Privacy Policy
Last updated: 31 August 2026
This policy explains what personal data we collect when you use vrg.asia, contact us, book a call, or do business with us — and what we do with it. It is written to describe what actually happens, not to cover every eventuality.
Who we are
vrg.asia is operated jointly by two companies, which act as joint controllers of your personal data:
- Virtually Reality Co. Ltd., Level 11, P23 Building, 11/2 Soi Sukhumvit 23, Khlong Toei Nuea, Watthana, Bangkok 10110, Thailand. Tax ID 0105558193131.
- VRG Industries Ltd., The Bower, 207 Old Street, London EC1V 9NR, United Kingdom.
For anything relating to this policy or your data, contact us at info@vrg.asia. Our data protection contact is James Wood, Managing Director.
The short version
- We collect what you give us when you enquire, book a call or work with us, plus limited technical and usage data when you visit.
- We use it to respond to you, deliver work, run and improve the site, and measure our advertising.
- We do not sell personal data.
- We use a small number of service providers, some outside Thailand and the UK, listed below.
- You can ask us what we hold about you, correct it, or ask us to delete it.
What we collect and why
When you send an enquiry
Through the contact form or by email, WhatsApp or LINE: your name, email address, company, your message, and the IP address the form was sent from.
We use this to respond to you and, if it leads to work, to set up the engagement. The IP address is kept to limit abuse of the form.
Legal basis: our legitimate interest in responding to business enquiries; taking steps at your request before entering a contract.
When you book a call
Your name, email, company, a description of your project, an indicative budget range, the time you choose and your time zone, and the IP address of the request.
Booking creates an event in our Google Calendar with a Google Meet link, and sends you an invitation — so your email address is shared with Google to deliver that invitation.
If you arrived from an advert or campaign link, we also record the attribution parameters attached to that link (campaign source, medium and name, a Google click identifier, and which version of our landing page you saw). We use this to understand which advertising brings in genuine enquiries.
Legal basis: taking steps at your request before entering a contract; our legitimate interest in measuring advertising effectiveness.
When we work together
If you become a client or supplier we hold what is needed to deliver the work and bill for it: contact details, company registration and tax details, billing address, quotations, invoices, payment records and project correspondence.
Quotations and invoices are produced as Google Sheets documents and PDFs in our Google Drive.
We may use an AI service (Anthropic) to help draft quotation line items from the project description and any brief you send us. That material is sent to Anthropic for that purpose only, on terms under which it is not used to train their models.
Legal basis: performance of our contract with you; compliance with tax and accounting law.
Keeping our records accurate
We use a tool that reads the headers of our business email — sender, recipient, subject and date, not the body — to match correspondence to the right company record in our customer system. This is how we keep contact details current. It does not read message content and is not used for marketing.
Legal basis: our legitimate interest in maintaining accurate business records.
When you apply for a job
Applications are made by email. We hold your CV, covering message and anything else you send, to assess your application and contact you about it.
Legal basis: taking steps at your request before entering a contract; our legitimate interest in recruitment.
When you visit the site
Technical data. Our hosting provider records the IP address, browser type and pages requested for each visit, in server logs used for security and to keep the site running.
Usage data. We record which pages are viewed, which calls-to-action are clicked, how far pages are scrolled, and form submissions, linked to a random visitor identifier stored in a cookie. We use this to test different versions of our pages and see which work better. It is not linked to your name unless you then submit a form.
Advertising measurement. We use Google Tag Manager, Google Analytics and Google Ads conversion tracking to understand how visitors reach us and whether our advertising leads to enquiries. Google may use this data to build audiences for remarketing under its own policies. We also use Vercel Web Analytics, which provides aggregate page statistics without cookies.
Visitor identification. We may use HappierLeads, which uses your IP address and public business data to estimate which organisation a visit is coming from. It does not tell us who you are as an individual, but it does process your IP address for this purpose.
Chat and lead tools. Some pages may load an AI chat assistant (b2blead.ai, a product we built) or a Typebot chat widget. Anything you type into these is processed to answer you, and if you leave contact details it is treated as an enquiry under the section above.
Legal basis: our legitimate interest in running, securing and improving the site (technical and usage data); your consent, where required, for advertising and identification cookies. You can withdraw that consent at any time — see Cookies below.
Cookies
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
vrg_visitor | vrg.asia | Random identifier so we can count a visitor once across page views when testing page variants | 1 year |
vrg_tracking | vrg.asia | Remembers campaign attribution (source, medium, campaign, click ID, page variant) so a later enquiry can be attributed to the right advert | 30 days |
vrg_lang_banner_dismissed | vrg.asia | Remembers that you closed the language suggestion | 1 year |
| Supabase auth cookies | vrg.asia | Keep our staff signed in to the admin area. Not set for visitors. | Session |
_ga, _gid, _gcl_* and related | Analytics and advertising measurement, as described above | Up to 2 years | |
| HappierLeads cookies | HappierLeads | Support visitor organisation identification | Varies |
You can block or delete cookies in your browser settings. Blocking our own cookies does not affect your ability to use the site or contact us. Google offers an opt-out browser add-on for Analytics and ad settings for advertising.
Who we share data with
We do not sell personal data. We share it only with providers who process it on our behalf, and with others where the law requires.
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Vercel | Hosts the website and runs our server code; web analytics | United States and global edge locations |
| Supabase | Hosts our database (enquiries, bookings, customer records) | Singapore |
| Google (Workspace, Calendar, Meet, Drive, Sheets, Gmail) | Business email, calendar bookings, video calls, documents | Global, primarily United States and Europe |
| Google (Tag Manager, Analytics, Ads) | Analytics and advertising measurement | Global |
| Anthropic | AI assistance drafting quotations | United States |
| HappierLeads | Visitor organisation identification | European Union / United States |
| Meta (WhatsApp) and LINE Corporation | If you choose to message us on those platforms, under their own policies | Global / Japan |
| Accountants, banks, professional advisers | Billing, tax and legal compliance | Thailand and United Kingdom |
We may also disclose personal data where required by law, court order or a regulator, or to establish, exercise or defend legal claims.
International transfers
We operate from Thailand and the United Kingdom, and our providers are in Singapore, the United States and elsewhere. Your data therefore moves between countries.
- From the UK or EU: where a destination country is not recognised as providing adequate protection, we rely on the UK International Data Transfer Addendum or the European Commission's standard contractual clauses, and where a provider is certified under the EU–US Data Privacy Framework, on that certification.
- From Thailand: transfers to our providers are made under contractual safeguards that meet the requirements of the Personal Data Protection Act, or are necessary to perform a contract with you or at your request.
How long we keep it
| Data | Retention |
|---|---|
| Enquiries and bookings that do not lead to work | Up to 3 years after our last contact with you |
| Client and supplier records, contracts, quotations, invoices | At least 5 years after the end of the relationship in Thailand and 6 years in the UK, as accounting and tax law require |
| Job applications | 12 months after the role is filled or the application closes, unless you ask us to keep it on file |
| Site usage and analytics data | Up to 26 months |
| Server logs | Short periods, as set by our hosting provider |
When data is no longer needed we delete it or anonymise it.
Your rights
Depending on where you are, you have rights under the UK GDPR, the EU GDPR and Thailand's Personal Data Protection Act (PDPA). These include the right to:
- Access the personal data we hold about you, and receive a copy.
- Correct data that is inaccurate or incomplete.
- Delete your data, where we no longer have a valid reason to keep it.
- Restrict how we use it while a dispute is resolved.
- Object to processing based on our legitimate interests, including profiling for advertising.
- Port data you gave us to another provider, in a machine-readable form.
- Withdraw consent at any time, where consent is the basis for processing. This does not affect what was done before you withdrew it.
To exercise any of these, email info@vrg.asia. We may ask you to confirm your identity. We aim to respond within one month, and within 30 days for requests under the PDPA.
If you are not satisfied with our response you can complain to a supervisory authority:
- UK: the Information Commissioner's Office — ico.org.uk
- Thailand: the Office of the Personal Data Protection Committee — pdpc.or.th
- EU: the data protection authority in the country where you live or work.
We would rather you raised it with us first, and we will take it seriously.
Security
All traffic to the site is encrypted in transit. Personal data is held in a database with row-level access controls, and access to customer records is limited to authenticated staff with an administrator role. Server-side credentials are never exposed to the browser.
No method of storage or transmission is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant regulator as the law requires.
Children
The site and our services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children.
Links to other sites
The site links to third-party services including WhatsApp, LINE, LinkedIn and Facebook. Their handling of your data is governed by their own privacy policies, not this one.
Changes to this policy
When we change this policy we update the date at the top. Material changes will be highlighted on this page. The English version of this policy is the governing text.
Contact
Email: info@vrg.asia Post (Thailand): Virtually Reality Co. Ltd., Level 11, P23 Building, 11/2 Soi Sukhumvit 23, Khlong Toei Nuea, Watthana, Bangkok 10110 Post (UK): VRG Industries Ltd., The Bower, 207 Old Street, London EC1V 9NR