Privacy Policy

Introduction

aruncounad is committed to protecting the privacy and personal data of individuals who engage with our legal advisory services. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data in accordance with Thailand's Personal Data Protection Act (PDPA) and applicable professional obligations governing the legal profession in Thailand.

For questions regarding this Privacy Policy or our data practices, please contact us at [email protected].

Data Collection Information

What Personal Data We Collect

We collect the following categories of personal data:

• Contact information including name, email address, telephone number, and business address
• Professional information including job title, company name, and role within your organization
• Communication records including correspondence, meeting notes, and legal advisory discussions
• Transaction information related to legal engagements including billing details and payment information
• Website usage data including IP address, browser type, and pages visited when you access our website

How We Collect Data

Personal data is collected through the following means:

• Direct provision when you contact us, engage our services, or provide information during consultations
• Website forms and contact inquiries submitted through our online presence
• Email and telephone communications initiated by you or in response to your inquiries
• Cookies and similar technologies when you visit our website (see our Cookie Policy for details)
• Third-party sources such as public company registries, professional networks, or referral sources where permissible

Legal Basis for Processing

We process personal data based on the following legal grounds under the PDPA:

• Consent: Where you have provided explicit consent for specific processing purposes
• Contract performance: To fulfill our obligations under legal service engagements
• Legitimate interests: For business operations, client relationship management, and service improvement
• Legal obligations: To comply with professional regulations, court orders, or legal requirements

Data Retention

We retain personal data for the following periods: Client engagement records and legal documents are retained for seven years following the conclusion of an engagement, consistent with professional record-keeping requirements. Contact information for prospective clients is retained for three years from last contact unless you request earlier deletion. Website analytics data is retained for two years. Payment and billing records are retained for ten years in accordance with Thai tax and accounting requirements.

Data Usage

How We Use Personal Data

Personal data is used for the following purposes:

• Providing legal advisory services including transaction support, regulatory counsel, and compliance assistance
• Client communication including responding to inquiries, scheduling consultations, and providing engagement updates
• Billing and payment processing for professional services rendered
• Legal compliance including conflict of interest checks, anti-money laundering procedures, and regulatory reporting
• Service improvement through feedback analysis and quality assurance processes
• Business operations including record-keeping, insurance purposes, and professional indemnity requirements

Data Sharing

We may share personal data with the following third parties under appropriate safeguards:

• External legal counsel or advisors engaged to support specific matters with your knowledge
• Professional service providers including accountants, IT service providers, and document management systems
• Regulatory authorities when required by law, court order, or professional obligations
• Payment processors for billing and transaction purposes
• Insurance providers in connection with professional indemnity coverage

We do not sell personal data to third parties or use it for marketing purposes without explicit consent.

Data Protection Measures

We implement appropriate technical and organizational measures to protect personal data:

• Encryption of data in transit and at rest using industry-standard protocols
• Access controls limiting data access to authorized personnel based on need-to-know principles
• Secure document management systems with version control and audit trails
• Regular security assessments and updates to address emerging threats
• Employee training on data protection obligations and confidentiality requirements
• Incident response procedures including breach notification protocols aligned with PDPA requirements

In the event of a personal data breach that is likely to result in a high risk to your rights, we will notify you and the relevant authorities as required under the PDPA within 72 hours of becoming aware of the breach.

Cookies and Website Technology

Our website uses cookies and similar technologies to enhance user experience and analyze website usage. We use the following types of cookies:

• Essential cookies required for website functionality and security
• Analytics cookies to understand how visitors use our website and improve our online presence
• Preference cookies to remember your settings and choices

For detailed information about our cookie practices and how to manage your preferences, please review our Cookie Policy.

Your Rights Under the PDPA

As a data subject under Thailand's PDPA, you have the following rights:

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days as required under the PDPA.

International Data Transfers

Our operations are based in Thailand, and we primarily process personal data within Thailand. In cases where personal data must be transferred outside Thailand, we ensure appropriate safeguards are in place, including standard contractual clauses or other mechanisms approved under the PDPA. Any such transfers will be conducted only with your knowledge and in accordance with applicable legal requirements.

Children's Privacy

Our legal advisory services are directed at businesses and organizations, not individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a minor, we will take steps to delete such information promptly.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or business operations. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this policy and, where appropriate, provide additional notice such as via email or website announcement. We encourage you to review this Privacy Policy regularly to stay informed about how we protect your personal data.