Legal
Privacy Policy
Last updated: 10 June 2026
Thiti ("we", "us", "our") is committed to handling personal data responsibly and transparently. This policy explains what data we collect, how we use it, and what rights you have under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). Please read it before submitting personal information through our website or engaging our services.
1. Data Controller
The data controller is Thiti, located at 22 Ratchadaphisek Road, Din Daeng, Bangkok 10400, Thailand. For data-related enquiries, contact us at [email protected].
2. Data We Collect
We may collect the following categories of personal data:
- Identity data: Full name, as provided through our contact form or in correspondence.
- Contact data: Email address, telephone number, postal address where provided.
- Case-related data: Personal information shared in connection with a pension legal matter, which may include employment history, pension statements, and government-issued identification.
- Technical data: IP address, browser type, pages visited, and session duration collected automatically via cookies and analytics tools.
- Communication data: Records of email or telephone correspondence with our team.
3. Legal Basis for Processing
We process personal data on the following legal bases under the PDPA:
- Contractual necessity: To deliver legal services you have engaged us for.
- Legitimate interests: To respond to enquiries, maintain records, and improve our services.
- Consent: For non-essential cookies and any optional communications. You may withdraw consent at any time.
- Legal obligation: Where we are required by law to retain or disclose information.
4. How We Use Personal Data
Personal data is used for the following purposes:
- Responding to initial enquiries and scheduling consultations
- Delivering the legal service you have requested
- Preparing legal documentation, submissions, and correspondence on your behalf
- Maintaining records of our engagement as required by professional obligations
- Improving the functionality and content of our website (via analytics)
We do not use personal data for unsolicited marketing. We do not sell personal data to third parties.
5. Data Sharing
We share personal data only where necessary:
- Relevant authorities: Where required to submit documents or engage in proceedings on your behalf, and only with your knowledge.
- Service providers: Including secure hosting and email delivery services operating under data processing agreements.
- Legal or regulatory requirement: Where disclosure is required by Thai law or an order of a court or competent authority.
6. Data Retention
Client matter files are retained for a minimum of five years following the conclusion of an engagement, in accordance with professional obligations. Website enquiry data not resulting in an engagement is retained for up to twelve months. Technical/analytics data is retained for up to twenty-four months. Upon expiry of these periods, data is securely deleted or anonymised.
7. Data Protection Measures
We maintain the following security measures:
- TLS encryption for all data transmitted via our website
- Access controls limiting data access to authorised team members only
- Secure storage of physical and digital case files
- Periodic review of data handling practices
In the event of a personal data breach affecting your rights and freedoms, we will notify you and the PDPA supervisory authority within the timescales required by law.
8. Cookies
We use essential cookies to operate the website, and optional analytics cookies to understand how the site is used. You can manage your cookie preferences at any time via our Cookie Policy page.
9. Your Rights
Under the PDPA, you have the following rights in relation to your personal data:
- Access: To request a copy of the personal data we hold about you.
- Rectification: To request correction of inaccurate data.
- Erasure: To request deletion of your data, subject to legal retention obligations.
- Portability: To receive data in a structured, machine-readable format where applicable.
- Objection: To object to processing based on legitimate interests.
- Withdrawal of consent: To withdraw consent at any time without affecting the lawfulness of prior processing.
- Complaint: To lodge a complaint with the Personal Data Protection Committee of Thailand.
To exercise any of these rights, contact us at [email protected]. We will respond within thirty days.
10. Third-Party Links
Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their policies independently.
11. Children's Privacy
Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe we have inadvertently done so, please contact us and we will promptly delete the information.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated by updating the "Last Updated" date at the top of this page. Continued use of our website following changes constitutes acceptance of the revised policy.
13. Contact
For any questions about this policy or your personal data:
Thiti
22 Ratchadaphisek Road, Din Daeng, Bangkok 10400, Thailand