Privacy Policy

1. Introduction

Garuda Advocates ("the Firm", "we", "us") is committed to handling personal data with care and in accordance with applicable Thai law, including the Personal Data Protection Act B.E. 2562 (PDPA). This policy explains what personal data we collect, how we use it, how we protect it, and what rights you have over it.

This policy applies to data collected through our website at garudaad.pro, through our contact forms, and in the course of providing legal services. For questions, contact us at [email protected].

2. Personal Data We Collect

We collect personal data in the following categories:

• Contact data: name, email address, telephone number, as submitted through our website contact form or by direct communication.
• Matter-related data: information about your legal matter that you share with us during consultations or engagements. This is subject to legal professional privilege.
• Usage data: IP address, browser type, pages visited, and session duration, collected via analytics cookies (where consented).

Legal basis for processing: We process contact data on the basis of your consent (when you submit our form) or our legitimate interest in responding to enquiries. Matter-related data is processed on the basis of contractual necessity. Analytics data is processed only with your cookie consent.

Retention: Contact enquiry data is held for 12 months. Matter-related data is held for 7 years following the close of an engagement, in accordance with professional obligations.

3. How We Use Your Data

• To respond to your enquiries and provide the services you have requested
• To conduct and manage your legal matter, where an engagement is agreed
• To comply with our professional obligations and applicable law
• To analyse and improve our website, where analytics cookies are consented to
• To send service-related communications (not marketing) relevant to your matter

We do not sell personal data to third parties. We do not send unsolicited marketing communications. We share data only as necessary to conduct your matter (for example, with correspondent law firms where jurisdictional coordination is required), and only with your knowledge.

4. Data Protection Measures

• All data transmitted via our website is encrypted using TLS
• Client files are stored on secure, access-controlled systems
• Access to client data is restricted to members of your engagement team
• All staff sign confidentiality agreements and receive annual data protection training
• In the event of a data breach, affected individuals will be notified within 72 hours in accordance with PDPA requirements

5. Cookies

Our website uses cookies. Essential cookies are required for the site to function. Optional analytics and preference cookies are only set with your explicit consent. You may manage your cookie preferences at any time via our Cookie Policy page.

6. Your Rights Under the PDPA

Under Thailand's Personal Data Protection Act, you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data, subject to our legal retention obligations.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Withdraw any consent previously given at any time.

To exercise any right, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Personal Data Protection Committee of Thailand if you believe your rights have not been respected.

7. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

8. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted data through our website, please contact us at [email protected] so we may delete it.

9. Updates to This Policy

We may update this policy from time to time. Material changes will be notified on this page with a revised effective date. Continued use of our website after changes are published constitutes acceptance of the revised policy.

10. Contact

For any privacy-related enquiry, please contact: