Privacy & Cookies Statement

Last updated: July 2026

This statement sets out how Khonsu Legal handles the personal data of people who visit this website, get in touch with us, or engage us as clients. It covers what we gather, why we gather it, who we share it with, and the choices and rights you have. We have written it to satisfy Thailand's Personal Data Protection Act (PDPA) B.E. 2562 (2019) and, where it applies to you, the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The party that decides how and why your personal data is processed (the “data controller”) is Khonsu Legal, whose registered office is at One Bangkok Tower 4, Witthayu Rd, Lumphini, Pathum Wan, Bangkok 10330, Thailand. Everyone who works for the firm is required to follow our internal data-protection rules whenever they handle personal data. If you have a question about anything in this statement, you can reach us at info@khonsulegal.com.

2. The personal data we collect

Depending on how you interact with us, we may gather the following kinds of information:

Identity and contact details — your name, email address, telephone number, company name, position, and the postal address you give us.
Enquiry details — whatever you choose to tell us through our contact form, by email, or over WhatsApp and similar channels when you ask about our services.
Client engagement data — the documents and instructions we need to act for you, which can include passport and visa information, corporate records, financial figures, and other material tied to the matter we are handling.
Sensitive data — for certain immigration, corporate, or litigation work we may need data that the law treats as sensitive (for example, identification documents). We only process this where you have given consent or another lawful ground under the PDPA or GDPR applies.
Technical and usage data — your IP address, browser and device type, and anonymous statistics about how the site is used, gathered through cookies and analytics as explained in section 7.
Data from third parties — when we represent you, Thai authorities such as the Department of Business Development, the Revenue Department, and the Immigration Bureau may exchange information about your filings with us, and we may receive data from your other advisers.

3. How and why we use your data

We process personal data only where we have a lawful reason to do so. In practice we use it to:

answer your questions and provide the legal, corporate, immigration, real-estate, or accounting services you have asked for — on the legal basis of performing a contract with you;
run and protect our practice, keep records, and prevent fraud or misuse of the site — on the basis of our legitimate interests;
send service-related messages about a matter we are working on for you;
carry out anti-money-laundering, know-your-client, accounting, and other checks the law imposes on a regulated Thai firm — on the basis of a legal obligation;
improve the website and our communications, and, where you have agreed, send you occasional updates — on the basis of your consent.

4. Use of artificial intelligence

Where we use software that relies on artificial intelligence to help process information, those tools are reviewed first to confirm they meet our ethical and legal standards. We do not allow any decision that produces a legal or similarly significant effect on you to be made by automated means alone — a qualified member of our team always remains responsible.

We never sell your personal data. We disclose it only in the limited situations below, and only to the extent needed:

Trusted service providers who help us operate — for example secure document storage, accounting platforms, and IT support — and who are bound to protect it and use it only on our instructions.
Government bodies and counterparties as part of the registrations, filings, and applications we make on your behalf.
Professional and financial institutions such as banks, auditors, or notaries where a matter requires it.
A buyer or successor if the firm is ever reorganised or its business transferred, subject to the safeguards in this statement.
Authorities or courts where disclosure is required by law, regulation, or a valid legal order.

6. Your marketing choices

If we send you updates or insights, you stay in control. You can opt out at any time by using the unsubscribe link in any email we send, or by writing to info@khonsulegal.com. Opting out of marketing does not stop service messages about a matter we are actively handling for you.

7. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. They let the site work properly, remember your settings, and help us understand how it is used. We keep our use of cookies to a minimum: those that are strictly necessary for the site to function, and analytics cookies that measure how visitors use it. We do not use cookies to build advertising profiles, and we do not sell your data.

To measure how the site is used, we use Google Analytics 4 (Google LLC, United States) and Yandex Metrica (Yandex, processed on servers in the Russian Federation) to measure aggregate, anonymised site usage such as pages viewed and traffic sources. Yandex Metrica also provides heat-maps and session replay (“Webvisor”) of anonymised page interactions like clicks and scrolling; it does not record the contents of form fields. Each provider acts as an independent controller for the data it receives, under its own privacy policy (Google, Yandex). Because both are located outside Thailand and the EU, our use of these analytics tools involves a cross-border transfer of usage data — see section 10.

You are in control of cookies. Most browsers let you view, block, or delete cookies through their privacy or settings menu, and you can set your browser to refuse new ones — though some parts of the site may then not work as intended. To opt out of our analytics specifically, you can install Google’s Analytics Opt-out Browser Add-on, which stops Google Analytics across every site you visit, and follow Yandex’s opt-out instructions to disable Yandex Metrica.

8. Your privacy rights

Subject to the conditions in the PDPA and the GDPR, you may ask us to: give you access to the data we hold about you; correct anything inaccurate; delete it; restrict or object to how we use it; transfer it to another provider; or withdraw a consent you previously gave. To make a request, email info@khonsulegal.com and we will reply within the period set by the applicable law — usually no later than 30 days.

9. How we keep your data safe

We apply appropriate technical and organisational safeguards — including access limited to those who genuinely need it, encrypted storage, and regular staff training — designed around recognised information-security standards. No safeguard is ever perfect; if a breach occurs that puts your data at risk, we will notify you and the competent authority within the timeframes the law requires.

10. Sending data outside Thailand

Some of the providers and counterparties involved in our work are located in other countries, so your data may be transferred across borders. Where we do this, we put recognised safeguards in place — such as standard contractual clauses or an adequacy decision — so that your information keeps an equivalent level of protection under the PDPA and the GDPR.

11. How long we keep your data

We hold client files for as long as our professional and statutory duties require — generally ten years after an engagement ends, and longer where continuing compliance work makes it necessary. Information from website enquiries that do not turn into an engagement is kept for up to 24 months and then deleted or anonymised.

12. Other points worth knowing

If you choose not to provide data we have asked for, we may be unable to act for you or complete a filing.
Automated decisions. We do not make decisions about you based solely on automated processing.
Do-not-track. Because there is no common industry standard for “do not track” browser signals, our site does not currently respond to them.
Other websites. Our pages may link to sites we do not control; this statement does not cover their practices, so please read their own notices.
Children. Our services are aimed at businesses and adults, and we do not knowingly collect data from children.

13. Changes to this statement

We may revise this statement as our practice or the law evolves. The latest version always lives at this address, with the date shown at the top. If a change is significant, we will let active clients know by email.

14. How to contact us

For any privacy question, request, or complaint, write to our data-protection team at info@khonsulegal.com or by post to the registered office above. If you believe we have not resolved your concern, you may lodge a complaint with Thailand's Personal Data Protection Committee (PDPC) or, if you are in the EU, with your local supervisory authority.