Effective date : 17/10/2026

Alpha Legal (Thailand) Co., Ltd. (the “Firm”), as data controller, issues this notice to explain how it collects, uses and discloses your personal data under Section 23 of the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”).

1. Data controller and contact

Alpha Legal (Thailand) Co., Ltd., 32nd–33rd Floor, Interchange 21 Building, 399 Sukhumvit Road, Klongtoey-Nua, Wattana, Bangkok 10110, Thailand

Privacy contact : Veronika Muttenthaler / Partner

Email : [email protected]

Tel : (+66) 064-474-1697

2. Who this notice covers

• Clients, including directors, shareholders, employees and contact persons of corporate clients
• Persons who contact the Firm for advice or send documents for review before engaging the Firm (“Prospective Clients”)
• Opposing parties, counterparties, opposing counsel, witnesses, experts and other persons involved in matters handled by the Firm
• General contacts, seminar attendees, newsletter recipients, and visitors to the Firm’s website and office
• Individual suppliers and contact persons of the Firm’s service providers

3. Personal data we collect

4. Sources of data

We obtain data directly from you, from our clients (where you are an opposing party, witness or related person), from courts and government authorities, and from public sources such as company registries.

5. Purposes and legal bases

6. Disclosure

We may disclose data, only as necessary, to:

• Courts, arbitral tribunals and government authorities
• Opposing parties or their counsel, only as needed to carry out the matter on the client’s instructions
• Foreign counsel, experts, interpreters and translators engaged on a matter
• IT, cloud, email, document storage and destruction service providers
• Auditors, advisers and the Firm’s professional indemnity insurers

The Firm does not sell personal data. It will not disclose information or documents received from a Prospective Client or client to an opposing party unless authorised or required by law.

7. International transfers

We may transfer data outside Thailand where needed for a matter, for example when working with foreign counsel, or when using cloud services hosted abroad. Transfers follow Sections 28 and 29 of the PDPA, for example where the destination has adequate protection, the transfer is necessary to perform our contract with you, or appropriate safeguards such as standard contractual clauses are in place.

8. Retention

After the retention period, data is deleted, destroyed or anonymised.

9. Your rights

You may request access to and a copy of your data, data portability, objection, erasure, restriction, rectification, and withdrawal of consent under Sections 19 and 30 to 36 of the PDPA. You may also lodge a complaint with the Expert Committee at the Office of the Personal Data Protection Committee.

Send requests to [email protected]. We will acknowledge your request promptly and act on it within 30 days of receipt. We may refuse a request where the law allows, for example where it would affect the rights of others, our duty of confidentiality to clients, or the exercise of legal claims. We will give you written reasons for any refusal.

10. Security

Access to matter files is limited to the people working on that matter, and we apply appropriate technical and organizational measures. We will notify the Office of the Personal Data Protection Committee of a personal data breach within 72 hours of becoming aware of it, as required by law.

11. If you do not provide data

If you do not provide necessary data, we may be unable to accept or perform the engagement.

12. Changes to this notice

We may update this notice from time to time and will publish the latest version on www.alpha-legal.co.th. If the Thai and English versions differ, the Thai version prevails.

Effective date : 17/10/2026

Alpha Legal (Thailand) Co., Ltd. (the “Firm”), as employer and data controller, issues this notice to job applicants, employees, lawyers, interns and former employees (“you”) under Section 23 of the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”).

1. Data controller and contact

Alpha Legal (Thailand) Co., Ltd., 32nd–33rd Floor, Interchange 21 Building, 399 Sukhumvit Road, Klongtoey-Nua, Wattana, Bangkok 10110, Thailand

Privacy contact : Veronika Muttenthaler / Partner

Email : [email protected]

Tel : (+66) 064-474-1697

2. Data we collect

3. Purposes and legal bases

4. Disclosure

We may disclose data, only as necessary, to the Revenue Department, the Social Security Office and other authorities, payroll banks, insurers and benefit providers, payroll and IT service providers, auditors, and the Lawyers Council of Thailand where required.

5. Retention

6. Your rights

You may request access to and a copy of your data, data portability, objection, erasure, restriction, rectification, and withdrawal of consent under Sections 19 and 30 to 36 of the PDPA. You may also lodge a complaint with the Expert Committee at the Office of the Personal Data Protection Committee.

Send requests to [email protected] or Human Resources. We will act on requests within 30 days of receipt.

7. Your duties regarding client data

You must comply with the Firm’s Personal Data Protection Policy and report any actual or suspected personal data breach to the privacy contact immediately.

8. Changes to this notice

We may update this notice from time to time and will inform you. If the Thai and English versions differ, the Thai version prevails.

Approved by : Veronika Muttenthaler / Partner

Effective date : 17/10/2026   
Next review : 17/10/2027

This policy sets the internal rules that everyone at Alpha Legal (Thailand) Co., Ltd. (the “Firm”) must follow when handling personal data, to comply with the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”) and the Firm’s duty of confidentiality to clients.

1. Scope

This policy applies to all partners, lawyers, employees, interns and contractors of the Firm. It covers personal data in every form: paper, electronic files, email and messages in messaging apps.

2. Responsibilities

3. Core principles

1. Collect, use and disclose data only with a legal basis and for the purposes notified.
2. Use only the data needed for the matter; do not request or pass on more than necessary.
3. Keep data no longer than the period set in the ROPA.
4. Keep data secure and confidential at all times.
5. Record key decisions in writing so compliance can be demonstrated.

4. Legal bases and sensitive data

• Client data: contract or pre-contractual steps (Section 24(3)).
• Opposing parties, witnesses and other persons in a matter: legitimate interests (Section 24(5)); consent is not required.
• Sensitive data, such as health or criminal records: only where necessary to establish, exercise or defend legal claims (Section 26(4)) or with explicit consent, and accessible only to those working on the matter.
• Newsletters and marketing: prior consent, with an easy way to unsubscribe.

5. Prospective clients and new matters

1. Run a conflict check on party names before opening substantive documents.
2. If there is a conflict, tell the prospective client and accept no further documents. Store any documents already received separately; no one acting for the other side may access them.
3. Store prospective client documents in a restricted folder, accessible only to assigned people, and never forward them outside the Firm.
4. Always confirm in writing whether the Firm will act.
5. Provide the privacy notice with the intake form or engagement letter.

6. Privacy notices

Publish the privacy notice on the website, attach it to every engagement letter, link it in the Firm’s email footer, and give it to employees and applicants when their data is first collected.

7. Record of processing activities (ROPA)

The Privacy Officer keeps the ROPA required by Section 39 up to date, reviews it at least once a year, and updates it immediately when a new activity, system or service provider is introduced. The ROPA must be ready to provide to the Office of the Personal Data Protection Committee on request.

8. Security measures

• Grant access to matter files per matter (need-to-know) and keep access logs for at least [1 year].
• Use multi-factor authentication (MFA) for email and document storage.
• Do not send client documents through personal email or messaging accounts unless approved.
• Check the recipient’s name and email before every send; encrypt files containing sensitive data.
• Lock screens when away from the desk; keep paper files in locked cabinets.
• Disable user accounts on the day an employee leaves.

9. Processors and international transfers

Service providers that process data on the Firm’s behalf, such as IT, cloud, translators or document destruction firms, must sign a data processing agreement under Section 40. Transfers outside Thailand must meet Section 28 or 29 and be recorded in the ROPA.

10. Retention and destruction

Keep data for the periods set in the ROPA, then delete or destroy it and record the destruction. Do not delete data relating to an open data subject request, complaint or regulatory inquiry.

11. Data subject requests

Letters from the Office of the Personal Data Protection Committee and complaints go to the Privacy Officer and the Managing Partner on the day received.

12. Personal data breaches

1. Anyone who discovers or suspects a breach reports it to the Privacy Officer immediately, and within 24 hours at the latest.
2. The Privacy Officer contains the breach, for example by asking a wrong recipient to delete documents or disabling a user account.
3. Assess the risk to data subjects’ rights and freedoms.
4. If there is a risk, the Managing Partner approves notification to the Office of the Personal Data Protection Committee within 72 hours of becoming aware. If the risk is high, notify affected data subjects, with remedial steps, without delay.
5. Log every incident in the breach register, including those assessed as not notifiable, with reasons.
6. Always reply in writing to anyone who reports that their data was leaked, with the outcome of the investigation.

13. Training

Everyone completes training on this policy within 30 days of joining and refreshes it at least once a year. The Privacy Officer keeps attendance records.

14. Breach of this policy

Breach of this policy may lead to disciplinary action under the Firm’s work rules.

15. Review

This policy is reviewed at least once a year, or when the law or the Firm’s operations change. If the Thai and English versions differ, the Thai version prevails.