Privacy Policy

1. Who We Are

Ananda Pact is an environmental regulatory advisory practice registered and operating in Bangkok, Thailand. Our registered office is at 78 Phetchaburi Road, Ratchathewi, Bangkok 10400. We are the data controller for personal data collected through this website and in the provision of our services.

You may contact our data protection point of contact at info@{{DOMAIN}} or by post at the address above.

2. Information We Collect

We collect personal data when you interact with us in the following ways:

Information you provide directly:

• Contact details: full name, email address, telephone number
• Organisation or company name (where applicable)
• The content of messages or enquiries you send us through our contact form or by email
• Any documents or materials you share with us in connection with a matter

Information collected automatically when you visit our website:

• IP address and approximate geographic location
• Browser type, device type, and operating system
• Pages visited, time spent on pages, and referring URLs
• Cookie identifiers and session data (see Section 8)

We do not collect sensitive categories of personal data (such as health data, financial account details, or national identification numbers) through our website. If such information becomes relevant in the context of a legal engagement, it is handled under separate professional confidentiality obligations.

3. How We Use Your Data

We use the personal data we collect for the following purposes:

• To respond to your enquiries and communicate with you about your matter
• To provide the legal and advisory services you have engaged us to perform
• To manage our client relationship, including billing and correspondence
• To comply with our professional obligations and applicable legal requirements
• To improve the functionality and content of our website
• To analyse how our website is used, using aggregated and anonymised data where possible
• To send you relevant updates or information about our services where you have consented to receive them

We do not use automated decision-making or profiling in ways that produce legal or similarly significant effects on you.

4. Legal Basis for Processing

Under Thailand's Personal Data Protection Act B.E. 2562 (PDPA), we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the services you have requested or to take steps before entering a service agreement
• Legitimate interests: Processing necessary for our legitimate business interests, such as responding to general enquiries and improving our website, provided these interests are not overridden by your rights
• Legal obligation: Processing required to comply with applicable Thai laws and regulations
• Consent: Where you have provided explicit consent, such as for certain analytics cookies or to receive marketing communications — which you may withdraw at any time

5. Sharing and Disclosure

We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes.

We may share personal data with:

• Service providers: Trusted third-party providers who assist us in operating our website and delivering our services (such as hosting providers, email services, and analytics platforms), who are contractually bound to process data only on our instructions
• Professional advisors: External experts, co-counsel, or specialist consultants engaged in connection with your matter, with your prior knowledge
• Regulatory or judicial authorities: Where we are required to do so by applicable law, a court order, or a legitimate regulatory request

In each case, we take reasonable steps to ensure that third parties receiving your data maintain appropriate data protection standards.

6. Data Retention

We retain personal data only for as long as is necessary for the purposes described in this policy, or as required by applicable law or professional standards.

• Enquiries that do not proceed to an engagement are typically retained for up to 12 months
• Data relating to active or completed client matters is retained for a period consistent with our professional obligations, generally a minimum of 7 years from the close of the matter
• Website analytics data is retained in aggregated or anonymised form and is not linked to identifiable individuals beyond 26 months

When personal data is no longer required, it is securely deleted or anonymised.

7. Your Rights Under the PDPA

Under Thailand's PDPA, you have the following rights in respect of personal data we hold about you:

• Right of access: To request a copy of the personal data we hold about you
• Right to rectification: To request correction of inaccurate or incomplete data
• Right to erasure: To request deletion of your personal data in certain circumstances
• Right to restriction: To request that we restrict processing in certain circumstances
• Right to data portability: To receive your data in a structured, commonly used format
• Right to object: To object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at info@{{DOMAIN}}. We will respond within 30 days. We may need to verify your identity before processing a request. Some requests may be subject to limitations under applicable law or our professional confidentiality obligations.

You also have the right to lodge a complaint with the Personal Data Protection Committee of Thailand if you believe your data has been processed in a way that violates the PDPA.

8. Cookies

Our website uses cookies and similar tracking technologies. A cookie is a small file placed on your device that allows us to recognise your browser and retain certain preferences or information.

We use the following categories of cookies:

• Essential cookies: Necessary for the website to function. These cannot be disabled.
• Analytics cookies: Used to understand how visitors interact with our website, such as pages viewed and time spent. Used only with your consent.
• Marketing cookies: Used to track the effectiveness of our advertising and to provide relevant content. Used only with your consent.
• Preference cookies: Used to remember your settings, such as cookie consent choices. Used only with your consent.

You may manage your cookie preferences at any time using the consent panel on our website, or by clearing cookies from your browser settings. For full details, please see our Cookie Policy.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include secure server infrastructure, access controls, and staff training on data handling obligations.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable precautions, we cannot provide an absolute assurance of security. If you have reason to believe that your interaction with us has been compromised, please notify us promptly at info@{{DOMAIN}}.

10. Children

Our website and services are intended for adults and businesses. We do not knowingly collect personal data from individuals under the age of 20 (or the applicable age of majority). If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it promptly. If you believe we have received data from a minor, please contact us at info@{{DOMAIN}}.

11. Cross-Border Data Transfers

Our operations are based in Thailand and we process data primarily within the country. In limited circumstances, data may be processed by service providers located outside Thailand (for example, cloud hosting or email services). Where such transfers occur, we take reasonable steps to ensure that adequate protections are in place consistent with the requirements of the PDPA, which may include relying on standard contractual protections or the recipient country's data protection standard.

12. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website following any update constitutes your acknowledgment of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:

We will make every effort to respond to your enquiry promptly and to resolve any concerns in a fair and transparent manner.