Privacy Policy

1. Who we are

Legal Craft Advisory ("Legal Craft Advisory", "we", "us" or "our") is a legal services firm based in Bangkok, Thailand, providing company incorporation, licensing, visa, work permit, accounting and corporate advisory services to foreign entrepreneurs.

For the purposes of the Thai Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and, where it applies, the EU General Data Protection Regulation ("GDPR"), we act as the data controller of the personal data described in this policy.

2. Scope of this policy

This policy applies to personal data we process when you:

• visit www.legalcraftadvisoryth.com or any of its pages;
• submit the contact form or request a free consultation;
• contact us by email, telephone or WhatsApp;
• engage us as your legal, corporate or accounting services provider; or
• are named in a matter we handle for a client (for example as a shareholder, director, employee or family member of an applicant).

It does not apply to third-party websites we link to, which have their own privacy policies.

3. Personal data we collect

We only collect the data we need for the purpose in question. In practice this means:

3.1 Data you give us

• Contact form and consultation requests: full name, email address, phone or WhatsApp number, the service you are interested in, and the description of your project you choose to write.
• Direct communications: anything you include in an email, phone call, WhatsApp message or meeting with us.
• Client engagement data: once you engage us, the information required to deliver the service — identity and passport details, address, nationality, date of birth, marital and family details where a visa requires them, shareholding and corporate information, financial and tax data, employment details, and copies of supporting documents.

3.2 Data collected automatically

• Technical data: our hosting provider records standard server logs, including IP address, browser type, device type, referring page, and the date and time of your request. This is used to operate and secure the site.

3.3 Sensitive personal data

Some immigration, work permit and corporate filings in Thailand require documents that contain sensitive data under the PDPA — for example, information appearing on identity documents, medical certificates or criminal record checks. We collect this only where the relevant procedure requires it, and we rely on your explicit consent or another lawful basis under section 26 of the PDPA.

4. Why we use your data, and on what legal basis

We do not sell your personal data, and we do not use it for automated decision-making or profiling that produces legal effects for you.

5. Cookies and similar technologies

This website does not use advertising cookies and does not run third-party analytics or tracking scripts. No cookie is set on the public pages of the site for marketing or measurement purposes.

Two things are worth noting:

• Content delivery networks. The site loads fonts from Google Fonts and an icon stylesheet from Cloudflare's cdnjs. Requesting those files necessarily discloses your IP address and browser information to those providers, which they process under their own privacy policies.
• Staff area. Our internal administration panel, which is not accessible to visitors, uses strictly necessary browser storage to keep authorised staff signed in.

If we introduce analytics or other non-essential cookies in the future, we will update this policy and, where the law requires it, ask for your consent beforehand.

6. Who we share data with

We disclose personal data only where it is necessary, and only to:

• Thai government authorities involved in your matter, such as the Department of Business Development, the Board of Investment, the Immigration Bureau, the Department of Employment and the Revenue Department.
• Banks and financial institutions, where you ask us to assist with corporate account opening.
• Service providers who process data on our behalf, under contract and on our instructions — currently our website host (Vercel), our contact form provider (Formspree), our database and authentication provider (Supabase), our email provider, and our messaging channel (WhatsApp, operated by Meta) when you choose to contact us that way.
• Professional counterparties such as notaries, translators, auditors, landlords or opposing parties, where your matter requires it.
• Courts, regulators or law enforcement, where we are legally required to disclose.

We never share your data with third parties for their own marketing purposes.

7. International transfers

Some of the providers listed above store or process data outside Thailand, including in the United States and the European Union. Where personal data is transferred out of Thailand, we take steps to ensure the transfer meets the requirements of sections 28 and 29 of the PDPA — by relying on the recipient's adequate protection standards, contractual safeguards with the provider, your consent, or the necessity of the transfer for the performance of our contract with you. Where the GDPR applies, we rely on an adequacy decision or standard contractual clauses.

8. How long we keep your data

• Enquiries that do not become engagements: up to 24 months from the last contact, so that we can follow up and answer repeat questions.
• Client files: for the duration of the engagement and then for as long as needed to comply with Thai statutory retention and limitation periods, which for accounting and tax records is at least 5 years.
• Accounting and invoicing records: as required by the Revenue Code and the Accounting Act.
• Server logs: a short rolling period set by our hosting provider.

When a retention period ends, we delete the data or irreversibly anonymise it.

9. Security

We apply appropriate organisational and technical measures to protect personal data: HTTPS across the whole website, access control and authentication on our internal systems, row-level access restrictions on our client database, access limited to the staff who need it, and confidentiality obligations for everyone in the firm. No system is completely secure, but if a data breach occurs that is likely to result in a high risk to your rights, we will notify you and the competent authority as the PDPA requires.

10. Professional confidentiality

11. Your rights

Subject to the conditions and exceptions in the PDPA and, where applicable, the GDPR, you have the right to:

• Access your personal data and obtain a copy of it;
• Rectify data that is inaccurate, out of date or incomplete;
• Erase data, where it is no longer necessary or where you withdraw the consent it relied on;
• Restrict or object to processing based on legitimate interest;
• Data portability, where processing is based on consent or contract and is carried out by automated means;
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• Lodge a complaint with a supervisory authority — in Thailand, the Personal Data Protection Committee (PDPC); in the EU/EEA, your national data protection authority.

To exercise any of these rights, write to info@legalcraftadvisory.com. We will respond within 30 days. We may need to verify your identity first, and we may be unable to erase data we are legally required to keep or that we need in order to establish or defend a legal claim.

12. Children

This website is not directed at children, and we do not knowingly collect data from them through it. Where a matter involves a minor — for example a dependent's visa — we process that data on the instruction of, and with the consent of, the parent or legal guardian.

13. Changes to this policy

We may update this policy to reflect changes in our services, our providers or the law. The current version is always published on this page with its effective date. Where a change materially affects your rights, we will inform active clients directly.

14. Contact us

For any question about this policy or about how we handle your personal data:

See also our Terms & Conditions.