Privacy Policy

1. Who We Are

Rom Pho is a legal practice based at 110 Ratchadamri Road, Lumphini, Bangkok 10330, Thailand. We are the data controller for information you provide to us. For data protection enquiries, contact [email protected].

2. What Data We Collect

We collect personal data only when it is necessary for providing our services or responding to your enquiry. This may include:

• Full name
• Email address and telephone number
• Pension and employment records shared during a case
• Messages submitted via our contact form
• Technical data (browser type, IP address) via analytics cookies (with consent)

We do not collect sensitive personal data beyond what is necessary for your pension matter (which may include financial or employment history). This data is handled with heightened care.

3. Legal Basis for Processing

Under the PDPA, we process your personal data on the following grounds:

• Contract: data necessary to deliver the legal service you have requested
• Legitimate interest: responding to enquiries and improving our services
• Consent: analytics cookies and any optional marketing communications (you may withdraw at any time)
• Legal obligation: where we are required to retain records under Thai law

4. How We Use Your Data

• To respond to your enquiry or provide the service you have requested
• To manage your case and communicate with relevant authorities on your behalf
• To keep records as required by Thai legal professional obligations
• To improve our website and services (using anonymised analytics data where consent is given)

We do not sell your data to third parties. We do not use your data for automated decision-making or profiling.

5. Data Sharing

We share your personal data only when necessary and only with:

• Relevant Thai government authorities (Social Security Office, Government Pension Fund, etc.) as required by your case — with your prior knowledge
• Our secure analytics provider (anonymised data only, where consent is given)
• Legal or regulatory bodies where required by Thai law

6. Data Retention

Case files and associated personal data are retained for seven years from case closure, in line with Thai legal professional obligations. Contact form submissions not leading to a case are deleted after 12 months. Analytics data (where consent applies) is anonymised after 26 months.

7. Data Security

We use encrypted storage for all digital case files and restrict access to authorised staff only. Physical documents are held in locked storage. In the event of a data breach affecting your rights, we will notify you and the relevant Thai authority within 72 hours of becoming aware of it.

8. Cookies

Our website uses essential cookies (for basic site function) and, with your consent, analytics cookies. You can manage your cookie preferences at any time via our Cookie Policy page. We do not use marketing or tracking cookies.

9. Your Rights Under the PDPA

As a data subject under Thai law, you have the right to:

• Access a copy of your personal data held by us
• Request correction of inaccurate data
• Request deletion of data no longer necessary for its original purpose
• Object to processing based on legitimate interest
• Withdraw consent at any time (without affecting prior lawful processing)
• Request data portability in a readable format
• Lodge a complaint with the Personal Data Protection Committee of Thailand

To exercise any of these rights, write to us at [email protected]. We respond within 30 days.

10. Third-Party Links

Our website may contain links to external sites (such as government portals). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy notices before providing any personal information to them.

11. Children

Our services are intended for persons aged 18 and over. We do not knowingly collect personal data from minors. If you believe we have inadvertently done so, please contact us immediately at [email protected].

12. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last Updated" date at the top. For significant changes affecting how we use your data, we will inform you directly where we hold your contact details.

13. Contact

For privacy-related questions, requests, or complaints: