Privacy policy

Last updated: 14 October 2026

This policy explains what personal data we collect when you use vrg.asia or our applications, contact us, book a call, or do business with us — and what we do with it. It is written to describe what actually happens, not to cover every eventuality.

Update, 14 October 2026: Added coverage for our applications, including Aviagen Workshop room data, shared sessions, audio, retention and deletion.

Who we are

vrg.asia is operated jointly by two companies, which act as joint controllers of your personal data:

• Virtually Reality Co. Ltd., Level 11, P23 Building, 11/2 Soi Sukhumvit 23, Khlong Toei Nuea, Watthana, Bangkok 10110, Thailand. Tax ID 0105558193131.
• VRG Industries Ltd., The Bower, 207 Old Street, London EC1V 9NR, United Kingdom.

For anything relating to this policy or your data, contact us at info@vrg.asia. Our data protection contact is James Wood, Managing Director.

The short version

• We collect what you give us when you enquire, book a call or work with us, plus limited technical and usage data when you visit.
• We use it to respond to you, deliver work, run and improve the site, and measure our advertising.
• We do not sell personal data.
• We use a small number of service providers, some outside Thailand and the UK, listed below.
• You can ask us what we hold about you, correct it, or ask us to delete it.

Our applications

This policy also covers VRG applications that link to it. The app-specific information below explains the data each named app uses; website cookies and advertising do not automatically apply inside an app. If an application has a separate privacy notice, that notice explains its particular data handling.

Aviagen Workshop

Virtually Reality Company Limited (VRG Asia), the Thai company listed above, is responsible for Aviagen Workshop, our Quest mixed-reality training app and its facilitator control software. The following describes the current 0.3.3 workshop application. If your organisation runs a workshop, it also controls device assignments and session operation; contact its administrator about records it controls.

Room and placement. With Spatial Data permission, Aviagen reads the saved-room information supplied by Meta, including floor boundaries, surfaces and obstacles, to suggest where training equipment fits. A confirmed placement is saved on the headset as a floor-anchor identifier, position, orientation and scale. The app does not upload room geometry to our website or the facilitator server. Passthrough is displayed through Meta's system compositor; our app does not capture or store raw camera images.

Movement and shared sessions. Headset position and orientation, controller input and tracking status operate the experience. When connected, the app sends headset position, orientation, alignment status, battery level and frame rate to the configured facilitator computer over an authenticated, encrypted connection. The facilitator can see connected devices. Headsets in the same assigned room receive participant and session information to coordinate the workshop and display nearby participants.

Device configuration. The headset and facilitator computer retain a generated device identifier, connection credentials and settings; the facilitator's registry also retains its device label and room assignment. No participant real name is required. Operators should use device labels rather than personal names.

Audio. When the facilitator enables their computer microphone, speech is streamed to selected headsets and buffered for playback. The workshop software does not record it to disk. The headset app does not capture or transmit participants' microphone audio.

Diagnostics. Local performance logs contain timestamps, frame timings and connection/alignment status. An explicitly triggered support diagnostic records saved-room loading results. Authorised support may copy these files and app configuration to a support computer for troubleshooting or backup.

Meta account services. The app initializes Meta's Platform SDK and checks entitlement to use the application. We request User ID and User Profile access for Meta's spatial-platform prerequisites. Current application code does not fetch, display, store or transmit Meta user IDs, usernames or profile photos. Meta operates its account, headset permissions and platform services separately under its privacy policy.

Purpose and sharing. We use this information to deliver and coordinate training, place equipment, maintain device connections and diagnose faults. Our basis is our legitimate interest in providing and supporting the training experience, and performance of a contract where you are a party to it. Device permissions control access to restricted features. Workshop data is available to the facilitator, participants in the same assigned room as described above, and authorised VRG support where needed. We do not send it to separate companies or service providers for processing on our behalf. The app has no advertising or third-party behavioural analytics integration and we do not sell its user data. Software downloads from vrg.asia do not upload room, movement or voice data to that website.

Retention and deletion. Live movement and audio are processed in memory; the workshop software does not keep a movement history or audio recording. Saved placement, configuration and diagnostic files remain until removed or replaced; there is no automatic retention timer in the current app. Support and backup copies must also be considered when deleting data. These app-specific arrangements are separate from the website and business-record retention periods below.

To request access, correction or deletion of application data, email info@vrg.asia with Aviagen Workshop and enough information to identify your workshop or device. Do not send passwords or connection tokens. We will identify relevant data and arrange deletion of records we control, subject to any applicable legal obligation to retain them. This includes support copies and app data on devices and facilitator computers we control. Contact your administrator for equipment your organisation manages. Meta's saved room scans and account records are managed separately through Meta's settings and services. The rights and response times below also apply to application requests.

Choices and age. You can decline or withdraw Spatial Data permission in headset settings; automatic room placement will then be unavailable. The facilitator controls shared-session participation and microphone streaming. Speak to the facilitator if you do not want to participate in a connected workshop. Aviagen is intended for supervised professional training, with Meta's teens-and-adults age category, and is not directed at children under 13; regional minimum-age requirements still apply.

What we collect and why

When you send an enquiry

Through the contact form or by email, WhatsApp or LINE: your name, email address, company, your message, and the IP address the form was sent from.

We use this to respond to you and, if it leads to work, to set up the engagement. The IP address is kept to limit abuse of the form.

Legal basis: our legitimate interest in responding to business enquiries; taking steps at your request before entering a contract.

When you book a call

Your name, email, company, a description of your project, an indicative budget range, the time you choose and your time zone, and the IP address of the request.

Booking creates an event in our Google Calendar with a Google Meet link, and sends you an invitation — so your email address is shared with Google to deliver that invitation.

When advertising tracking is enabled and you arrive from an advert or campaign link, we also record the attribution parameters attached to that link (campaign source, medium and name, a Google click identifier, and which version of our landing page you saw). We use this to understand which advertising brings in genuine enquiries.

Legal basis for the booking: taking steps at your request before entering a contract. Advertising attribution follows the tracking settings described below.

When we work together

If you become a client or supplier we hold what is needed to deliver the work and bill for it: contact details, company registration and tax details, billing address, quotations, invoices, payment records and project correspondence.

Quotations and invoices are produced as Google Sheets documents and PDFs in our Google Drive.

We may use an AI service (Anthropic) to help draft quotation line items from the project description and any brief you send us. That material is sent to Anthropic for that purpose only, on terms under which it is not used to train their models.

Legal basis: performance of our contract with you; compliance with tax and accounting law.

Keeping our records accurate

We use a tool that reads the headers of our business email — sender, recipient, subject and date, not the body — to match correspondence to the right company record in our customer system. This is how we keep contact details current. It does not read message content and is not used for marketing.

Legal basis: our legitimate interest in maintaining accurate business records.

When you apply for a job

Applications are made by email. We hold your CV, covering message and anything else you send, to assess your application and contact you about it.

Legal basis: taking steps at your request before entering a contract; our legitimate interest in recruitment.

When you visit the site

Technical data. Our hosting provider records the IP address, browser type and pages requested for each visit, in server logs used for security and to keep the site running.

Usage data. Analytics starts by default unless you have saved a choice turning it off. While enabled, we use VRG's page experiments, Vercel Web Analytics and Google Analytics to understand visits and improve the site. Our experiments use a random visitor identifier. Linking an experiment to an enquiry also requires advertising tracking to be enabled.

Advertising measurement. Advertising tracking starts by default unless you have saved a choice turning it off. While enabled, we use campaign attribution and Google Ads conversion tracking to understand which advertising leads to enquiries. After a successful contact-form submission or booking, we normalize and hash your email address in your browser and send the hash to Google Ads for enhanced conversion matching. Hashing does not make this data anonymous. Our conversion code does not send your email address or its hash to Google Analytics, or save the hash in browser storage. Google may use advertising data for personalised advertising. Read how Google uses data. Google tags load directly according to your current tracking settings. B2BLead's own optional form measurement requires both analytics and advertising to be enabled; our website sends confirmed lead events to Analytics or Ads independently according to your choices. A first visit can send Google measurement requests before you make a choice. The default is not recorded as an affirmative acceptance by you.

Chat assistant and contact form. B2BLead hosts our chat assistant and contact form. The B2BLead widget connects when both tracking categories are enabled. If either is off, the footer AI assistant link still lets you start a conversation on B2BLead when you choose. We do not pass advertising parameters or launcher experiment identifiers to chat. Chat can remember your selected language for the browser session. Anything you type into chat is processed to answer you; contact details are treated as an enquiry. The contact form, email links and booking remain available without optional consent. When either tracking category is off, the form's optional analytics and campaign storage are disabled. Form drafts are not saved in browser storage. Security checks, including Cloudflare Turnstile and short-lived form submission tickets, remain active to prevent abuse.

Legal basis for running and securing the site: our legitimate interest. Handling an enquiry uses the bases described above and does not require advertising tracking. Optional tracking uses the opt-out settings described here; an enabled default is not a record of affirmative consent.

Cookies

Analytics and advertising tracking are on by default. Use Turn off optional tracking, Keep tracking on, or Settings in the tracking notice. Existing saved choices, including earlier rejections, take priority over the default. We record a choice only when you use these controls, not merely because you browse. Saved choices are remembered for 180 days. Reopen Cookie settings in the footer to change them at any time. Changing an active tracking choice refreshes the page so previously loaded scripts stop; save any unfinished form text first.

When you turn tracking off, we stop the corresponding future collection and remove the optional first-party identifiers and related campaign storage we control. Turning tracking off does not delete data collected earlier, and we cannot delete cookies on another provider's domain. You can also delete cookies through your browser or use Google's ad settings.

The contact form may store campaign attribution in localStorage for up to 30 days only when both tracking categories are enabled. Advertising conversion deduplication uses sessionStorage while advertising tracking is enabled. A small localStorage signal synchronises cookie-choice changes across tabs; it contains only a timestamp. Booking availability is cached locally for up to ten minutes to support the booking service, with no visitor identifier.

Who we share data with

We do not sell personal data. The table below lists providers used for our website and business operations; it is not a list of recipients of Aviagen room or tracking data. Application sharing is described above. We also disclose data where the law requires.

We may also disclose personal data where required by law, court order or a regulator, or to establish, exercise or defend legal claims.

International transfers

For our website and business operations, we operate from Thailand and the United Kingdom, and our providers are in Singapore, the United States and elsewhere. Data processed by those services therefore moves between countries. Aviagen workshop data stays on its participating devices and configured facilitator computer, except for authorised support copies; Meta handles its platform services separately.

• From the UK or EU: where a destination country is not recognised as providing adequate protection, we rely on the UK International Data Transfer Addendum or the European Commission's standard contractual clauses, and where a provider is certified under the EU–US Data Privacy Framework, on that certification.
• From Thailand: transfers to our providers are made under contractual safeguards that meet the requirements of the Personal Data Protection Act, or are necessary to perform a contract with you or at your request.

How long we keep it

When data is no longer needed we delete it or anonymise it.

Your rights

Depending on where you are, you have rights under the UK GDPR, the EU GDPR and Thailand's Personal Data Protection Act (PDPA). These include the right to:

• Access the personal data we hold about you, and receive a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data, where we no longer have a valid reason to keep it.
• Restrict how we use it while a dispute is resolved.
• Object to processing based on our legitimate interests, including profiling for advertising.
• Port data you gave us to another provider, in a machine-readable form.
• Withdraw consent at any time, where consent is the basis for processing. This does not affect what was done before you withdrew it.

To exercise any of these, email info@vrg.asia. We may ask you to confirm your identity. We aim to respond within one month, and within 30 days for requests under the PDPA.

If you are not satisfied with our response you can complain to a supervisory authority:

• UK: the Information Commissioner's Office — ico.org.uk
• Thailand: the Office of the Personal Data Protection Committee — pdpc.or.th
• EU: the data protection authority in the country where you live or work.

We would rather you raised it with us first, and we will take it seriously.

Security

All traffic to the site is encrypted in transit. Personal data is held in a database with row-level access controls, and access to customer records is limited to authenticated staff with an administrator role. Server-side credentials are never exposed to the browser.

No method of storage or transmission is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant regulator as the law requires.

Children

Our website and business enquiry services are intended for adults and businesses. Application age requirements are stated in the relevant app section or its separate notice. Aviagen Workshop is not directed at children under 13. If you believe a child below the applicable age has provided personal data, contact info@vrg.asia so we can investigate and arrange deletion where appropriate.

Links to other sites

The site links to third-party services including WhatsApp, LINE, LinkedIn and Facebook. Their handling of your data is governed by their own privacy policies, not this one.

Changes to this policy

When we change this policy we update the date at the top. Material changes will be highlighted on this page. The English version of this policy is the governing text.

Contact

Email: info@vrg.asia Post (Thailand): Virtually Reality Co. Ltd., Level 11, P23 Building, 11/2 Soi Sukhumvit 23, Khlong Toei Nuea, Watthana, Bangkok 10110 Post (UK): VRG Industries Ltd., The Bower, 207 Old Street, London EC1V 9NR