What data we collect

We collect data that is necessary to deliver legal services, meet regulatory obligations and improve our operations. Collection methods include direct submission by users, automated collection through the website, and receipt from trusted third parties.

Data you provide directly

When you contact us or engage our services, you may provide the following categories of personal data necessary for case handling and business communications:

• Identification details: full name, national ID or passport number when required for filings.
• Contact information: email address, telephone number, and business address.
• Company data: company name, registration numbers, partner details and business documents.
• Case-related documents: contracts, invoices, licenses, corporate records and other documents needed for legal work.
• Business and billing information: payment details, invoicing addresses and records necessary for billing and anti-funds laundering checks.
• Communications: notes from meetings, emails and other correspondence related to the provision of services.

Data collected automatically

When you visit exdorali.digital or interact with our digital tools, we may collect certain technical and usage data to operate the site and improve user experience:

• Device and browser information such as device type, browser version and operating system.
• IP address and approximate location data derived from network information.
• Usage data including pages visited, time on site, click paths and interaction metrics.
• Cookies and similar tracking technologies used to remember preferences and support functionality.
• Technical logs and error reports generated by our hosting and monitoring services.
• Analytics data aggregated to understand website performance and service demand.

Data received from third parties

In some cases we receive data from trusted third parties to facilitate service delivery or compliance checks. Examples include:

• Professional advisers and partners who supply documents or information on your behalf.
• Service providers such as payment processors, hosting providers and background check services.
• Public registers and governmental authorities when information is required for legal filings or regulatory compliance.

Legal bases for processing

We rely on appropriate legal bases when processing personal data. The applicable basis will depend on the purpose and context of processing:

• Performance of a contract: to fulfill our obligations under an engagement agreement with a client.
• Legal obligation: to comply with statutory or regulatory requirements, including tax and anti-funds laundering laws.
• Legitimate interests: for administrative functions, fraud prevention, network and information security, and internal business operations where those interests are balanced against individual rights.
• Consent: where you have explicitly agreed to a specific processing activity, such as marketing communications, and you may withdraw consent at any time.

Cookies and similar technologies

We use cookies to operate the website reliably, support essential features and collect analytics data to improve the site. You can manage cookie preferences through your browser or the cookie controls provided on the website.

Types of cookies used include essential cookies required for site functionality, performance cookies for analytics, and optional advertising or preference cookies that enhance the user experience.

Essential cookies enable core functionality. Performance cookies collect anonymous analytics. Preference cookies remember settings. Advertising cookies may be used by third-party services to tailor content.

You can control cookies via your browser settings and by adjusting preferences in the cookie banner at exdorali.digital. Disabling some cookies may affect the website’s functionality and your user experience.

Cookie policy and preferences

When we share data

We share personal data only with parties necessary to perform our services, comply with law, or support our operations under appropriate safeguards.

• Service providers and technology vendors that assist with hosting, communications, billing and analytics under strict contractual obligations.
• Professional advisers, external counsel or accountants when their involvement is necessary for the provision of legal services.
• Regulatory bodies, courts and law enforcement where disclosure is required by law or to comply with a valid legal process.
• Payment processors and banks for the purpose of processing transactions and complying with business regulations.
• Potential buyers or advisors in the event of a sale, transfer or reorganization of exdorali’s business, subject to confidentiality protections.
• Other parties where you have explicitly consented to the sharing of your information.

International data transfers

Personal data may be transferred to jurisdictions outside Thailand to enable service delivery or use of third-party platforms. Transfers are limited to recipients who provide adequate protections.

When data is transferred internationally, we adopt safeguards such as contractual clauses, data processing agreements, encryption and vetting of service providers to maintain appropriate levels of protection.

Data retention

We retain personal data only for as long as necessary to fulfill the purposes described, meet legal obligations and support legitimate business needs.

Client records and account information are retained for a period consistent with professional rules and Thai statutory retention periods, typically several years after the end of engagement, unless a different period is required.

Email correspondence and case-related communications are retained for case management and evidence purposes, subject to internal retention schedules and legal requirements.

System logs, access records and technical diagnostics are retained for security, auditing and troubleshooting for a limited period aligned with operational needs.

When retention periods expire or data is no longer necessary, we securely delete or anonymize personal data in accordance with our record management practices and applicable law.

Security of personal data

We implement reasonable technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction or disclosure. Security practices are reviewed regularly and updated as needed to reflect evolving risks.

• Encryption of data in transit and at rest for sensitive files and communications.
• Access controls and role-based permissions limiting data access to authorized personnel.
• Regular security reviews, staff training on data protection and incident response procedures.

Your rights

Subject to applicable law, individuals have rights regarding their personal data. Requests should be directed to the contact details provided below.

• Right of access: request confirmation of processing and a copy of personal data.
• Right to rectification: request correction of inaccurate or incomplete information.
• Right to erasure: request deletion of personal data where lawful and applicable.
• Right to restrict processing: request limitation of processing in specific circumstances.
• Right to data portability: receive personal data in a commonly used, machine-readable format where applicable.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: withdraw consent previously given without affecting processing before withdrawal.
• Right to lodge a complaint with a supervisory authority if you consider your rights have been breached.

How to exercise your rights

To exercise any privacy rights, please contact our privacy representative with a clear description of your request, relevant identifiers and supporting information. Requests can be made by mail, phone or through the website contact form. We will verify identity before fulfilling sensitive requests.

[email protected]

We aim to respond to verified requests promptly and typically within 30 days. Complex requests or those requiring coordination with third parties may take longer, in which case we will inform you and provide a timeline.

Marketing communications

We may send information about services, legal updates relevant to entrepreneurs, events, and client resources where you have consented or where we have a legitimate interest and the communication is relevant to your business relationship with exdorali. Messages will be limited in scope and frequency, and recipients may choose their preferences online or by contacting our office.

To stop receiving marketing communications, follow the unsubscribe link included in our messages or contact our office via the contact details on exdorali.digital. We will process unsubscribe requests promptly; operational messages about your account or engagements may still be sent.

Children's personal data

Our services and content are intended for business users and adults. We do not knowingly collect or solicit personal information from individuals under the age of 18. If we become aware that we have collected personal data from a minor without verified parental consent, we will take steps to delete that information as required by applicable law.

Third-party links

Our website may contain links to third-party websites and services for which exdorali is not responsible. Those sites have independent privacy practices; please review their privacy notices before providing personal data. Linking does not imply endorsement of third-party content or practices.