Our commitments & your choices
Privacy Notice
Effective date:
Thank you for visiting. We are SBC International Law Associates Co., Ltd., a Bangkok law firm trading as SBC Law Office (“SBC”, “we”, “us” or “our”). This notice explains what personal data we collect, why we use it, who we share it with and your choices.
We handle data in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (2019) and its subordinate regulations (the “PDPA”). SBC is the data controller for the personal data described here. If anything is unclear, please ask us.
Applies to www.sbcinterlaw.com and sbcinterlaw.skywork.website.
1. Who this notice covers
This notice applies to people whose personal data we handle outside an employment relationship:
- Website visitors who browse either of our websites.
- Enquirers and prospective clients who contact us through the website, email, phone or messaging apps.
- Clients, including individual clients and the directors, shareholders, employees and representatives of corporate clients.
- Suppliers and business partners, including vendors, consultants, correspondent law firms, affiliated advisory firms and their personnel.
- People connected to a matter, such as counterparties, witnesses, beneficial owners and family members whose details reach us through client instructions.
- Office visitors and event attendees who visit our office, seminars or events.
Our staff and job applicants are covered by a separate internal notice.
2. What personal data we collect
The information we collect depends on how you deal with us.
- Identity details
- Name, title, nationality, date of birth, passport or ID card number, tax ID, signature and photograph.
- Contact details
- Email, phone number, postal or business address, LINE or WhatsApp ID and business-card details.
- Professional details
- Employer, job title, company registration documents, shareholding and directorship information.
- Matter information
- Documents, correspondence, meeting notes and other information supplied by you or others so that we can advise you.
- Financial details
- Billing details, bank information used for payments or refunds, invoices and payment history.
- Website and technical data
- Our hosting or security providers may process IP addresses, browser and device information and technical request records to operate and secure the website. This release does not install analytics or collect article-view statistics; see our Cookie Policy.
- Enquiry and marketing data
- Information in your enquiry, newsletter or event preferences and opt-out choices, where you provide them. This website release does not itself enable newsletter subscription or marketing tracking.
Sensitive personal data
We do not ask for sensitive data, such as health information, religion, criminal records or biometric data, unless a matter genuinely requires it—for example, a criminal background check for a work permit application. Where the PDPA requires explicit consent, we will ask for it first. Please do not include sensitive information in a website enquiry.
Children
Our website is not aimed at children. We do not knowingly collect data from anyone under 20, the age of majority in Thailand, without consent from a parent or guardian. If we learn we have done so by mistake, we will delete it.
3. Where we get your personal data
- Directly from you, when you submit an enquiry, email or call us, meet us, sign an engagement letter or give us a business card.
- Automatically, through the necessary browser storage described in our Cookie Policy and technical records that the hosting platform may independently process.
- From other people or public sources, including a client whose matter involves you, a referrer, affiliated firms, the Department of Business Development, court records and company registries in other jurisdictions.
If you give us someone else’s data—a colleague, family member or shareholder, for example—please let them know and point them to this notice.
4. Why we use data and our legal basis
The PDPA requires a lawful reason for processing. Our main purposes and legal bases are:
| Purpose | Legal basis under the PDPA |
|---|---|
| Replying to enquiries and arranging consultations | Steps at your request before a contract; legitimate interest in responding to people who contact us. |
| Conflict checks and client due diligence | Legal obligation; legitimate interest in meeting professional standards. |
| Advice and client instructions, including dealings with agencies, courts, the BOI and registries | Performance of our contract; legitimate interest where you are connected to a client’s matter but are not our client. |
| Billing, fee collection, accounting and tax filings | Performance of contract; legal obligation under Thai accounting and revenue laws. |
| Operating, securing and improving the website | Legitimate interest; consent for any future non-essential cookies before activation. No analytics or advertising is enabled in this release. |
| Legal updates, newsletters and event invitations, where offered | Legitimate interest for existing clients and contacts on closely related topics; consent in other cases. You can unsubscribe at any time. |
| Office and system safety, including visitor logs and CCTV | Legitimate interest; vital interest where someone’s safety is at risk. |
| Legal claims and lawful requests from authorities | Legal obligation; legitimate interest. |
| Business restructuring, merger or change of ownership | Legitimate interest. |
Where we rely on consent, you may withdraw it at any time by contacting us. Withdrawal does not affect processing that was lawful before it.
If you do not provide information we need, such as identification for client due diligence, we may be unable to accept your matter or continue acting. We will tell you when this applies.
5. Who we share your data with
We treat client information confidentially. Within SBC, access is limited to people who need the data for their work. Outside SBC, we may share it with:
- Affiliated firms, including McMillan Woods (Thailand) Ltd., assisting with audit, accounting or advisory aspects of your matter.
- Correspondent and partner law firms in other jurisdictions, such as Malaysia, Singapore or the BVI, for cross-border matters.
- Business service providers: website hosting and development providers, including Skywork, cloud storage and email providers, IT support, translators, couriers, banks and our auditors.
- Government and regulatory bodies, courts and arbitral institutions where needed for your matter or required by law. These include the Department of Business Development, Revenue Department, Board of Investment, Immigration Bureau and Department of Employment.
- Counterparties and their advisers as a normal part of acting on your instructions.
- Professional advisers and potential acquirers in a restructuring, merger or sale, under suitable confidentiality terms.
We do not sell personal data or allow third parties to use it for their own marketing. Processors acting on our behalf must keep it confidential, protect it properly and use it only for the purpose for which we provided it.
6. Sending data outside Thailand
Our ASEAN and offshore work may involve sending data to, or storing it in, other countries—for example, when instructing a firm in Singapore or Malaysia, or using overseas hosting and cloud servers. Some countries may have less stringent protection than Thailand. We follow the PDPA’s cross-border rules, which may involve contractual safeguards, transfers necessary to perform our contract with you, or your consent.
7. How long we keep your data
We keep data only for as long as needed. As a general guide:
- Enquiries without an engagement
- Up to 2 years from our last contact, then deleted.
- Client and matter files
- For the life of the matter and up to 10 years after it closes, reflecting the general limitation period under the Thai Civil and Commercial Code and professional record-keeping obligations.
- Accounting and tax records
- At least the legally required period, generally 5 to 7 years under Thai accounting and revenue laws.
- Marketing lists
- Until you unsubscribe or ask to be removed.
- Browser storage
- For the periods explained in the Cookie Policy.
We may retain data longer where required by law or needed for an actual or potential legal claim. When no longer needed, it is deleted, destroyed or anonymised so that it can no longer identify you.
8. How we protect your data
We use reasonable technical and organisational measures, including restricted file access, password-protected and encrypted systems, secure paper storage and confidentiality obligations for staff and service providers. No system is completely secure.
Please think carefully before sending highly confidential material by ordinary email or a website form. Ask us about a more secure method before sending sensitive documents.
If a breach is likely to put your rights at risk, we will notify the Personal Data Protection Committee Office (PDPC) within the time required by law, and notify you where the risk is high.
9. Your rights under the PDPA
- Access your data, obtain a copy and ask how we obtained data collected without your consent.
- Correct inaccurate, outdated or incomplete data.
- Delete, destroy or anonymise data in certain circumstances.
- Restrict our use of data in certain circumstances.
- Object to processing, including direct marketing, which we will always stop.
- Data portability: receive data in a commonly used electronic format or have it sent to another organisation, where technically possible.
- Withdraw consent whenever we rely on it.
- Complain to the Personal Data Protection Committee if you believe we have handled your data unlawfully.
Contact our Data Protection Officer below to exercise a right. We may need to verify your identity and will usually respond within 30 days. Some rights are not absolute: we may need to retain legally required data or protect legal professional privilege and our duty of confidentiality to a client. If we cannot fulfil a request, we will explain why.
10. Links to other websites
We may link to government portals, news sources and other third-party sites. We are not responsible for their handling of personal data. Please read their own privacy policies.
11. Contact our Data Protection Officer
For questions about this notice or to exercise your rights, please contact:
SBC International Law Associates Co., Ltd. (SBC Law Office)Attention: Data Protection Officer317 Kamol Sukosol Building, Level 8, Unit 8C, Silom Road, Bangrak, Bangkok 10500, ThailandEmail: dpo@sbcinterlaw.comTelephone: +66 (0)2 631206412. Changes to this notice
We review this notice from time to time and post updates here with a new effective date. Significant changes will be made clear on the website, or communicated directly where appropriate.