Privacy Policy

1. Data Controller

The data controller for the purposes of this policy is Garuda Helm, located at 55/2 Charoenkrung Road, Bangrak, Bangkok 10500, Thailand. You may contact us regarding data matters at info@{{DOMAIN_NAME}} or by telephone at +66 2 630 9472.

2. Applicable Law

This policy has been prepared with reference to Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA), which governs the collection, use, and disclosure of personal data by organisations operating in Thailand. Where clients or visitors are located in the European Economic Area, the General Data Protection Regulation (GDPR) may also apply. We apply the higher of the two standards where they differ.

3. Data We Collect

Information you provide to us

• Contact information: name, email address, telephone number
• Enquiry details submitted via our website contact form
• Documents and personal information provided in the course of engaging our services (including identity documents, asset details, beneficiary information, and other succession-related materials)
• Correspondence by email, post, or telephone

Information collected automatically

• Device and browser information (IP address, browser type, operating system)
• Pages visited, time on site, and referral source — collected via analytics tools with your consent
• Cookie identifiers where you have consented to non-essential cookies (see our Cookie Policy)

4. Legal Bases for Processing

We process personal data on the following bases:

• Contract performance: to provide legal services you have engaged us for
• Legitimate interests: to respond to enquiries, maintain client records, and operate this website
• Legal obligation: to comply with Thai law, including professional and regulatory requirements applicable to law practices
• Consent: for non-essential cookies and analytics; where consent is the basis, you may withdraw it at any time

5. How We Use Your Data

• Responding to enquiries and providing information about our services
• Preparing and delivering legal documents and advice under a service engagement
• Complying with our professional obligations as a regulated law practice
• Maintaining records required by Thai law
• Improving this website using aggregated, anonymised analytics data
• Sending service-related communications where you are an active or former client

We do not use personal data for automated profiling or automated decision-making that produces legal or significant effects.

6. Disclosure of Data

We do not sell, rent, or trade personal data to third parties. We may share data in the following limited circumstances:

• With your consent: for example, coordinating with foreign counsel where you have engaged us for cross-border estate planning
• Service providers: trusted third parties that support website operation, IT infrastructure, or communications, under appropriate data processing agreements
• Legal requirement: where disclosure is required by Thai law, court order, or regulatory authority

Where data is transferred outside Thailand, we apply safeguards consistent with PDPA requirements and, where applicable, GDPR Chapter V standards.

7. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law. As a general rule:

• Enquiry records not resulting in an engagement: 12 months
• Client files and associated documents: 10 years from conclusion of engagement, in accordance with professional record-keeping obligations under Thai law
• Website analytics data: 26 months in aggregated form, then deleted
• Cookie consent records: 13 months

8. Your Rights

Under the PDPA (and GDPR where applicable), you have the following rights in relation to your personal data:

• Access: to receive a copy of the personal data we hold about you
• Rectification: to request correction of inaccurate or incomplete data
• Erasure: to request deletion of your data, subject to our legal obligations to retain certain records
• Restriction: to request that we limit processing of your data in certain circumstances
• Portability: to receive your data in a structured, machine-readable format where processing is based on consent or contract
• Objection: to object to processing based on legitimate interests
• Withdrawal of consent: where processing is based on consent, to withdraw it at any time without affecting prior lawful processing

To exercise any of these rights, please contact us at info@{{DOMAIN_NAME}}. We will respond within 30 days. No fee applies for reasonable requests.

9. Security

We maintain technical and organisational security measures appropriate to the nature of the data we process. These include access controls, encrypted transmission for website data, and restricted access to client files. No transmission over the internet can be guaranteed fully secure, and we encourage you to take reasonable precautions when sharing sensitive information electronically.

10. Cookies

This website uses cookies. Essential cookies are necessary for the site to function and do not require consent. Analytics and marketing cookies are placed only with your consent, which you may manage at any time via the cookie settings on this site. For full details, see our Cookie Policy.

11. Third-Party Services

This website may use third-party services including Google Analytics, Google Maps, and advertising platforms. These services operate under their own privacy policies. We configure them to minimise data collection consistent with their terms and our obligations under the PDPA.

12. Children

This website is not directed at persons under the age of 20 (the age of majority in Thailand). We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this policy from time to time. The current version will always be available on this page with the date of last update noted at the top. Material changes will be notified to active clients by email where practicable.

14. Complaints

If you have concerns about how we handle your personal data and we have not resolved them to your satisfaction, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand, or with your local supervisory authority if you are located in a jurisdiction with an applicable regulatory body.