Privacy policy

This policy explains what personal data Sabai Legal collects when you use our website, send us a request, message us or become our client. It also explains why we need that data, who we share it with, how long we keep it and how you can control it.

The policy follows Thailand’s Personal Data Protection Act B.E. 2562 (2019), the PDPA. Section numbers below refer to that Act.

1. Who is responsible for your data

The data controller is Sabai Legal (“we”, “us”). Our full company details are set out in the contract with each client.

For any question about your personal data, contact us through the form on this website or the messengers listed on our Contacts page. Start your message with “Personal data” so we can pass it to the right person quickly.

2. What data we collect

When you send a request through the quiz or a form

• your name;
• your phone number;
• your preferred contact channel: WhatsApp, Telegram, LINE or a phone call;
• your quiz answers, such as the purpose of your stay, its length, your nationality or the type of company;
• your comment, if you leave one;
• an extra field on some forms, such as a company name, the number of transactions per month or a deal amount;
• confirmation that you have read this policy and agree to the processing of your request data.

Technical data sent with your request

• the address of the page you submitted the request from and the site you came from (referrer);
• the site language and the service you asked about;
• advertising source tags: UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the ad click ID fbclid;
• your IP address, used to protect the form from spam and repeated submissions and kept as part of the request record;
• the request number and a technical event ID;
• only if you accept marketing cookies: Meta identifiers from the _fbp and _fbc cookies and your browser details (user agent).

When you message or call us

Your phone number or username, your profile name and the content of our conversation. WhatsApp, Telegram and LINE also process this data under their own terms.

When you become our client

To provide a service we need documents and information about your case. Depending on the service, this may include:

• passport details and copies, visas and entry stamps;
• your address in Thailand;
• information about your work and income, and bank statements;
• company documents and details of shareholders and directors;
• marriage and birth certificates and other family documents;
• contracts and correspondence with counterparties;
• accounting and tax documents.

Sensitive data

Some services require sensitive data under Section 26 of the PDPA because the law or an authority asks for it, for example a criminal record certificate for a DTV visa or a medical certificate for a work permit. We process such data only with your explicit consent or where the law expressly allows it, and only as far as your case requires.

Children’s data

Our services are meant for adults. If a child is involved in a case, for example a family visa, the child’s data is provided by the parents or legal guardians, who also give consent on the child’s behalf where the law requires it (Section 20 of the PDPA).

If you do not provide data

Without your name and phone number we cannot reply to your request. Without the documents required by law or by an authority we cannot provide the service. Consent to marketing cookies is optional: the website and the forms work without it.

3. Why we use your data and on what legal basis

The PDPA allows personal data to be processed only on a lawful basis. We rely on the following:

Purpose	Legal basis under the PDPA
Reply to your request, contact you the way you prefer, review your situation and prepare an offer	Steps taken at your request before entering into a contract, Section 24(3)
Provide the service: prepare and file documents, represent you before authorities, keep you updated on your case and remind you of deadlines	Performance of a contract, Section 24(3)
Keep accounting and tax records, respond to lawful requests from authorities	Compliance with the law, Section 24(6)
Log requests in our CRM and managers’ chat, see which ad a request came from, check the quality of our work	Legitimate interests, Section 24(5)
Protect the website and forms from spam, bots and abuse, and keep a backup copy of each request so it is not lost	Legitimate interests, Section 24(5)
Protect our rights and our clients’ rights in disputes	Legitimate interests, Section 24(5); for sensitive data, Section 26
Meta Pixel and Conversions API: measure ad performance and show ads to people who will find them useful	Your consent, Section 19
Process sensitive data needed for your case	Explicit consent or another basis under Section 26

Where we rely on legitimate interests, we make sure they do not override your rights and freedoms. You can object to this processing (see section 8).

We do not sell personal data, and we do not make decisions about you based solely on automated processing: a person reviews every request.

4. Cookies and similar technologies

The website uses two categories of cookies:

• Necessary cookies are always on. Without them the site cannot remember your language or your cookie choice, and your request would reach us without its source.
• Analytics and advertising cookies are switched on only after you consent in the cookie banner.

Until you consent, the Meta Pixel code is not loaded and no data is sent to Meta. Referral source tags (UTM and fbclid) are stored even without consent, because we need them to process your request and know how you found us. Without your consent these tags are not sent to Meta.

Name	Category	Purpose	Retention
sl_consent	Necessary	Remembers your choice in the cookie banner	6 months
sl_utm	Necessary	Stores the source tags of your first visit (UTM, fbclid) so they can be added to your request	30 days
lang	Necessary	Remembers your site language	1 year
sl_quiz:… (browser session storage)	Necessary	Keeps your quiz answers if you switch to a messenger and come back	Until you close the tab or send the request
_fbp (Meta)	Analytics and advertising	Browser identifier used to measure Meta ads	Up to 90 days
_fbc (Meta)	Analytics and advertising	Stores the ID of your click on a Facebook or Instagram ad	Up to 90 days

Once you consent, Meta may also use its own cookies on its own domains under its cookie policy.

Managing cookies. You can change your choice or withdraw consent at any time using the “Cookie settings” link in the site footer. After you withdraw consent, the Meta Pixel is not loaded from the next page on. You can delete _fbp and _fbc cookies that are already stored in your browser settings. Your browser can also block cookies entirely, although some site features may then work less well.

5. Who we share data with

We share only the data needed for a specific purpose. Service providers that process data on our behalf must keep it confidential and may not use it for their own purposes (Section 37(2) of the PDPA).

• Telegram: the managers’ work chat, where new requests arrive straight away, and a backup chat in case of a failure.
• Our CRM provider: we keep records of requests and clients in a CRM system.
• Hosting provider: the website server in the Netherlands, used for hosting the site, processing submitted forms and keeping backup copies of requests.
• Meta Platforms: only if you consent to marketing cookies. We send website events: page views, quiz start and steps, request submission and clicks on messenger buttons. For a request we also send your phone number and name in hashed form (SHA-256), your IP address, browser details and the _fbp and _fbc identifiers. Meta processes this data under its own privacy policy.
• WhatsApp, Telegram and LINE, if you talk to us through these messengers.
• Specialists and partners we bring into your case, such as lawyers, accountants and translators. They receive only what they need for the work and must keep it confidential.
• Authorities, banks and other organisations where we file documents on your instructions, for example the Immigration Bureau, the Department of Business Development (DBD), the Revenue Department and the Ministry of Labour.
• Authorities and courts where disclosure is required by law or a court order.

6. International transfers

Some of our providers, namely our hosting provider (server in the Netherlands), Telegram, Meta and our CRM provider, may store and process data on servers outside Thailand. We transfer data abroad:

• where it is needed to reply to your request or perform our contract with you (Section 28(3) of the PDPA);
• to Meta, on the basis of your consent to marketing cookies (Section 28(2) of the PDPA);
• in other cases, with appropriate safeguards such as the provider’s contractual data protection commitments (Section 29 of the PDPA).

Please note that the level of data protection in the recipient’s country may differ from Thailand’s. We choose providers that apply generally accepted security measures.

7. How long we keep data

• Backup copy of your request on the website server: 30 days, then deleted automatically.
• Counters that block repeated submissions (by IP address): about 10 minutes.
• Your request in the CRM and the managers’ chat: as long as we need it to handle your enquiry. If no contract follows, we delete or anonymise the data once it is no longer needed, or sooner if you ask.
• Correspondence and client case files: for the whole period of the service and, after it ends, for as long as Thai law requires (for example, accounting and tax rules) or as needed to establish or defend legal claims.
• Cookies: as shown in the table in section 4. Quiz answers in your browser are kept until you close the tab or send the request.
• Data sent to Meta: under Meta’s rules.

When the retention period ends, we delete or destroy the data or anonymise it so that it can no longer identify you.

8. Your rights

Under the PDPA you have the right to:

• access your data and get a copy, and find out how we obtained data you did not consent to (Section 30);
• receive your data in a machine-readable format or ask us to send it to another controller where technically possible (Section 31);
• object to processing based on legitimate interests, and to direct marketing (Section 32);
• have your data erased, destroyed or anonymised if it is no longer needed, you withdraw consent, you object to the processing or the data was processed unlawfully (Section 33);
• restrict the use of your data, for example while its accuracy is being checked (Section 34);
• have your data corrected or completed if it is inaccurate, out of date or incomplete (Sections 35 and 36);
• withdraw your consent at any time, as easily as you gave it. Withdrawal does not affect processing carried out before it (Section 19);
• lodge a complaint if you believe we are breaching the PDPA (Section 73). Complaints are received by the Office of the Personal Data Protection Committee of Thailand (PDPC, pdpc.or.th).

How to exercise your rights. Contact us through the website form or the messengers on our Contacts page. We may ask you to confirm your identity so that we do not hand your data to someone else. We will reply without undue delay and no later than 30 days after receiving your request.

Some rights are limited by law. For example, we cannot delete documents we are legally required to keep or need to establish or defend legal claims. If we decline a request, we will explain why.

If you have a concern, please contact us first and we will try to resolve it quickly. Your right to contact the PDPC remains unaffected.

9. How we protect your data

• The website and forms work only over a secure HTTPS connection.
• Only the staff and specialists who need requests and case files for their work can access them.
• Access keys to our services are kept in protected settings, separate from the website code.
• The form is protected against bots and bulk submissions.
• Our providers and partners are bound by confidentiality.

If a personal data breach occurs and is likely to put people’s rights at risk, we will notify the PDPC Office without delay and, where feasible, within 72 hours. If the risk is high, we will also inform you and explain what we are doing about it (Section 37(4) of the PDPA).

No system is completely secure. If you notice anything suspicious, for example someone messaging you on behalf of Sabai Legal from contacts not listed on our Contacts page, please let us know.

10. Changes to this policy

We update this policy when our processes, services or the law change. The new version is published on this page, with its date shown at the top. We will announce significant changes on the website, and if the law requires your consent for a new purpose, we will ask for it again.

11. How to contact us

For questions about your personal data or this policy, contact us through the website form or the messengers listed on our Contacts page. Our service terms are set out separately in the Terms of service.