Legal

Privacy Policy

Ratana Law  |  Last Updated: 15 May 2025  |  Effective: 15 May 2025

1. About This Policy

This Privacy Policy applies to all personal data processed by Ratana Law ("we", "us", "our"), a legal services firm registered and operating in Bangkok, Thailand. It covers our website at ratanalal.cyou and all services we provide to clients.

If you have questions about this policy, please contact us at [email protected] before providing us with any personal information.

2. Data We Collect

Information you provide directly

• Name and contact details (email address, telephone number)
• Postal address
• Details of your pension situation or legal matter, as shared in enquiry forms or correspondence
• Documents you choose to share with us for the purpose of a legal review

Information collected automatically

• Browser type and version, operating system
• IP address (anonymised where possible)
• Pages visited and time spent on the site
• Referral source

Legal basis for processing

We process your personal data on the following legal bases under the PDPA: consent (for marketing and optional cookies); performance of a contract or pre-contractual steps (for client service delivery); legitimate interests (for website analytics and security); and legal obligation (for regulatory compliance and professional conduct requirements).

3. How We Use Your Data

• To respond to your enquiry and, where agreed, to provide legal services
• To send you updates relevant to your matter
• To prepare correspondence, submissions, and documentation on your behalf
• To maintain records required under our professional and regulatory obligations
• To improve our website and understand how visitors use it (analytics only, with appropriate consent)
• To comply with anti-money laundering and other legal obligations applicable to Thai legal practices

We do not use your personal data for unsolicited marketing. If you agree to receive updates from us, you may withdraw that consent at any time by emailing [email protected].

4. Data Sharing

We do not sell your personal data. We may share your information only in the following limited circumstances:

• With pension authorities, government bodies, or administrative tribunals, where necessary and authorised by you, to progress your legal matter
• With professional advisors (e.g. barristers or specialist consultants) engaged with your knowledge and consent to assist with your matter
• With IT and website service providers under appropriate data processing agreements
• Where required by Thai law, court order, or regulatory authority

Any third-party providers we use are required to handle your data in accordance with applicable law and under contractual obligations of confidentiality.

5. Data Retention

We retain client files for a minimum of seven years following the conclusion of a matter, in accordance with our professional obligations and the applicable statute of limitations under Thai law. Website enquiry data from non-clients is retained for no longer than 24 months. Cookie and analytics data is retained for the periods described in our Cookie Policy.

6. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted email communication, secure file storage, and restricted access controls within our practice.

In the event of a data breach that poses a risk to your rights, we will notify you and the relevant Thai supervisory authority (the Personal Data Protection Committee) within the timeframes required by the PDPA.

7. Cookies

Our website uses cookies to support basic functionality and, where consented to, to understand how visitors use the site. Please see our Cookie Policy for a full explanation, including how to manage your preferences.

8. Your Rights Under the PDPA

As a data subject under Thailand's Personal Data Protection Act, you have the following rights:

• Right to be informed: to know how your data is being used (this policy fulfils that obligation)
• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to ask us to correct inaccurate data
• Right to erasure: to request deletion of your data, subject to our legal retention obligations
• Right to portability: to receive your data in a portable format where technically feasible
• Right to object: to object to processing based on legitimate interests
• Right to withdraw consent: at any time, for processing based on consent
• Right to lodge a complaint: with the Personal Data Protection Committee (PDPC) of Thailand

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Third-Party Links

Our website may include links to external resources or referenced organisations. We are not responsible for the privacy practices of those third parties and encourage you to review their policies before sharing any personal information with them.

10. Children's Privacy

Our services are intended for persons aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we hold data from a minor, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time to reflect changes in our practice or in applicable law. The updated policy will be published on this page with a revised "Last Updated" date. We encourage you to review it periodically.

12. Contact Us

For any questions, requests, or concerns about this policy or how we handle your personal data, please contact: