Privacy Policy

1. Data Controller

Sukhothai Law is the data controller for personal information collected through this website and in connection with our legal services. Our contact details are set out at the end of this Policy.

2. Information We Collect

We may collect and process the following categories of personal information:

• Identity and contact information — name, surname, email address, telephone number, and postal address provided when you contact us or complete a form on this website.
• Employment and pension-related information — details of your employment history, pension statements, and related documentation that you choose to share with us in the course of obtaining legal counsel.
• Correspondence records — records of communications between you and the firm, including emails, letters, and notes of telephone discussions.
• Website usage data — technical information collected automatically when you visit this website, such as your IP address, browser type, pages visited, and time of access. This information is collected through cookies and similar technologies; please see our Cookie Policy for further detail.

We do not knowingly collect information from individuals under the age of 20 without verifiable parental or guardian consent.

3. Lawful Basis for Processing

We process personal information only where we have a lawful basis to do so under the PDPA. The bases we rely on include:

• Contractual necessity — processing required to perform a legal services engagement you have entered into with us, or to take steps at your request before entering into such an engagement.
• Legitimate interests — processing necessary for our legitimate interests in managing our practice, improving our services, and maintaining the security of this website, where those interests are not overridden by your rights.
• Legal obligation — processing required to comply with our professional obligations and applicable Thai law.
• Consent — where we rely on your consent (for example, for certain cookies), you may withdraw that consent at any time without affecting the lawfulness of earlier processing.

4. How We Use Your Information

We use the personal information we hold about you to:

• Respond to enquiries and provide the legal services you have requested.
• Manage our client relationship, including scheduling appointments and issuing fee notes.
• Communicate with third parties (such as former employers or pension administrators) on your behalf, where you have instructed us to do so.
• Comply with our obligations under Thai law, including professional conduct rules applicable to legal practitioners.
• Operate and improve this website, including diagnosing technical issues and analysing aggregate usage patterns.
• Send service-related communications, such as appointment reminders, where these are necessary to the engagement.

We do not sell personal information to third parties, nor do we use it for automated decision-making that produces legal or similarly significant effects.

5. Disclosure of Information

We may share personal information with:

• Third parties acting on your instructions — such as former employers, pension authorities, or regulatory bodies, where disclosure is necessary to conduct your matter.
• Service providers — trusted third-party suppliers who assist with website hosting, analytics, or communication services. These providers are contractually bound to process information only on our instructions and to maintain appropriate security.
• Professional advisers — legal counsel, accountants, or other advisers where necessary for the operation of our practice.
• Authorities — where required to do so by law, court order, or the directions of a competent regulatory authority.

We do not transfer personal information outside Thailand except where you have explicitly consented or where a transfer is necessary to conduct your legal matter and appropriate safeguards are in place.

6. Data Retention

We retain personal information for as long as is necessary to fulfil the purposes set out in this Policy and to comply with our professional and legal obligations. For client files, the standard retention period is seven years from the conclusion of the engagement, in line with professional record-keeping requirements. Website usage data collected through analytics tools is retained in accordance with the settings described in our Cookie Policy.

When personal information is no longer required, we dispose of it in a secure manner.

7. Security

We maintain reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction. These measures include restricted access to client files, encrypted transmission of data where practicable, and regular review of our security practices. No method of transmission over the internet is entirely without risk; we nonetheless take this obligation seriously and continue to review and improve our measures.

8. Your Rights

Under the PDPA, you have the following rights in relation to personal information we hold about you:

• Right of access — to obtain a copy of the personal information we hold about you.
• Right to rectification — to request correction of inaccurate or incomplete information.
• Right to erasure — to request deletion of personal information in certain circumstances, including where it is no longer necessary for the purpose for which it was collected.
• Right to restriction of processing — to request that we limit processing in certain circumstances.
• Right to data portability — to receive personal information you have provided to us in a structured, machine-readable format, where processing is based on consent or contract.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on your consent, to withdraw that consent at any time.

To exercise any of these rights, please contact us using the details below. We will respond within the timeframe required by applicable law. We may need to verify your identity before acting on a request.

9. Cookies

This website uses cookies and similar technologies. For full details of the cookies we use, their purpose, and how to manage your preferences, please see our Cookie Policy.

10. Links to Other Websites

This website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any external site you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page indicates when the current version was published. Where changes are material, we will make reasonable efforts to bring them to your attention.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data subject rights, please contact us at:

You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee (PDPC) if you believe your rights under the PDPA have not been observed.