Privacy Notice

Last updated: 17 September 2026

This notice explains what happens to the personal data you send us through the enquiry form on this website. It is written to meet the requirements of Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").

Who is responsible for your data

Bastion Legal (Thailand) Co., Ltd. ("the firm") is the data controller. The firm decides why and how your data is used. Our marketing agency builds and operates this website and its enquiry system on the firm's behalf. It acts as a data processor: it handles your data only on the firm's instructions and for the purposes described here.

What we collect on the form

• What you tell us: your name, email address, nationality, where you are located, the type of matter, the details you write, how you prefer to be contacted, and your WhatsApp contact if you choose to give it.
• Your consent to be contacted about your enquiry.
• How you found us: campaign tags in the link you followed (UTM parameters and the Google Ads click identifier), the first page you landed on, the referring website, and the page you submitted from.
• Technical data: your IP address, the country it maps to, your browser type and language, and the time of submission.

Please do not send original documents, identity numbers or other sensitive information through the form. A lawyer will tell you how to share those securely if they are needed.

Why we collect it

• To reply to your enquiry and assess whether and how the firm can act for you. This is based on your consent and on steps taken at your request before entering into an engagement.
• To send you an email confirming receipt, with a reference number.
• To protect the form against spam and abuse, which is why technical data is recorded. This is based on the firm's legitimate interests.
• To understand which channels bring enquiries, so the firm can manage its marketing. This is based on the firm's legitimate interests.

We do not sell your data, and we do not use it for unrelated marketing.

Where it is stored and who handles it

Enquiries are stored in a database operated by Cloudflare, Inc., where data is encrypted at rest and in transit. Access is restricted to the firm and to authorised staff of the agency.

We use a small number of service providers to run the enquiry system: Cloudflare (website hosting, database and bot protection), Resend (delivery of the emails described above) and Google (website analytics, see below). These providers may process data outside Thailand. Where they do, we rely on the safeguards permitted by the PDPA for international transfers.

The content of your enquiry is covered by the firm's professional duty of confidentiality.

How long we keep it

If you become a client, your enquiry becomes part of your client file and is kept for as long as the firm's professional and legal record-keeping obligations require. If you do not become a client, we delete or anonymise your enquiry within 24 months of your last contact with us. You can ask us to delete it sooner.

Analytics cookies

This website uses Google Analytics 4 (GA4) to measure visits and to record when an enquiry form is submitted. GA4 sets cookies on your device and collects usage data such as pages viewed, approximate location and device type. It does not receive the content of your enquiry. You can block these cookies in your browser settings or with Google's opt-out browser add-on. The website works without them.

The form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than an automated program. It does not use advertising cookies.

Your rights under the PDPA

You have the right to:

• withdraw your consent at any time;
• access your personal data and obtain a copy of it;
• have inaccurate or incomplete data corrected;
• have your data deleted, destroyed or anonymised;
• restrict or object to our use of your data;
• receive your data in a portable format, or have it sent to another controller where technically feasible;
• lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand.

Withdrawing consent does not affect anything done lawfully before the withdrawal. To exercise any of these rights, email us at the address below. We will respond within 30 days.

Contact

For any question about this notice or your personal data, email privacy@bastionlegal.co.th.

Changes to this notice

If we change how we handle personal data, we will update this page and the date at the top.