Privacy Policy

1. Introduction

Khaolak Counsel ("the firm", "we", "our") is a legal practice based in Bangkok, Thailand, specialising in franchise and distribution law. This Privacy Policy explains how we collect, use, store, and protect personal information submitted through our website or provided in connection with an inquiry or engagement.

This policy applies to visitors to our website and to individuals who submit field inquiries through our contact form. It does not govern data processed under a separate engagement letter, which may include additional confidentiality and data handling terms.

Questions about this policy may be addressed to [email protected].

2. Information We Collect

We collect the following categories of personal information:

• Inquiry form submissions: name, email address, telephone number (optional), and the content of the message submitted.
• Correspondence: email and other communications sent to the firm directly.
• Website usage data: IP address, browser type, pages visited, and session duration, collected through analytics tools where consent is given.
• Cookies: as described in our Cookie Policy.

We do not knowingly collect personal information from individuals under 18 years of age. Our services are directed to commercial and professional clients.

3. Legal Basis for Processing

We process personal information on the following legal bases under the Personal Data Protection Act B.E. 2562 (PDPA) of Thailand:

• Consent: for analytics cookies and optional marketing communications, where you have provided explicit consent.
• Legitimate interests: for responding to inquiries and improving the website, where our interests are not overridden by your rights.
• Contract: for processing information necessary to fulfil an engagement or pre-engagement steps at your request.
• Legal obligation: where processing is required by applicable Thai law or professional regulatory requirements.

4. How We Use Your Information

• To respond to field inquiries and assess whether and how the firm can assist
• To communicate with you regarding the scope and terms of an engagement
• To fulfil our obligations under an engagement agreement
• To comply with professional conduct obligations, including conflict-check requirements
• To understand website usage patterns and improve the site, where consent is given
• To send occasional updates relevant to franchise and distribution law practice in Thailand, where you have opted in

We do not sell, rent, or share personal information with third parties for their own marketing purposes.

5. Data Retention

Inquiry information is retained for up to three years from the date of the inquiry or the end of an engagement, whichever is later, to enable us to respond to follow-up questions and to comply with professional record-keeping obligations. Analytics data is retained in aggregated form for up to 26 months. You may request deletion at any time as described in Section 7.

6. Third-Party Services

We may use the following categories of third-party service providers, each subject to their own privacy terms:

• Website hosting and infrastructure providers located in Singapore or the European Economic Area
• Analytics providers (only where cookie consent is given)
• Email delivery services for correspondence management

We do not transfer personal data outside of Thailand or the EEA without appropriate safeguards in place. For cross-border transfers, standard contractual clauses or equivalent mechanisms are used.

7. Your Rights Under the PDPA

Under the Personal Data Protection Act B.E. 2562 (Thailand), you have the following rights:

• Right of access: to obtain confirmation of whether we hold your personal data and a copy of it.
• Right to rectification: to correct inaccurate or incomplete personal data.
• Right to erasure: to request deletion of your personal data where retention is no longer necessary or lawful.
• Right to restriction: to request that we limit processing in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format where technically feasible.
• Right to object: to processing based on legitimate interests.
• Right to withdraw consent: at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, write to [email protected]. We will respond within thirty days. You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (Thailand).

8. Cookies

Our website uses essential cookies for basic functionality and, where consent is given, analytics cookies to understand how the site is used. Full details are available in our Cookie Policy.

9. Data Protection Measures

We maintain reasonable technical and organisational measures to protect personal information against unauthorised access, loss, and disclosure. These include encrypted data transmission (HTTPS), access controls limiting who within the firm can access personal data, and secure email handling procedures. In the event of a data breach affecting your rights, we will notify you and the relevant supervisory authority as required by applicable law.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before submitting personal information to them.

11. Changes to This Policy

We may update this policy from time to time to reflect changes in law, practice, or our operations. The date at the top of this page indicates when the policy was last revised. Material changes will be communicated by updating the date and, where appropriate, by notice on the website.

12. Contact

Data protection inquiries should be directed to: