Privacy Policy

1. Introduction

Sutthi ("we", "us", "our") takes the handling of personal data seriously. This policy explains what information we collect, how we use it, how long we keep it, and what rights you have in relation to it.

This policy applies to personal data collected through our website at sutthi.sbs and through direct contact with our practice. It is written in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).

If you have questions about this policy or your data, contact us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact information — name, email address, telephone number provided through our contact form or by email or phone.
• Matter-related information — details about your pension situation shared during consultations or in correspondence, including documents you provide.
• Website usage data — anonymised data about how our website is used, collected via cookies where you have consented.

Legal basis: We process contact data on the basis of your consent (when submitting our form) or legitimate interest (when you contact us directly). Matter-related data is processed on the basis of the contract between you and the practice, or to take steps at your request prior to entering such a contract.

3. How We Use Your Data

• To respond to your enquiry and arrange consultations
• To provide the legal services you have engaged us for
• To send you updates on your matter and any documents for review or signature
• To comply with legal obligations placed on the practice
• To improve our website based on anonymised usage data (with your cookie consent)

We do not use your data for marketing purposes without your explicit consent, and we do not sell, rent, or trade your personal data to third parties.

4. Data Sharing

We share personal data only in the following circumstances:

• With your instruction — when you ask us to contact or submit documents to a government body, authority, or the other party in your matter.
• Legal obligation — if required to do so by a court order or applicable law.
• Service providers — trusted third-party services that support our website (such as hosting and analytics), bound by data processing agreements.

5. Data Retention

We retain personal data for the following periods:

• Enquiries that did not result in a service engagement: up to 12 months
• Files relating to a completed legal matter: 7 years, in accordance with Thai legal record-keeping requirements
• Website usage data (anonymised): up to 24 months

After the applicable retention period, data is securely deleted or anonymised.

6. Data Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, or loss. These include:

• Encrypted transmission of data via HTTPS
• Access controls limiting who within the practice can view client files
• Secure storage of physical documents within the office
• Procedures for identifying and reporting data breaches

7. Cookies

We use cookies on our website for essential functionality and, where you have consented, for analytics purposes. For detailed information and to manage your preferences, see our Cookie Policy.

8. Your Rights Under Thai PDPA

Under Thailand's Personal Data Protection Act, you have the following rights in relation to your personal data:

• Right to access — to request a copy of the data we hold about you
• Right to rectification — to ask us to correct inaccurate data
• Right to erasure — to ask us to delete data in certain circumstances
• Right to restrict processing — to ask us to limit how we use your data
• Right to data portability — to receive your data in a structured format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend you read their policies before submitting any personal information.

10. Children

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us and we will delete it promptly.

11. Policy Updates

We may update this policy from time to time. When we do, the revised version will be posted on this page with an updated date. If changes are material, we will notify active clients by email.

12. Contact

For questions about this policy or to exercise your data rights:

Sutthi Legal Practice
38 Surawong Road, Bang Rak, Bangkok 10500, Thailand
Email: [email protected]
Phone: +66 2 233 7460