Privacy Policy

1. Who We Are

The data controller for your personal data is Nakhon Advocates, a legal practice registered and operating in Thailand, with offices at 41 Chom Phon Road, Nai Mueang, Mueang Nakhon Ratchasima, Nakhon Ratchasima 30000. For data protection enquiries, please contact us at [email protected].

2. What Data We Collect

We collect personal data in the following ways and categories:

• Enquiry data: name, email address, telephone number, and the content of any message submitted through our website contact form or sent to us directly.
• Engagement data: during the course of a legal engagement, we collect information relevant to the matter — which may include identity documents, financial information, family relationships, and details about the deceased's estate.
• Website usage data: IP address, browser type, pages visited, and session duration, collected through cookies and analytics tools where consent has been given.
• Communication records: records of telephone calls and email correspondence related to our services.

3. Legal Basis for Processing

We process personal data on the following legal bases under Thailand's Personal Data Protection Act (PDPA) B.E. 2562:

• Consent: for website analytics cookies and marketing communications, where you have provided consent.
• Contract performance: to perform our legal services under the engagement we have with you.
• Legitimate interests: to respond to enquiries and maintain records of our professional practice.
• Legal obligation: where Thai law requires us to retain or disclose certain records.

4. How We Use Your Data

• To respond to enquiries submitted through our website or by other means
• To perform the legal services you have engaged us to provide
• To maintain accurate records of our professional engagements
• To comply with our legal and regulatory obligations as a law practice
• To improve our website's performance and user experience (where consent is given)
• To send you relevant information about our services if you have consented to receive it

5. Data Retention

We retain personal data for the following periods:

• Enquiry data (no engagement): 12 months from the date of enquiry, after which it is securely deleted.
• Engagement files: 10 years from the close of the engagement, in accordance with Thai legal professional standards and limitation periods applicable to succession matters.
• Website analytics data: up to 26 months, subject to your cookie consent settings.

6. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include access controls on client files, password-protected systems for digital records, and encrypted communication channels for sensitive correspondence. All members of our practice who have access to client data are bound by professional legal privilege and confidentiality obligations. In the event of a data breach that is likely to affect your rights, we will notify you and the relevant authority as required by the PDPA.

7. Cookies

Our website uses cookies. For detailed information on the types of cookies we use and how to manage your preferences, please read our Cookie Policy. You may withdraw your consent to non-essential cookies at any time through the cookie preference settings on that page.

8. Sharing Your Data

We do not sell or rent personal data. We may share your data in the following circumstances:

• With courts and registries: where required to conduct your legal matter.
• With instructed experts or consultants: where relevant to your engagement and with your knowledge.
• With IT and cloud service providers: who process data on our behalf under data processing agreements.
• As required by law: including to regulatory authorities or in response to lawful requests.

9. Third-Party Links

Our website may include links to external websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before submitting any personal data.

10. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe we have inadvertently collected data from a minor, please contact us so we can arrange for its deletion.

11. Your Rights Under the PDPA

As a data subject under Thailand's Personal Data Protection Act, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to request correction of inaccurate data.
• Right to erasure: to request deletion of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, commonly used format.
• Right to object: to object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: with the Personal Data Protection Committee or another supervisory authority if you believe your data has been processed unlawfully.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will revise the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after a change constitutes acceptance of the updated policy.

13. Contact Information