Privacy Policy

This Privacy Policy explains how Thai Legal Protection (“we”, “us”) collects, uses, discloses and protects your personal data, in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (PDPA).

1. Data controller

Thai Legal Protection (7th Floor, Sindhorn Tower 1, 130, 132 Witthayu Rd, Lumphini, Pathum Wan, Bangkok 10330) is the controller of your personal data. For any question about this policy or to exercise your rights, contact our Data Protection Officer (DPO) at info@thailegalprotection.com.

2. Data we collect

• Account data: full name, email, phone number, nationality.
• Case data: details of your matter, documents and files you upload, messages with your lawyer.
• Payment data: payment history (we never store card numbers — payments are handled by Stripe).
• Technical data: essential cookies and login/security information.
• Device data: the push-notification token of your mobile device, when you turn on notifications.
• Linked accounts: when you choose to sign in with Google, the link to that Google account and its basic profile (name, email).
• Will and Living Will service data: when you use our document-preparation service, we collect what you enter in the form — identity details, family and children information, your executor and beneficiaries (third-party data you provide), assets and debts, and funeral wishes — and any images of asset documents you choose to attach (such as title deeds or bank books), which are stored encrypted and visible only to the reviewing consultant as reference material. For a Living Will this also includes your health-care directives (health data) and religious or spiritual wishes, which are sensitive data under PDPA Section 26 — we collect these only with your explicit consent, store them encrypted, and restrict access to the lawyer handling your matter.

3. Purposes & legal basis

• To provide our legal services and manage your account (contract).
• To route your matter to TSL, our appointed legal service provider (contract).
• To process payments and issue receipts (contract / legal obligation).
• To send marketing communications, only where you have opted in (consent).
• To keep the service secure and prevent fraud (legitimate interest).

4. Disclosure

We share data, only as necessary, with: TSL & Associate (Thailand) Co., Ltd. (TSL), our appointed legal service provider that handles your matter, our payment processor (Stripe), our email provider (Resend), our push-notification and sign-in provider (Google/Firebase), and government authorities where legally required. We do not sell your personal data.

5. International data transfers

Some of our providers are located overseas — Stripe (payment processing), Resend (email), and Google/Firebase (push notifications and Google Sign-In) — so your personal data may be transferred abroad. We do this under appropriate safeguards as required by the PDPA, such as Data Processing Agreements with those providers, so your data keeps an adequate level of protection.

6. Data retention

We keep your data while your account is active. Files and documents uploaded to a case (yours and the lawyer's) are permanently deleted within about 30 days after the case is closed, except a delivered will document, which is kept under the will-service terms below. The case record itself (status, correspondence and history) is retained while your account is active so you can view your own history. When your account is closed or you exercise your right to erasure, your identifiers on the platform are anonymised, and the legal team retains the case record only as necessary — for no longer than 10 years — for the establishment, exercise or defence of legal claims. Some data we are required by law to keep (e.g. financial and tax records) is retained for the period the law requires.

Will / Living Will service data is kept for as long as your account is active, so you can come back and request changes to your document. When your account is closed or you exercise your right to erasure, this data is deleted within 30 days, except what we must retain — for no longer than 10 years — for the establishment, exercise or defence of legal claims.

7. Your rights under the PDPA

You have the following rights, which you can exercise by contacting our DPO:

• Right to access and obtain a copy of your data.
• Right to rectification.
• Right to erasure.
• Right to data portability.
• Right to object to or restrict processing.
• Right to withdraw consent at any time.

8. Cookies

We use cookies that are essential to the service, such as keeping you signed in and remembering your language. See the cookie notice on the site for details.

9. Security

We apply appropriate safeguards, including encrypted connections, access controls, and storing document files so only authorised parties can access them.

10. Changes to this policy

We may update this policy from time to time; the latest update date is shown above.