Privacy Notice

1. Who this notice applies to

YACT Association Company Limited (the "firm", "we") issues this notice under the Personal Data Protection Act B.E. 2562 (2019) to explain how we collect, use and disclose your personal data. It applies to everyone whose data the firm holds:

If you fall into more than one group, every relevant part applies to you. This notice does not diminish a lawyer's duty of confidentiality to clients under the law and the Lawyers Council's rules of professional conduct. That duty protects clients more strictly than this notice and always applies alongside it.

2. Data controller and how to contact us

3. The personal data we collect

Personal data means information about a natural person from which that person can be identified. It does not include data about deceased persons. What we collect depends on our relationship with you. Broadly:

Sensitive personal data. We do not set out to collect it, but in some matters it cannot be avoided: a criminal-record check required for a work-permit application or arising in a case, health data in a medical certificate supporting a visa application or in a personal-injury claim, or the religion and blood group printed on a Thai national ID card. In those cases we ask for your explicit consent first, unless the law allows processing without it — most often where it is necessary to establish, comply with, exercise or defend a legal claim. Data on an ID card that we do not need is struck through or masked before the copy is filed.

Minors and persons under guardianship. Our services are not aimed at them. Where a matter involves one — a family or inheritance case, for example — we act through the person exercising parental power, the guardian or the curator, as the law requires.

If you do not provide data. Some items are required by law or by the authority concerned — copies of directors' identity documents for a company registration, a supplier's tax identification number and bank account for payment and withholding tax, an applicant's qualifications and licence. Without them we may be unable to handle the matter, or to handle it completely, and we will tell you so.

4. Where the data comes from

• From you directly, when you telephone, email, message us on LINE or WeChat, visit the office, send documents, submit a quotation, sign a contract or apply for a position.
• From your organisation, for example when your employer engages us for your work permit, or when an organisation names you as its contact with us.
• From third parties, such as counterparties or opposing parties, opposing counsel, courts, government agencies, referrers (other law firms, accounting firms, clients), an applicant's referees and educational institutions, the job platform you applied through, and the building management.
• From public sources, and from the course of the matter, such as documents issued by a court or agency while it is under way.

Where we obtain your data from a source other than you, we inform you within the time the law allows, unless you already know, or the law exempts us from doing so — which includes cases where professional confidentiality requires us to keep that information secret (section 25). If you are a client who sends us another person's data, please let that person know about this notice as appropriate.

5. What we use the data for, and on what legal basis

The law permits us to collect, use or disclose personal data when a lawful basis supports it. The bases we rely on in this notice are:

5.1 Clients and prospective clients

5.2 Persons who appear in a client's matter

If you are not our client but appear in a matter a client has engaged us on — as a counterparty, the opposing party, a witness, an expert or a person referred to in a document — we hold your data because the client's matter requires it. We use it only as far as the matter requires: negotiation, sending a demand letter, filing with a court or agency. The basis is legitimate interests (section 24 (5)) or, for sensitive data, the necessity of establishing, complying with, exercising or defending a legal claim (section 26 (4)). You may receive letters or other contact from us directly, as the client's representative. We may disclose your data to the court, arbitral tribunal or agency the matter has to be filed with. Retention follows the life of the client's matter (section 8). You have the rights in section 10 like anyone else, but access and erasure may be more limited for you than for other groups, to protect the confidentiality we owe the client and to avoid prejudicing a claim the client is still pursuing, under the conditions in sections 30, 32 and 33.

5.3 Website visitors, cookies and traffic statistics

Our website has no forms and no accounts. Anything you send us by telephone, email, LINE or WeChat becomes an enquiry we have received and falls under 5.1 from that point.

Hosting provider and cookieless statistics. Our hosting provider (Cloudflare, Inc. — policy: https://www.cloudflare.com/privacypolicy/) processes technical connection data such as IP address and browser type to serve pages and block attacks, and compiles aggregate visitor statistics for us — visits per page, country of origin, device type — without cookies and without identifying anyone. Legal basis: legitimate interests in securing and improving the website (section 24 (5)).

Google Analytics statistics cookies. The website loads the Google Analytics 4 script when a page opens, which sets the cookies below in your browser — unless you have chosen "Do not allow" or your browser sends a Global Privacy Control signal, in which case the script does not measure and sets no cookies.

Google Analytics receives the pages you open, the time spent, the page that referred you, your device and browser type, and an approximate city-level location estimated from your IP address. Google states that it does not log IP addresses. We use this to see which content is read and what to improve; we do not use it for advertising, and Google's advertising features are switched off.

Legal basis. We rely on our legitimate interests in measuring and improving the website (section 24 (5)), limiting the data collected, keeping the cookie lifetime short, disabling advertising features, and letting you object to or switch off measurement at any time as described below — an exercise of the right to object under section 32 that we honour unconditionally.

Transfer abroad. The data is sent to and processed by Google LLC on servers outside Thailand, including in the United States. We rely on appropriate safeguards under section 29, through the data-processing terms Google binds itself to towards users of Google Analytics.

Switching it off. Click "Cookie settings" at the foot of any page and choose "Do not allow". The website stops sending data to Google at once and deletes the _ga and _ga_* cookies set on our domain. You can switch it back on in the same place, and you can also delete or block cookies in your browser settings. Switching off does not affect statistics lawfully collected before that point.

Remembering your choice. The website keeps your "Allow" or "Do not allow" answer in your browser's storage (localStorage, key yact-consent) for 365 days so that it can honour it on your next visit. The value stays on your device and is not sent anywhere. If your browser sends a Global Privacy Control signal we treat that as "Do not allow" without any setting on your part.

A limitation to be aware of. Google's script cannot be reached from mainland China; visitors from there are not counted in Google Analytics.

Links to external services. The LINE and WeChat buttons on the website link to those providers' apps or sites, which collect and use data under their own policies. Our website does not embed their scripts.

The map on the contact page. The contact page embeds a Google Maps map that loads with the page. When you open that page your browser connects directly to Google's servers, so Google receives your IP address, information about your browser and device, and the page you are viewing. Google may set its own cookies on Google domains and use the data under Google's privacy policy (https://policies.google.com/privacy), which is outside our control and is not governed by the "Cookie settings" button in the footer — that button controls Google Analytics only. We embed the map so that you can see where the office is and find your way to it, relying on legitimate interests (section 24 (5)). If you would rather your browser did not connect to Google, you can block it in your browser settings or with an extension; the office address is also given in plain text on the same page.

5.4 Visitors to the office

The building in which the office is located has CCTV in common areas such as the lobby and lifts, operated by the building management, not by the firm. The building management is a separate data controller for those images; you may ask it about its policy directly. If notes are taken at a meeting or business cards and documents are exchanged, we keep them only as far as the matter discussed requires. Items you leave behind are kept so that they can be returned to you, for no more than 90 days, after which they are dealt with appropriately. Legal basis: legitimate interests in the security of the premises and staff (section 24 (5)).

5.5 Job and internship applicants

We collect your CV and employment history, qualifications, relevant professional licences, previous positions, referee details, work samples and interview notes — mainly from you, from the job platform you applied through, from the referees you name, and from educational institutions where necessary and with your prior consent. We use the data to consider and act on your application before entering into an employment contract (section 24 (3)), and to keep a list of qualified candidates for future consideration on the basis of legitimate interests (section 24 (5)). If you are hired, your data comes under the privacy notice for employees, which is a separate document.

5.6 Suppliers, service providers and professional collaborators

We do not collect sensitive data about suppliers or professional collaborators.

5.7 Contacts at government agencies, courts and other firms

When you deal with us as an official of a court, a government agency or another law firm, we hold no more than business-card data — name, position, organisation and contact channel — to correspond and coordinate on the matter concerned, on the basis of the legitimate interests of both sides (section 24 (5)), for as long as that contact continues.

5.8 What we do not do, and new purposes

We do not send newsletters, promotions or marketing messages. Should the firm ever wish to, we will ask for your consent first, and you can opt out at any time. Notices about the firm itself — a change of address or of contact channels — are not marketing. We do not publish clients' names or matters on the website, on social media or in firm materials, whether anonymised or not, and we do not sell or rent personal data to anyone. If we ever need to use your data for a purpose not stated here, we will tell you and ask for your consent first, unless the law permits otherwise (section 21).

6. Who we disclose data to

We disclose data only as far as the matter requires, to these categories of recipient:

• Courts, arbitral tribunals and government agencies the client's matter must be filed with or dealt with — for example the Department of Business Development, the Immigration Bureau, the Department of Employment, the Board of Investment, the Revenue Department, the Legal Execution Department, the Department of Lands, the Department of Intellectual Property and the Department of Consular Affairs.
• Counterparties, opposing parties and their lawyers, to the extent negotiation or proceedings require.
• People we entrust with part of the work, as the client knows or agrees — translators and certified translators, notaries, experts or expert witnesses, process servers, law firms in other provinces or abroad that assist on the matter.
• The client concerned, where a supplier or professional collaborator works on that client's matter as an expert or co-counsel.
• Our service providers, who process data on our instructions under confidentiality terms — website hosting, email and document storage, accounting systems, auditors, IT providers, and the traffic-statistics provider described in 5.3.
• Banks, payment providers and the Revenue Department, to make and receive payments and to remit withholding tax or file tax returns.
• The building management, for office visitors' access to the building.
• A successor, if the firm restructures, merges or transfers its business, under the same duty of confidentiality.
• Anyone the law requires, on the order of a court or a competent authority.

We require every recipient working for us to use the data only for the stated purpose and to keep it confidential.

7. Transfers abroad

Your matter may take data outside Thailand — when you are abroad and we send you documents; when a counterparty, court or agency is abroad; when we work with a law firm or expert abroad; when our email, document-storage or traffic-statistics providers keep data on servers abroad; or when an applicant uses a job platform based abroad.

In those cases we send the data to a destination with adequate personal-data protection under the rules issued by the Personal Data Protection Committee, or rely on an exception under section 28 — compliance with the law; your consent after we have told you that the destination's standard is inadequate; necessity for a contract with you or for steps taken at your request before contracting; a contract between us and another person for your benefit; or the prevention of danger to life, body or health — and in other cases we put appropriate safeguards in place under section 29.

8. How long we keep data

We keep data for as long as the purpose requires and the law prescribes, on these criteria:

When a period expires we delete, destroy or anonymise the data.

9. How we keep data secure

Your data is accessible only to the lawyers and staff who need it for their work, all of whom are bound to confidentiality by their employment terms and by professional duty. Electronic documents are kept in systems that require authentication before access; paper documents are kept under lock. If a personal-data breach occurs, we notify the Office of the Personal Data Protection Committee, and notify you where the breach carries a high risk to your rights and freedoms, within the rules and time limits the law sets.

10. Your rights

Under the Personal Data Protection Act B.E. 2562 you have the following rights:

Exercising your rights. Contact us through the channels in section 2. We may ask for further information to confirm your identity before acting, and will act on your request without undue delay — for access requests, within thirty days of receiving the request. If a request is complex or there are several, we will tell you the timetable.

Limits. Some rights are conditional under the law. We may refuse access where the law or a court order permits, or where access would prejudice the rights and freedoms of others, and we may have to keep some data even where you ask for erasure, to comply with the law or to establish, exercise or defend a legal claim. For persons who appear in a client's matter (5.2), access and erasure may be more limited than for other groups, for the reasons explained there. If we refuse, we will give the reason and record it as the law requires. Exercising your rights is free of charge.

11. Changes to this notice

This notice takes effect on 2 September 2026. We may update it from time to time; the current version is always published on the firm's website with the date of its last revision. If a change materially affects your rights, we will tell you through the channel you use with us.