Privacy Policy

1. Introduction & Scope

This Privacy Policy applies to Garuda Law ("we", "us", "our"), an inheritance law firm registered and operating in Bangkok, Thailand. It covers information collected through our website at garudalaw.sbs, as well as through any direct correspondence, consultation bookings, or enquiries submitted to us.

We handle your personal information in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and, where applicable, the EU General Data Protection Regulation ("GDPR"). By using our website or contacting us, you acknowledge that you have read and understood this policy.

If you have any questions at any point, you are welcome to contact us at [email protected].

2. Data We Collect

We collect only the information necessary to respond to your enquiries and provide our legal services. This may include:

• Contact details: name, email address, telephone number
• Enquiry content: details you share in messages or consultation requests
• Usage data: IP address, browser type, pages visited, and time spent on the site (collected via analytics tools)
• Cookie data: preferences stored in your browser as described in Section 5

We do not collect sensitive categories of data (such as financial account details or biometric data) through this website. Information shared during formal legal engagement is governed by a separate client agreement and professional confidentiality obligations.

Legal Basis for Processing

• Consent — when you complete and submit an enquiry form
• Legitimate interest — for website analytics and service improvement
• Contract performance — when we are engaged to provide legal services
• Legal obligation — where we are required to retain records under Thai law

Retention Periods

• Enquiry data (not converted to client): retained for up to 12 months, then deleted
• Client matter records: retained for 10 years after the matter closes, as required by Thai professional and legal standards
• Analytics data: aggregated and anonymised; not retained beyond 26 months

3. How We Use Your Data

Information you provide is used for the following purposes:

• Responding to your enquiry and arranging consultations
• Delivering the legal services you have engaged us for
• Sending relevant updates about your matter (by email or telephone)
• Improving our website and understanding how visitors engage with it
• Complying with our legal and professional obligations

We do not use your contact details for unsolicited marketing. If you have made an enquiry, we may follow up once to check whether your question was resolved; we will not add you to any mailing list without your explicit consent.

Data Sharing

We share data only when necessary and only with parties who are bound by confidentiality obligations:

• Thai government offices and courts — where required to file documents on your behalf
• Analytics providers (e.g. Google Analytics) — anonymised usage data only
• IT service providers — hosting and email infrastructure, under data processing agreements

We do not sell, rent, or trade personal information to third parties under any circumstances.

4. Data Protection & Security

We take reasonable and appropriate measures to protect personal information against unauthorised access, loss, or misuse:

• Our website is served over HTTPS with current TLS encryption
• Access to client records is restricted to the fee-earner(s) handling the matter
• Electronic files are stored on access-controlled systems with regular backups
• Paper records containing personal data are stored securely and disposed of by shredding
• Staff are trained in data handling obligations under the PDPA

In the event of a data breach that is likely to affect your rights or interests, we will notify you and the relevant authority within the timeframes required by applicable law.

5. Cookies

Our website uses cookies to support basic functionality and to understand how visitors use the site. We use the following categories:

• Essential cookies: required for the site to function; cannot be disabled
• Analytics cookies: help us understand page visits and user journeys (optional)
• Preference cookies: remember settings such as cookie consent choices (optional)

You can manage your cookie preferences at any time through our Cookie Policy page, which includes controls for each category. For more detail on the cookies we use and their purpose, please see that page.

6. Your Rights

Under Thailand's PDPA and, where applicable, GDPR, you have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to ask us to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your data where there is no overriding legal basis to retain it
• Right to data portability — to receive your data in a structured, commonly used format
• Right to object — to object to processing based on legitimate interests
• Right to restrict processing — to request that we limit how your data is used while a matter is under review
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting any prior lawful processing

To exercise any of these rights, please write to us at [email protected]. We will respond within 30 days. Where we cannot fulfil a request — for example, because retention is required by law — we will explain the reason.

If you are dissatisfied with our response, you may lodge a complaint with Thailand's Personal Data Protection Committee or, for EU residents, your local data protection authority.

7. Third-Party Links

Our website may contain links to external resources, such as government offices or legal registries. These sites have their own privacy policies, which we do not control and for which we are not responsible. We encourage you to review the privacy policy of any external site before submitting personal information there.

8. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal information from individuals under 18. If we become aware that data has been submitted by a minor without appropriate parental or guardian consent, we will delete it promptly. Please contact us at [email protected] if you have concerns on this matter.

9. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in law or our practices. When we do, the revised date at the top of this page will be updated. For significant changes, we will place a notice on our website homepage for a reasonable period. Continued use of the website after changes have been published constitutes acceptance of the revised policy.

10. Contact

For any questions, requests, or concerns regarding your personal data, please contact: