Privacy Policy

1. Introduction

Khao Counsel ("we", "us", "our") is a legal practice registered and operating in Bangkok, Thailand. We are committed to handling personal data responsibly and in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) (the "PDPA"). This Privacy Policy explains what personal data we collect, how we use it, and the rights available to individuals whose data we hold.

This Policy applies to personal data collected through our website at khaoacou.pro, by email correspondence, by telephone, and through our engagement with clients and prospective clients. It does not apply to data held in the context of a specific legal matter, which is governed by our engagement terms and applicable professional obligations.

Questions about this Policy may be sent to [email protected].

2. Data Controller

The data controller for personal data collected through this website and our general business activities is:

Khao Counsel
218 Sukhumvit Soi 24, Khlong Tan, Khlong Toei, Bangkok 10110, Thailand
Email: [email protected]
Phone: +66 2 392 4716

3. Personal Data We Collect

We collect the following categories of personal data:

• Identity data: name, job title, company name
• Contact data: email address, telephone number, business address
• Enquiry data: the content of messages submitted through our contact form or by email
• Technical data: IP address, browser type, pages visited, time spent on pages (collected through analytics cookies where consent is given)
• Communication data: records of correspondence between us

We do not collect sensitive personal data (such as health data, financial account details, or identification document numbers) through this website. Such data may be collected in the course of a specific legal engagement, under separate terms.

4. How We Collect Personal Data

• Contact forms: when you submit an enquiry through our website
• Direct correspondence: by email or telephone
• Cookies and analytics: automatically when you browse this website, subject to your cookie preferences
• Referrals: when a third party provides your contact details to us in connection with a potential instruction

5. Legal Basis for Processing

We process personal data on the following legal bases under the PDPA:

• Consent: where you have provided consent, for example by accepting analytics cookies
• Contractual necessity: where processing is necessary for the performance of or entry into a contract with you
• Legitimate interest: where processing is necessary for our legitimate business interests, such as responding to enquiries, maintaining business records, and improving our services — provided those interests are not outweighed by your rights
• Legal obligation: where we are required to process data to comply with applicable law

6. How We Use Personal Data

• To respond to enquiries submitted through our website or by other means
• To assess whether we are able to assist with a legal matter and to communicate our position
• To manage and maintain our client and contact records
• To send relevant information about our services where you have requested or consented to this
• To comply with legal and regulatory obligations, including professional obligations under Thai law
• To improve the functionality and content of this website, where analytics consent has been given

7. Data Retention

We retain personal data for as long as is necessary for the purpose for which it was collected, and in accordance with applicable legal requirements:

• Enquiry records: up to 2 years from the date of the enquiry, unless an engagement follows
• Client records arising from an engagement: 7 years from the close of the matter, in accordance with Thai civil limitation periods and professional record-keeping obligations
• Analytics data: in accordance with the retention periods of the analytics service used (typically 26 months)

Where personal data is no longer required, we delete or anonymise it.

8. Data Sharing

We do not sell personal data. We may share personal data in the following limited circumstances:

• With connected overseas counsel: where a cross-border matter requires coordination, and only to the extent necessary and with appropriate confidentiality undertakings
• With service providers: such as email hosting and website analytics providers, operating under data processing agreements
• With regulatory authorities: where required by law or professional regulation

We do not share personal data for marketing purposes with third parties.

9. Data Security

We maintain technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted email and document storage
• Access controls limiting data to personnel who require it
• Regular review of data security practices
• Staff awareness of data protection obligations

In the event of a personal data breach affecting your rights, we will notify the Office of the Personal Data Protection Committee (PDPC) and affected individuals in accordance with the PDPA's notification requirements.

10. Cookies

This website uses cookies. Please see our Cookie Policy for a full explanation of the cookies we use, their purposes, and how to manage your preferences. Essential cookies necessary for the website to function are placed without requiring consent. Analytics and preference cookies require your consent.

11. Your Rights Under the PDPA

As a data subject under the PDPA, you have the following rights:

• Right to access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate or incomplete data
• Right to erasure: to request deletion of personal data where there is no longer a lawful basis for processing
• Right to restriction: to request that we limit processing in certain circumstances
• Right to data portability: to receive personal data in a structured, machine-readable format where processing is based on consent or contract
• Right to object: to object to processing based on legitimate interest
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint: with the Office of the Personal Data Protection Committee (PDPC), the supervisory authority in Thailand

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

12. Third-Party Links

This website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their respective privacy policies before providing any personal data.

13. Children's Privacy

Our services are directed to businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted personal data through this website, please contact us and we will take steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The date of the most recent revision is shown at the top of this page. Where changes are material, we will take reasonable steps to notify affected individuals. Continued use of this website after a revised Policy has been posted constitutes acceptance of the updated terms.

15. Contact

For questions about this Privacy Policy or about how we handle your personal data, please contact:

Khao Counsel — Data Privacy
218 Sukhumvit Soi 24, Khlong Tan, Khlong Toei
Bangkok 10110, Thailand
Email: [email protected]
Phone: +66 2 392 4716