Privacy Policy

01 Data Controller

Sanam Pact acts as the data controller for personal data collected through this website and in connection with our legal advisory services. Our contact details are as follows:

• Name: Sanam Pact
• Address: 105 Rama IV Road, Khlong Toei, Bangkok 10110, Thailand
• Telephone: +66 2 249 6738
• Email: [email protected]

Where we engage third-party service providers who process personal data on our behalf, those providers act as data processors and are bound by appropriate data processing agreements consistent with the PDPA.

02 Personal Data We Collect

Depending on how you interact with Sanam Pact, we may collect and process the following categories of personal data:

Contact and Enquiry Data

• Full name
• Email address
• Telephone number
• Company or organisation name (if applicable)
• Content of your enquiry or message

Technical and Usage Data

• IP address and approximate geolocation derived from it
• Browser type and version
• Operating system
• Pages visited and navigation sequence on this website
• Referral source (how you arrived at our website)
• Date and time of visits
• Cookie identifiers (see Section 11)

Communication Records

• Records of email correspondence with us
• Notes from telephone calls where made with your awareness

We do not collect sensitive personal data (as defined under Section 26 of the PDPA) through this website, such as health information, racial or ethnic origin, or biometric data. If sensitive data becomes necessary in the context of a legal engagement, we will seek explicit consent separately and handle it under enhanced safeguards.

03 How We Collect Data

We collect personal data through the following means:

• Contact forms — when you submit an enquiry or consultation request via our website
• Direct correspondence — when you email or telephone us
• Automatic collection — through cookies and analytics tools as you browse our website (see Section 11)
• Third-party referrals — where a referring party provides your contact details with your prior consent

We do not purchase personal data lists or acquire data from data brokers.

04 Legal Basis for Processing

Under the PDPA, we rely on the following lawful bases for processing your personal data:

• Consent (Section 19 PDPA) — for analytics cookies, marketing communications, and any processing not covered by other bases below. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Contractual necessity (Section 24(3) PDPA) — to respond to your enquiries and, where a legal engagement is entered into, to perform our services.
• Legitimate interests (Section 24(5) PDPA) — for the purposes of website security, fraud prevention, improving our services, and maintaining internal records, where such interests are not overridden by your rights and interests.
• Legal obligation (Section 24(6) PDPA) — where processing is required by applicable law, such as record-keeping obligations under the Accounting Act or legal professional regulations.

05 Purposes of Processing

We use the personal data we collect for the following purposes:

• Responding to enquiries and consultation requests submitted through our contact form or by email
• Providing legal advisory and compliance services where an engagement is established
• Managing our client relationships and maintaining matter records
• Sending service-related communications, including appointment confirmations or document requests
• Improving the content, navigation, and functionality of this website using aggregated analytics data
• Complying with our professional and legal obligations
• Administering and protecting our business operations

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects on individuals.

06 Disclosure to Third Parties

We do not sell personal data. We may share personal data with third parties only in the following circumstances:

• Service providers — including website hosting, email delivery, and analytics platform providers who process data on our behalf under appropriate contractual terms
• Professional advisors — such as accountants or IT support, where strictly necessary and subject to confidentiality obligations
• Regulatory authorities — where we are required by law or a competent authority to disclose information
• Counterparties in legal proceedings — where disclosure is necessary in connection with legal proceedings in which we are involved on your behalf, and only with your prior awareness

Any third-party service provider who receives personal data is required to handle it only for the stated purpose and in a manner consistent with this policy and the PDPA.

07 Retention Periods

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law and professional regulations. Our general retention practices are as follows:

• Enquiry records — 12 months from the date of the enquiry, or longer if a legal engagement follows
• Client matter files — 7 years from the conclusion of the matter, in line with standard legal professional practice and applicable statutory limitation periods
• Financial and billing records — as required under the Accounting Act and Revenue Code
• Website analytics data — retained in aggregated or pseudonymous form; individual-level data is not stored beyond 26 months
• Cookie consent records — 12 months from the date of consent

When the relevant retention period ends, personal data is securely deleted or anonymised.

08 International Data Transfers

Some of the third-party service providers we use, such as cloud hosting and analytics platforms, may process personal data outside Thailand. Where this occurs, we take steps to ensure that appropriate safeguards are in place in accordance with the requirements of Chapter 7 of the PDPA, including:

• Transfers to countries that the Personal Data Protection Committee has determined provide an adequate level of protection
• Where no adequacy decision exists, use of standard contractual clauses or other mechanisms approved under Thai law

You may request information about the specific safeguards in place for any international transfer by contacting us using the details in Section 14.

09 Security Measures

We maintain reasonable technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, or disclosure. These include:

• HTTPS encryption for all data transmitted via this website
• Access controls limiting personal data access to authorised personnel
• Regular review of our data handling practices
• Physical security measures at our Bangkok office premises

While we take reasonable precautions, no method of electronic transmission or storage is entirely without risk. In the event of a personal data breach that is likely to affect your rights and freedoms, we will notify you and the relevant authority in accordance with Section 37 of the PDPA.

10 Your Rights Under the PDPA

As a data subject under the PDPA, you have the following rights in relation to your personal data. We will respond to any valid request within 30 days of receipt.

Right to Access (Section 30)

You may request a copy of the personal data we hold about you and information about how it is being processed.

Right to Rectification (Section 35)

You may ask us to correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure (Section 33)

You may request deletion of your personal data in certain circumstances, such as where it is no longer necessary for the purpose for which it was collected and no overriding legal basis for retention applies.

Right to Restriction of Processing (Section 34)

You may request that we temporarily limit how we process your data while a dispute about its accuracy or our right to use it is being resolved.

Right to Data Portability (Section 31)

Where processing is based on consent or contract and is carried out by automated means, you may request that we provide your data in a structured, commonly used, machine-readable format.

Right to Object (Section 32)

You may object to processing based on legitimate interests. We will honour your objection unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent (Section 19)

Where processing is based on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of any processing carried out prior to withdrawal.

Right to Lodge a Complaint

If you believe your data rights have not been respected, you have the right to lodge a complaint with the Personal Data Protection Committee or the relevant competent authority in Thailand.

To exercise any of these rights, please contact us using the details provided in Section 14. We may need to verify your identity before processing a request.

11 Cookies and Tracking

This website uses cookies and similar technologies. A full description of the cookies we use, their purposes, and how to manage your preferences is set out in our Cookie Policy. In summary:

• Strictly necessary cookies are used for core website functionality and do not require consent
• Analytics cookies help us understand how visitors use our website; these are placed only with your consent
• Marketing cookies may be used to measure the effectiveness of promotional activity; these are placed only with your consent

You can adjust your cookie preferences at any time by accessing the cookie settings link in the footer of this website.

12 Minors

This website is directed at businesses and professionals and is not intended for use by individuals under the age of 20 (the age of majority in Thailand). We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data to us without appropriate parental or guardian consent, please contact us and we will take reasonable steps to remove that data promptly.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational circumstances. When material changes are made, we will update the revision date at the top of this document. We encourage you to review this page periodically. Continued use of our website following the posting of changes constitutes your acknowledgement of those changes.

Prior versions of this policy are available on request.

14 Contact and Complaints

If you have questions about this policy, wish to exercise your data rights, or have a concern about how your personal data has been handled, please contact us: