Privacy Policy

1. Introduction

Ratana (“we”, “us”, “our”) is committed to handling personal data responsibly and in accordance with applicable law. This policy explains what personal data we collect, why we collect it, how it is used, and what rights you have in relation to it.

This policy applies to personal data collected through our website at ratanaxx and in connection with our legal services. If you have questions about this policy, please contact us at privacy@ratanaxx.

2. Data We Collect

We collect personal data in the following circumstances:

• Contact form submissions: name, email address, telephone number, and any message content you provide.
• Email correspondence: any personal data included in emails sent to us.
• Website usage data: IP address, browser type, pages visited, and session data — collected automatically through cookies and server logs.
• Client engagement data: information necessary to provide legal services, including business details, property information, and documents shared with us during an engagement.

The legal basis for processing contact form and client engagement data is the performance of or preparation for a contract, and our legitimate interest in responding to enquiries. Where analytics cookies are used, the legal basis is your consent.

3. How We Use Your Data

• To respond to enquiries and provide information about our services
• To deliver legal services where an engagement has been agreed
• To communicate progress updates and relevant information during an engagement
• To understand how our website is used and improve its content (where analytics cookies are accepted)
• To comply with legal and professional obligations under Thai law

We do not sell personal data to third parties. We do not use personal data for marketing purposes without your consent.

4. Data Retention

Enquiry data where no engagement follows is retained for up to 12 months and then deleted. Client engagement data is retained for a period of 7 years following the completion of an engagement, in line with professional record-keeping requirements under Thai law. Website usage data is retained in aggregate form only and not linked to identifiable individuals.

5. Data Protection Measures

We take reasonable technical and organisational steps to protect personal data against unauthorised access, disclosure, or loss. These include:

• Encrypted transmission (HTTPS) for all website communications
• Access controls limiting data to authorised personnel only
• Secure storage for client documents
• Prompt notification to affected individuals in the event of a data breach, as required under Thailand's Personal Data Protection Act B.E. 2562

6. Cookies

Our website uses essential cookies necessary for basic functionality and, with your consent, analytics cookies to understand how the site is used. You can manage your cookie preferences at any time via our Cookie Policy page. Essential cookies cannot be disabled as they are required for the site to function.

7. Third-Party Services

We may use the following third-party services in connection with our website:

• Google Analytics: website usage analytics (where analytics cookies are accepted)
• Google Maps: embedded map for office location display (no personal data shared)

Links from our website to third-party sites are provided for convenience. We are not responsible for the privacy practices of those sites and encourage you to read their policies independently.

8. Your Rights Under Thai PDPA

Under Thailand's Personal Data Protection Act B.E. 2562, you have the following rights in relation to your personal data:

• Access: to request a copy of personal data we hold about you
• Rectification: to request correction of inaccurate data
• Erasure: to request deletion of data where there is no continuing legitimate basis for its retention
• Portability: to request data in a machine-readable format where technically feasible
• Objection: to object to processing based on legitimate interest
• Withdrawal of consent: to withdraw consent for analytics cookies at any time without affecting prior processing

To exercise any of these rights, contact us at privacy@ratanaxx. We will respond within 30 days. You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee.

9. Children's Privacy

Our services are intended for persons aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time to reflect changes in how we handle data or as required by law. The updated date at the top of this page indicates when the policy was last revised. Continued use of our website after an update constitutes acceptance of the revised policy.