Privacy Policy

2. Information We Collect

We may collect the following information:

• Enquiry data: Name, email address, phone number and details of your legal matter submitted via our contact form or sent by WhatsApp or email.
• Account data: If you create an account or use a client portal, we hold your login email address, an encrypted password, your profile preferences and any documents you upload in connection with your matter.
• Insurance quote data: If you request a health insurance quote, we collect the contact and cover details you submit so that a quote can be prepared for you.
• Usage data: IP address, browser type, device information and pages visited, collected automatically via server logs and — only where you have consented — analytics cookies.

3. How We Use Your Information and Our Legal Basis

The Thai Personal Data Protection Act B.E. 2562 (PDPA) requires us to identify a lawful basis for each use of your personal data. The table below sets out what we do with your data and the legal basis under Section 24 of the PDPA (or Section 26 for sensitive data):

4. Sensitive Personal Data

Legal matters frequently involve sensitive categories of personal data as defined by Section 26 of the PDPA — including information about health, criminal records, family status and financial circumstances. We process such data only:

• With your explicit consent, given at the time you share the information with us for the purpose of obtaining legal advice or representation; or
• Where processing is necessary for the establishment, exercise or defence of legal claims.

You are never required to share sensitive information before you choose to instruct us. Sensitive data you share in connection with a matter is treated as legally privileged and confidential, and is not disclosed to third parties except where required to conduct your matter or where required by law.

5. Legal Professional Confidentiality

Information you share with us about a legal matter is treated as confidential. We will not disclose the details of your enquiry or any legal matter to third parties except where required by law or with your express consent.

6. Cookies & Analytics

We use essential cookies to operate the site. We also use Google Analytics to understand how visitors use it, but only if you click "Accept" on our cookie banner. We do not use advertising or third-party tracking cookies. See our Cookie Policy for full details, including the specific cookies used and how to change your choice.

7. Third-Party Services

We use the following third-party service providers, who process personal data on our behalf or under their own terms:

• Google Analytics (Google LLC): Website traffic analysis. IP addresses are anonymised and analytics cookies are only set where you have consented.
• YouTube / Google: Video content is embedded in privacy-enhanced mode (youtube-nocookie.com); YouTube does not set cookies unless you play a video.
• WhatsApp (Meta): If you contact us via WhatsApp, your messages are processed under Meta's terms of service.
• MongoDB Atlas: Secure cloud database storage for enquiries, account data and matter records.
• Resend: Transactional email delivery — used to send and route enquiry and notification emails.
• Vercel: Website hosting. Vercel processes IP addresses and request logs to serve and secure the site.
• Pacific Cross Health Insurance: If — and only if — you submit a health insurance quote request, the contact and cover details you provide are shared with Pacific Cross so they can prepare your quote.

We do not sell your personal data to any third party.

8. International Data Transfers

We are based in Thailand, and your data is primarily processed here. Some of our service providers (for example Google, MongoDB Atlas, Resend and Vercel) store or process data on servers outside Thailand, including in the United States and the European Union.

Where personal data is transferred across borders, we rely on the safeguards required by the Thai Personal Data Protection Act B.E. 2562 (PDPA) and, where the UK or EU GDPR applies, on an adequacy decision or the provider's Standard Contractual Clauses.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Personal Data Protection Committee (PDPC) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by Section 37(4) of the PDPA. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

To report a suspected data security issue, please contact us immediately at info@lawyersforexpatsthailand.com.

10. Your Rights

Depending on where you are located, you have rights over your personal data:

• Thailand (PDPA): rights of access, rectification, erasure, restriction, objection, data portability and withdrawal of consent. You may lodge a complaint with the Personal Data Protection Committee (PDPC).
• United Kingdom (UK GDPR / Data Protection Act 2018): the equivalent rights, with the right to complain to the Information Commissioner's Office (ICO).
• European Union / EEA (EU GDPR): the equivalent rights, with the right to complain to your national supervisory authority.

Where our processing is based on your consent, you can withdraw that consent at any time without affecting processing already carried out. To exercise any of these rights, contact us at info@lawyersforexpatsthailand.com.

11. Data Retention

We keep personal data only for as long as it is needed:

• Enquiries that do not become instructions: typically up to 24 months, then deleted.
• Client and matter records: retained for the duration of the engagement and afterwards for the period required by Thai law and our professional obligations (generally at least 10 years).
• Account data: retained while your account is active and deleted on request or after a prolonged period of inactivity.
• Website analytics: retained in line with Google Analytics' configured retention period.

12. Contact

Questions about this Privacy Policy should be sent to info@lawyersforexpatsthailand.com or via our Contact Page.