override your rights and freedoms. You have the right to object to processing carried out on this basis (see "What are your data protection rights?" below).
Before you can use the contact form, our website shows a notice with two choices: “Decline” and “Accept.” To be clear about what this choice does and does not cover:
- It does not control the Cloudflare cookies described in "Cookies" below; those apply regardless of your choice because they are necessary for the website to function securely and are not consent-gated.
- It does not constitute PDPA consent to processing. The legal bases for processing your data are set out in the table above (mainly legitimate interests), not this notice.
- It does specifically gate the contact form: selecting "Accept" turns the form on and confirms you have seen that your submission is sent to Web3Forms and forwarded to our Zoho Mail inbox (see "Web3Forms" and "Email provider: Zoho Mail" below).
- It does not apply to anything else on the website; it has no effect beyond enabling or leaving disabled the contact form itself.
In short, this notice is a transparency and access-control measure for one specific feature (the contact form), not a blanket consent mechanism for the website as a whole.
Is providing your data required?
Providing your personal data through the contact form is voluntary, but it is necessary if you want us to respond to your inquiry. The name, business email address, company name, subject, and message fields are required to identify you and reply to your message.
If you do not provide this data, or if you select "Decline" on the contact-form notice, you will not be able to submit the contact form and we will not be able to process or respond to your inquiry. You can still browse the rest of the website without providing any personal data, other than the technical data described above, which is necessary for the website to function securely.
How will we use your data?
NextStep collects your data so that we can:
- Process your inquiry from contact form and replying to you.
As set out in the table above, we rely on legitimate interests as the legal basis for this processing (or, where your inquiry concerns a prospective business engagement, necessity for steps taken at your request prior to entering into a contract).
Except for the recipients described below, NextStep will NOT share any of your data with any other company.
Who do we share your data with?
We do not sell your personal data. We only share it with the following categories of recipients, each of which helps us operate this website and respond to you:
- Web3Forms – our contact-form processor, which receives and forwards your submissions to us (see below).
- Cloudflare – our content-delivery and security provider, which processes limited technical data to protect the website (see "Cloudflare" below).
- Zoho Mail – operated by Zoho Corporation, hosts the inbox we use to receive and reply to your messages (see "Email provider: Zoho Mail" and "International data transfers" below).
We do not share your data with any other third party, except where required by law.
Web3Forms
Our contact form uses Web3Forms, a third-party form-processing service, to deliver your inquiry to us. For the purposes of this Privacy Policy, we treat Web3Forms as a data processor acting on our instructions; its role is limited to receiving your submission and forwarding it to us.
| Data sent | The fields you complete: name, business email address, company name, subject, and message. Plus a fixed account identifier and sender label our website uses to route the message; these two values are the same for every submission and are not derived from your personal data. |
|---|---|
| Also collected automatically |
Your IP address, browser/user-agent, and a
timestamp — standard HTTP request information that any server
logs, not data our website code separately collects or adds. Because our
website does not set a custom Referrer-Policy, browsers send at most our
site’s origin (https://nextstep.engineer), not the full page
path, as a referrer.
|
| Why it’s sent | So Web3Forms can forward your inquiry to NextStep’s email inbox and we can respond to you. |
| Retention | Per Web3Forms' privacy policy, form submission data is retained for up to three years from the date of submission, then automatically deleted. Its server logs (which may incidentally include your IP address and user-agent) are deleted on a regular basis. |
| Where it’s processed | United States (US-East), per Web3Forms. |
| Legal basis for the US transfer | PDPA Section 28 — see "International data transfers" below for the specific mechanism we rely on and the contractual safeguards that apply to this transfer. |
| Spam-filtering services | Our Web3Forms account has "Advanced Spam Filter" enabled (Basic protection level), and Captcha Protection set to "None." Per Web3Forms' privacy policy, this spam filtering may use third-party services (CleanTalk and/or Akismet), which can receive a submitter's IP address and email address. |
Our contact form does not use a CAPTCHA, honeypot, or any other anti-spam/security field.
Learn more in the Web3Forms privacy and GDPR FAQ.
Email provider: Zoho Mail
Web3Forms forwards your contact-form submission to our email inbox, which is hosted by Zoho Mail (operated by Zoho Corporation) on Zoho's United States data center.
Zoho offers a Data Processing Addendum, based on Model Contractual Clauses, on request; NextStep has not yet entered into this agreement with Zoho. Zoho states that an organization administrator can request a copy by emailing legal@zohocorp.com, specifying the data center the account was signed up under. See "International data transfers" below for the transfer mechanism we rely on for this recipient, and "Retention" below for how long your data may exist in this inbox and in Zoho's own systems (such as Trash).
Zoho's public GDPR policy states that it notifies affected organizations of a data breach within 72 hours of becoming aware of it, by email to the organization's primary address. This is a general policy Zoho publishes, not a bespoke contractual commitment NextStep has separately negotiated. See "How we handle security incidents" below for what this means in practice.
Zoho publishes a directory of the sub-processors and third parties it engages across its services. As of 25 August 2026, that directory does not list any sub-processor as applicable to Zoho Mail specifically. Separately, Zoho discloses six third-party providers (AMD, Kaleyra, Sinch, TeleSign, Value First, and Etisalat) that it uses only to send SMS messages for a Zoho Account's multi-factor authentication, sign-in, and account-recovery flows; these would only become relevant to us if multi-factor authentication on this Zoho Mail account is later configured to use SMS. See Zoho's sub-processor directory for the current list.
International Data Transfers
We may transfer personal data internationally through service providers such as Web3Forms, email providers, Cloudflare, and other third parties for website operations, communications, security, and hosting. Transfers are subject to applicable data protection laws and appropriate safeguards. Recipients may process data in countries where they or their infrastructure operate. Data is retained only as necessary under our retention policy and applicable law. You may exercise your data protection rights by contacting us. Further details about specific recipients, transfer locations, and safeguards are available upon request.
Three of the recipients described above process data outside Thailand. Where this happens, Section 28 of the PDPA requires us to explain the recipient country, the reason for the transfer, the transfer mechanism we rely on, and any contractual safeguards in place:
| Recipient | Recipient country | Reason for transfer | Transfer mechanism | Contractual safeguards |
|---|---|---|---|---|
| Web3Forms (contact-form processor) | United States (US-East) | To receive your contact-form submission and forward it to us so we can respond to your inquiry | Necessary to take steps you have requested, prior to or in connection with our response to your inquiry (PDPA Section 28) | Web3Forms states that its Data Processing Agreement, incorporating Standard Contractual Clauses for international transfers, is part of its Terms of Service and applies automatically to all customers, including NextStep. We have not separately reviewed or negotiated this agreement. |
| Cloudflare (content delivery & security) | Global network, including countries outside Thailand | To deliver this website to you and protect it from malicious traffic | Necessary for our legitimate interest in keeping the website secure, and/or necessary to take steps you have requested by using the website (PDPA Section 28) | NextStep has not independently reviewed a data processing agreement specific to this website with Cloudflare. |
| Zoho Mail (email hosting) | United States (Zoho's US data center) | To host the inbox where your contact-form submission is delivered, so we can read and reply to it | Necessary to take steps you have requested, prior to or in connection with our response to your inquiry (PDPA Section 28) | Zoho offers a Data Processing Addendum, based on Model Contractual Clauses, on request; NextStep has not entered into this agreement with Zoho. |
See "What are your data protection rights?" and "Complaints" below for how to object to these transfers or lodge a complaint with the Personal Data Protection Committee (PDPC). To request details about a specific transfer, email privacy@nextstep.engineer.
Data Retention
We retain personal data only for as long as necessary for its intended purpose, up to 3 months, unless a longer period is required by law or necessary to resolve legal claims.
Because different systems in this chain are governed by different retention rules, here is how long your data may exist in each of them:
| System | Retention |
|---|---|
| Your inquiry in our Zoho Mail inbox | 3 months, then deleted by NextStep under our own retention policy above. |
| Web3Forms (contact-form processor) | Up to three years from the date of submission, per Web3Forms' privacy policy, then automatically deleted. |
| Web3Forms server logs (may incidentally include IP address/user-agent, as described above) | Web3Forms states these logs are deleted on a regular basis. |
| Zoho Mail Trash (if an email is deleted before the 3-month period above) | Per Zoho's published policy: 5–180 days in Trash depending on our configured cleanup interval, then a further 30-day server-side recovery window, after which it is permanently and irrecoverably deleted. |
| Cloudflare security event logs | Up to 24 hours, per Cloudflare's published documentation for our plan. |
| Cloudflare security analytics logs | Up to 7 days, per Cloudflare's published documentation for our plan. |
| Backups, local copies, or a CRM system | None. NextStep does not maintain a separate backup, a local copy, or a CRM record of your inquiry outside the Zoho inbox described above. |
Data Security
We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, disclosure, or misuse. These measures are regularly reviewed to maintain an appropriate level of protection.
How we protect your data
We do not disclose implementation details that could themselves create a security risk, but at a high level, here is how your data is protected:
- Encryption in transit – All data you submit through our contact form travels over HTTPS, and Cloudflare terminates TLS for traffic to our website.
- No NextStep-operated database – This website is static and has no server or database of its own that stores your data. Once Web3Forms forwards your submission, it resides in the Zoho Mail inbox described above and, per Web3Forms' own privacy policy, in Web3Forms' systems for up to three years — both governed by the retention periods in the table above.
- Access controls – Access to the Zoho Mail inbox, our Cloudflare account, and our Web3Forms account requires multi-factor authentication (MFA).
- Third-party security – Web3Forms and Cloudflare each apply their own security measures to the data they process on our behalf; see "Web3Forms" and "Cloudflare" above.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. See "How we handle security incidents" below for what happens if something goes wrong.
How we handle security incidents
NextStep does not currently have a separate, formal incident-response document, given the limited scope of personal data this website processes (contact-form inquiries only). If we become aware of a security incident affecting your personal data, we will investigate it and take appropriate steps to contain and address it.
Where the PDPA's breach-notification obligations apply, we will notify the Personal Data Protection Committee (PDPC) without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights and freedoms. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, without delay, describing what happened and what we are doing about it.
Because Web3Forms and Zoho Mail process your data on our behalf, a security incident at either of them could also affect your data. Zoho publishes a general policy of notifying affected organizations by email within 72 hours of becoming aware of a breach, but this is not a bespoke contractual guarantee we have separately negotiated with Zoho. We have no equivalent statement or agreement, contractual or otherwise, from Web3Forms. As noted in "Web3Forms," "Email provider: Zoho Mail," and "International data transfers" above, we do not currently have a signed agreement with either provider that contractually guarantees they will inform us of an incident on their end. This is a gap we are aware of and are working to close. If you believe your data may have been affected by an incident at either provider, please contact us at privacy@nextstep.engineer.
You can also contact the PDPC directly; see "Complaints" below.
Personal data breaches
We maintain reasonable technical, administrative, and organizational safeguards designed to protect personal data against accidental or unlawful loss, unauthorized access, use, disclosure, alteration, or destruction (see "Security" above).
If we become aware of a suspected or confirmed personal data breach, we will take appropriate steps to:
- Investigate – Assess the incident and determine its nature, scope, and potential impact.
- Contain – Secure the affected systems or information.
- Mitigate – Take reasonable measures to limit harm and prevent a recurrence.
- Notify – Inform the PDPC and affected individuals where required, as described in "How we handle security incidents" above.
If you believe your personal data may have been involved in a security incident, or if you have questions about our handling of a personal data breach, please contact us at:
Email: privacy@nextstep.engineer
Phone: +66 2 017 2700
What are your data protection rights?
NextStep would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:
The right to withdraw consent – As set out in "Legal basis for processing" above, none of our current processing activities rely on consent; we rely on legitimate interests or, where relevant, necessity for steps taken at your request prior to entering into a contract. If this changes (for example, if we ever ask for your consent to use contact-form data for marketing), you will have the right to withdraw that consent at any time by contacting us. The "Privacy choices" control on our website does not itself grant or withdraw PDPA consent — as explained above, it only turns the contact form on or off. Withdrawing consent, where it applies, does not affect the lawfulness of processing carried out before the withdrawal.
The right to access – You have the right to request NextStep for copies of your personal data. Access requests are free of charge. We only charge a fee where the PDPC's rules allow it (for example, for a special format you request, for delivery costs, or where a request is repetitive or excessive), and we will tell you the fee before processing the request.
The right to rectification – You have the right to request that NextStep correct any information you believe is inaccurate. You also have the right to request NextStep to complete information you believe is incomplete.
The right to erasure – You have the right to request that NextStep erase your personal data, under certain conditions.
The right to restrict processing – You have the right to request that NextStep restrict the processing of your personal data, under certain conditions.
The right to object to processing – You have the right to object to NextStep’s processing of your personal data, under certain conditions.
The right to data portability – You have the right to request that NextStep transfer the data that we have collected to another organization, or directly to you, under certain conditions.
How we verify your identity: Before responding to a request, we will verify that it comes from you (or someone authorized to act for you), for example by confirming details against the contact-form submission or email address on record. If we cannot verify your request, we will tell you what additional information we need.
When we may refuse a request: We may refuse or limit a request where disclosure is prohibited by law or a court order, where it would affect the rights (including intellectual property rights) of another person, where the request is unfounded, or for other reasons permitted under the PDPA and its notifications. If we refuse a request, we will explain why.
If you make a request, we have 30 days to respond to you, which we may extend by up to a further 30 days for large or complex requests (we will notify you if we do). These timelines reflect the PDPC's Notification Re: Rules on Requests for Access to and Obtaining Copies of Personal Data (B.E. 2569/2026), which takes effect on 14 September 2026. If you would like to exercise any of these rights, please contact us at our email:
Call us at: +66 2 017 2700
Or write to us: privacy@nextstep.engineer
If you are not satisfied with how we have handled your request, you can lodge a complaint with the Personal Data Protection Committee (PDPC); see "Complaints" below.
Children’s privacy
This website is a business-to-business (B2B) website intended for professional and business inquiries. It is not directed at, or intended for use by, children, and we do not knowingly collect personal data from children through the contact form. If you believe a child has provided us with personal data, please contact us at privacy@nextstep.engineer so we can delete it.
AI Profiling
We may use AI to analyse personal data and support profiling to improve our services and decision-making. Where applicable, you may request information about such processing and exercise your rights under applicable data protection laws.
Third-party websites
The NextStep website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.
Changes to our privacy policy
NextStep keeps its privacy policy under regular review and places any updates on this web page. Current version: 15 September 2026 (see "Last updated" at the top of this page). Major revisions:
- 7 March 2026 – Original policy published.
- 26 August 2026 – Revised to align with Section 23 of the Thai PDPA: added a Data Controller section, legal basis for processing, whether providing data is required and the consequences of not providing it, a consolidated recipients section, and an international data transfers section.
- 27 August 2026 – Revised following legal review: verified and corrected the specific data sent to and retained by Web3Forms, Cloudflare, and Zoho Mail; added a legal-basis table, a retention-periods table, an international-transfers table, a Cloudflare cookie table, a Security section, and a "How we handle security incidents" section; clarified what the contact-form notice does and does not cover; expanded data-subject-rights procedures (identity verification, refusal grounds, PDPC access-request timelines); corrected the supervisory authority reference from the UK Information Commissioner's Office to the Personal Data Protection Committee (PDPC), Thailand; and restructured the whole policy into 16 clearly numbered topics, each with sub-topics nested underneath, matching the structure used by major B2B technology companies.
How to contact us
If you have any questions about NextStep’s privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.
Email us at: privacy@nextstep.engineer
Call us: +66 2 017 2700
Or write to us at:
689, BHIRAJ TOWER@EMQUARTIER, FLOOR 30, SUKHUMVIT ( SOI 35), KHLONG TAN NUA, VADHANA, BANGKOK 10110