Privacy Policy
Privacy policy
1. Who we are
T&S Asset Management LLC (“T&S”, “we”) handles personal data collected on this website (ts-asset-mgmt.com) in accordance with applicable laws, including Japan’s Act on the Protection of Personal Information (APPI) and Thailand’s Personal Data Protection Act (PDPA). Under the PDPA, we are the data controller.
2. What we collect
- Contact form: name, company or organisation, email address, country or region, reason for contact and your message.
- Illegal lending map membership: name, business email address, company name, head-office country, company registration number (such as a Japanese corporate number, UEN or NIB), role, company website, whether and when you consented, and the status of your application (unconfirmed, under review, approved or rejected) with the review decision. This is information about you and public information about the company you work for.
- Member sign-in: a cookie that keeps you signed in (see below).
- Lender check usage: when you searched, a hash of the search term (the term itself is not stored), the number of matches, and which records you opened and when.
- Paid plan: billing company name, address and tax ID (optional), plan status and renewal date, invoices and payment records. Card details go directly to our payment processor, Stripe; we do not store them.
- SEA Lending Brief (weekly email) sign-up: email address, language (English or Japanese), the URL of the page you signed up on, when you signed up, whether and when you confirmed, and when you unsubscribed.
- Access logs: IP address, browser type, pages viewed, referrer, time, and how long a page was shown.
- Your cookie choice and, if you allow analytics, your browsing record on this site (see 7).
If you do not provide the required fields (reason, name and email), we cannot reply to your enquiry.
3. Purposes and legal bases
| Replying to enquiries and sending requested materials or demos | Steps taken at your request before entering into a contract, or our legitimate interests |
|---|---|
| Reviewing membership applications (checking that the company exists and that your email domain matches its website) and preventing impersonation and misuse | Providing the member service (performance of a contract) and our legitimate interests |
| Providing member data and emailing sign-in links and review decisions | Performance of a contract |
| Member update emails (data updates and notable changes) | Your consent, which you can withdraw at any time |
| Providing the lender check, counting detail views and preventing attempts to read out the list | Performance of a contract and our legitimate interests |
| Charging for the paid plan, issuing invoices and keeping accounting and tax records | Performance of a contract and legal obligation |
| Sending SEA Lending Brief (a weekly summary of lending, credit and regulation in Southeast Asia), sending the confirmation email, and notifying our team of new subscribers | Your consent, given when you click the link in the confirmation email; you can withdraw it at any time |
| Analysing access logs to improve the site and to produce statistics on visitors’ regions and organisation types | Our legitimate interests |
| Understanding browsing with the analytics cookie, including which reports were read before an enquiry or weekly email sign-up | Your consent, which you can withdraw at any time |
| Operating the site securely and preventing abuse | Our legitimate interests |
| Complying with the law | Legal obligation |
We will ask for your consent before using your data for any other purpose, including marketing.
Unsubscribing from the weekly email: use the unsubscribe link at the end of the confirmation email and of every issue, at any time, or email contact@ts-asset-mgmt.com.
4. Service providers and disclosure
We do not disclose personal data to third parties without your consent, except where required by law. We use the following service providers to run the site and handle email, and supervise them to process data only as needed:
- Google LLC (website hosting on Google Cloud; storing weekly email sign-ups; storing membership records)
- Google LLC (email via Google Workspace, including the weekly email and its confirmation; web font delivery; sending member emails)
- Cloudflare, Inc. (cookieless site analytics)
- Stripe, Inc. and its affiliates (paid-plan payments and invoices)
5. International transfers
These providers may process data on servers outside Japan and Thailand. We transfer data only after confirming that the provider has appropriate safeguards (contractual data-protection terms, access control, encryption and similar measures). On request, we will provide information on the destination countries, their data-protection regimes and the measures the providers take.
6. How long we keep data
| Enquiry content and contact details | Three years from our last correspondence; longer if a business relationship follows and the contract or law requires it |
|---|---|
| Membership records | While you are a member; deleted within 30 days of a request to close your membership. Applications whose email was never confirmed are deleted after 30 days, and applications we could not accept after one year |
| Lender check usage records | One year |
| Paid-plan billing and payment records | As long as the law requires (up to 7 years) |
| Weekly email sign-ups | Until you unsubscribe. Sign-ups that are never confirmed are deleted after 30 days. After you unsubscribe we keep only the email address and date for one year, so we do not email you again |
| Access logs | Up to 90 days |
| Browsing record linked to the analytics cookie (ts_aid) | 13 months (deleted when you withdraw consent) |
After that, data is deleted or anonymised.
7. Cookies and analytics
The cookies on this site are first-party cookies, set and read only by our own server. We do not use cookies for advertising.
| Name | Kind and purpose | Lifetime |
|---|---|---|
| ts_consent | Necessary. Records your choice in the cookie settings (“Necessary only” or “Allow analytics”) | 6 months |
| tsm | Necessary. Keeps members of the illegal lending map signed in (signed, HttpOnly and Secure); not set for anyone who does not sign in | 180 days |
| ts_aid | Analytics. A random identifier (HttpOnly and Secure), set only if you choose “Allow analytics”, used to understand which reports are useful | 13 months |
Analytics cookie (ts_aid): the default is “Necessary only”; we do not set it unless you choose “Allow analytics”. If you do, we record on our server, linked to this identifier, the pages you view and when, the country and theme of the reports, and where your first visit came from (the referring site and the utm_source, utm_medium and utm_campaign campaign tags). We keep this for 13 months and then delete it. It is never shared or sold, not used for advertising and not combined with data from other sites. You can change your choice at any time with “Cookie settings” at the bottom of every page; if you withdraw, we delete ts_aid and the browsing record linked to it, and record nothing further.
Enquiries and weekly email sign-ups: if you have allowed analytics and send an enquiry, or confirm your SEA Lending Brief subscription, we attach a summary of your earlier browsing (number of reports, main countries and themes, the pages and times, and the first-visit source) to your enquiry or subscription record and manage it together with that record, for the same period (see 6. How long we keep data).
For site analytics we use Cloudflare Web Analytics (Cloudflare, Inc.), which does not use cookies. It collects aggregate information such as the pages viewed, referrers, browser and device type, and country, and does not identify or track individual visitors. Pages load fonts from Google Fonts, so your IP address and similar data are sent to Google when you visit. If we introduce other analytics tools, we will update this policy and ask for consent where required.
Access log analysis: we analyse the access logs on our own server (IP address, browser type, pages viewed and referrer) to improve the site and to produce statistics on visitors’ regions and organisation types. From the IP address we estimate the approximate region (country and city) and the organisation the network is registered to (such as a telecom operator or company). The estimate uses the DB-IP database on our own server; IP addresses are not sent to anyone else, and we do not use this to identify individuals. The analysis log records an identifier derived from the IP address with a key that changes every month, not the IP address itself. When you leave a page, the browser sends how many seconds the page was shown (no cookies are used). Access logs are kept for up to 90 days. Questions: contact@ts-asset-mgmt.com.
IP geolocation by DB-IP (https://db-ip.com)
8. Security
We use encrypted connections (HTTPS), restrict access and supervise our providers to prevent loss, leakage or damage. Where the law requires, we will notify the regulator and affected individuals of a breach.
9. Your rights
You may request access to, correction, addition or deletion of, restriction or erasure of your data, suspension of disclosure to third parties, data portability, and object to processing or withdraw consent. We will verify your identity and respond within the period set by law. You may also complain to Japan’s Personal Information Protection Commission or Thailand’s Personal Data Protection Committee (PDPC).
10. Contact point
For requests or questions about personal data, contact:
T&S Asset Management LLC, Personal Data Enquiries
Email: contact@ts-asset-mgmt.com (or choose “Other” on the contact form)
Representative: Takayuki Sato
11. Changes
We may update this policy when laws or our services change. Material changes will be announced on this page.
T&S Asset Management LLC
Effective: 28 September 2026
Last updated: 1 November 2026