Privacy Policy

1. Data We Collect

We collect the following categories of personal data:

• Contact information: name, email address, telephone number, submitted through our website contact form or direct communication.
• Message content: information you choose to share when describing your matter in the contact form.
• Technical data: IP address, browser type, pages visited, session duration — collected via analytics cookies where you have consented.
• Cookie preferences: your consent choices stored locally in your browser.

We do not collect sensitive personal data (such as financial account information, health data, or government identification) through our website.

2. Legal Basis for Processing

We process personal data on the following bases under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and, where applicable, the EU General Data Protection Regulation (GDPR):

• Consent: For marketing communications and analytics cookies, we rely on your explicit consent.
• Contractual necessity: To respond to enquiries and deliver advisory services you have engaged us for.
• Legitimate interests: To maintain the security and functionality of our website, and to understand how it is used.
• Legal obligation: Where required by Thai law or professional regulatory requirements.

3. How We Use Personal Data

• To respond to your enquiry and communicate about your legal matter
• To deliver advisory services and produce engagement deliverables
• To send service-related updates (not marketing, unless separately consented)
• To maintain and improve our website using aggregated analytics
• To comply with professional and legal obligations

We do not sell, rent, or trade personal data to third parties for their own marketing purposes.

4. Data Retention

We retain personal data for the following periods:

• Enquiry data (no engagement entered): 12 months from last contact
• Client engagement data: 7 years from the close of the engagement, in line with Thai professional obligations
• Analytics data: Up to 26 months from collection, in aggregated form
• Cookie preferences: Until you clear them or 12 months, whichever is shorter

5. Data Sharing

We share personal data only in the following circumstances:

• Service providers: Website hosting, email services, and analytics platforms acting as data processors under appropriate agreements.
• Legal requirements: Where disclosure is required by Thai law, court order, or regulatory authority.
• Professional referrals: With your explicit consent, where your matter requires specialist input beyond our scope.

Third-party processors we may use include Google Analytics (analytics), and email hosting services. These providers are bound by confidentiality and data processing terms.

6. Data Protection Measures

We apply the following measures to protect personal data:

• HTTPS encryption for all data transmitted through our website
• Access controls limiting data to those with a need to process it
• Regular review of systems and data handling procedures
• Breach notification procedures: if a data breach occurs, we will notify affected individuals and relevant authorities as required under the PDPA

7. Cookies

We use cookies to support website functionality and, with your consent, to analyse how the site is used. For detailed information, see our Cookie Policy.

8. Your Rights

Under Thailand's PDPA (and GDPR where applicable), you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Ask us to correct inaccurate or incomplete data
• Erasure: Request deletion of your data, subject to legal retention obligations
• Data portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent at any time where processing is consent-based, without affecting prior processing
• Complaint: Lodge a complaint with Thailand's Personal Data Protection Committee or, for EU residents, your local supervisory authority

To exercise any of these rights, contact us at privacy@nitichaoes. We will respond within 30 days.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

10. Children's Privacy

Our services are directed at businesses and adults aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that a minor has submitted data, we will delete it promptly.

11. International Transfers

Where personal data is transferred outside Thailand (for example, to cloud hosting providers), we ensure such transfers are subject to appropriate safeguards consistent with the PDPA's requirements for cross-border transfers.

12. Policy Updates

We may update this policy from time to time. Material changes will be noted on this page with a revised "Last Updated" date. Continued use of our website after changes constitutes acceptance of the updated policy.

13. Contact

Data controller: Niti Chao Legal Advisory
Address: 9/3 Soi Langsuan, Ploenchit Road, Lumpini, Pathum Wan, Bangkok 10330, Thailand
Email: privacy@nitichaoes
Telephone: +66 2 655 3284