Privacy notice

Viamitra is run by Messe Asia Co., Ltd. (company registration 0105569070485), Bhiraj Tower at BITEC, Room 23030-02, 23rd Floor, 4345 Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260, Thailand. Messe Asia Co., Ltd. is the data controller: it decides how your personal data is used and answers for it. We don't have a separate data protection officer; write to hello@viamitra.com and a person at the desk in Bangkok answers.

For people in the EU: we will appoint a representative in the EU under Article 27 of the GDPR, and name them on this page, before we work with buyers there.

• Buyers who send a sourcing request or have a Viamitra account, and the colleagues they name in a brief.
• Manufacturers' contact people, from the application onwards.
• Customers a manufacturer names as references, when we speak to them during a company check.
• Owners and directors of a company we check, as they appear in public registers.
• Visitors to viamitra.com, and anyone who writes to us.

When you send a sourcing request

Your name, work email, company and country, and what you need; if you add them, your role, the industry, rough volumes and when you want to decide. We also keep the IP address the request came from.

When you apply as a manufacturer

Details about your company, which are mostly not personal data, and about its contact person: name, role, work email, phone, LINE ID, preferred language, whether you'd like an interpreter, and a partner code if someone referred you. We keep the IP address the application came from and the consents you give in the form.

When you have an account

• Your name, role, email and language.
• The briefs you write, including the names and roles of people who will attend, if you add them.
• Shortlists and your answers to them (ask to meet, not for us, we already know them), with any reason you give.
• Meetings: the times, format, video link, who booked and who accepted the invite.
• Your answer to “how did it go?” after a meeting, and an optional private note.
• Next steps and the deal-room history, each with who made the change.
• Disputes about a report line, and how they were decided.
• When a manufacturer signs a membership: the name typed as the signature, the time and the IP address.

When we check a company

The company's registration, certificates and other records from public registers; its owners and directors as the registers show them, screened against public sanctions lists; and what the customers it names as references tell us, if they agree to speak to us. Documents and photos the company sends us are kept as evidence. We remove location data from photos when they are uploaded.

When you sign in

Your email address, a one-time code that we store only in scrambled (hashed) form, and a session record with the IP address it came from.

When you visit the site

Our forms use Cloudflare Turnstile to tell people from bots; it receives your IP address for that check. We count visits as daily totals of pages, linking sites and countries, with no IP address, cookie or other identifier. Our hosting keeps short-lived technical logs of requests.

When you write to us

Emails between you and the desk, in the desk's mailbox, and copies of the emails the service sends you. Replies to meeting invites (accept or decline) are read by the service to update the meeting.

What we don't collect

We don't ask for sensitive data such as health, religious, biometric or criminal-record information, we don't take card details, and we don't use advertising or tracking tools.

From you; from a colleague who names you in a brief; from public registers and sanctions lists; and from customers a manufacturer names as references. Some of the companies we approach are already in touch with Messe Asia through its trade events; we contact them only through that existing relationship.

We record where every contact came from. We don't buy contact lists, and we don't use lists whose source we can't account for.

The PDPA and the GDPR let us use personal data only for a stated reason on a lawful basis. Ours are:

Where we rely on consent, you can withdraw it at any time by writing to us. Where we rely on legitimate interests, you can object, and we stop unless we have compelling grounds that outweigh your interests.

• Buyers see a manufacturer's company details, its report line by line with the source of each line, and what it pays Viamitra. They don't see its contact details until both sides agree to meet, and never see evidence files.
• Before both sides agree to meet, a manufacturer sees a buyer's need, volumes, decision date, country and industry, but not the buyer's name or contacts.
• Once both agree, the manufacturer sees the buyer's company name, and each side sees the name, role, email, phone and LINE ID of the other's contact people. The meeting invite lists both teams.
• Your answer to “how did it go?”, your private note and why a meeting was cancelled are never shown to the other side. The reasons you give for declining are passed on only if you ask us to.
• Report lines record what a check found, such as “two customers called on 18 Sep, supplying for 3 and 5 years”. They don't name the people we spoke to or list individual owners.
• Viamitra desk staff see what they need to do their work. Every time staff open private notes, applications or evidence files, it is logged.

• The other side of an introduction, as described above, once you have both agreed to meet. From then on, they are responsible for how they use your details.
• Cloudflare, which hosts the website, its database and files, sends and receives our email, and runs the bot check on our forms.
• Google, which hosts the desk's mailbox and, when the desk sets up a video call, Google Meet. If a meeting uses another tool, such as Zoom, Microsoft Teams, Webex or Whereby, that provider handles the call.
• Messe Asia's own accounting team, for invoices, refunds and success fees.
• A government agency that co-funds your membership, only with your consent.
• Our lawyers and auditors, under a duty of confidentiality, and authorities when the law requires it.

Cloudflare and Google process data for us under their data processing terms. We never sell personal data.

Our database and files are held by Cloudflare in its Asia-Pacific region, which may be outside Thailand, and the website is served through Cloudflare's worldwide network. Google stores the desk's email in its data centres worldwide. These transfers are covered by the providers' data processing terms, which include the European Commission's Standard Contractual Clauses.

When you ask to meet a manufacturer, or agree to meet a buyer, your contact details go to that company, which may be in another country. We send them because the introduction you agreed to needs them.

When we delete a person, we keep records about companies, meetings held and money paid that no longer identify anyone.

• Connections to the site are encrypted, and our providers encrypt stored data.
• Sign-in uses one-time codes sent by email; codes and session tokens are stored only in hashed form, and repeated attempts are blocked.
• Only Viamitra staff with a desk role can open desk screens, and their access to sensitive records is logged.
• Photos have their location data removed when uploaded; evidence files are never shown to buyers.

If a breach of personal data is likely to put your rights at risk, we report it to Thailand's Office of the Personal Data Protection Committee within 72 hours of learning of it, and to EU authorities where the GDPR requires, and we tell you without delay when the risk to you is high.

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• send it to you, or to another organisation, in a common electronic format;
• correct it if it is wrong or incomplete;
• delete it, or make it anonymous;
• stop using it for a while (restriction);
• stop using it where we rely on legitimate interests (objection);
• stop using it where we rely on your consent (withdrawal).

Write to hello@viamitra.com from the address we know you by. We may ask you to confirm who you are. There is no charge, and we answer within 30 days. Sometimes the law lets us, or makes us, keep something, such as an invoice; if so, we tell you what and why.

You can also complain to Thailand's Office of the Personal Data Protection Committee or, in the EU, to the supervisory authority where you live or work. We would like the chance to put things right first.

Shortlists, company checks and every decision about an introduction are made by people at the Viamitra desk. We don't make decisions about you by automated means alone, and we don't build profiles of you.

The site sets two cookies, one to keep you signed in and one to remember your language, and none for tracking. The cookies page has the details.

Viamitra is a service for businesses. It is not meant for anyone under 20, and we don't knowingly collect their data.

We don't send cold marketing email. We write to people who asked to hear from us, or who are part of an introduction they agreed to. Emails that run the service, such as sign-in codes, invites, reminders and recaps, are part of the service, not marketing.

When this notice changes, the date at the top changes too, and members are told by email about anything that affects them.