Privacy Policy

This Privacy Policy describes how Pennyroyal Counsel ("we," "us," or "our"), operating from 19 Soi Ari 4, Phaya Thai, Bangkok 10400, Thailand, collects, uses, and handles personal information obtained through our website at pennyroy and through our client engagements.

1. Information We Collect

We collect personal information in the following ways:

• Contact enquiries: When you submit our contact form, we receive the name, email address, phone number (if provided), and message content you supply.
• Direct correspondence: Communications you send us by email or telephone may be retained as part of our records.
• Client engagements: During an engagement, we may hold notes and summaries agreed upon with you. The handling of engagement materials is governed separately by any engagement letter in place.
• Website usage data: When you visit our website, certain technical data may be collected automatically — including your IP address, browser type, referring URL, and pages visited — through server logs and analytics tools, subject to your cookie preferences.

2. How We Use Your Information

We use the personal information we collect for the following purposes:

• To respond to your enquiries and communicate about potential or ongoing engagements.
• To fulfil our obligations under any engagement agreement.
• To maintain records as required by applicable Thai law.
• To understand how our website is used and to improve it.
• To comply with legal obligations that apply to us.

We do not use your information for unsolicited marketing communications, nor do we sell or rent personal data to third parties.

3. Legal Basis for Processing

We process personal information on the following legal bases under the Thailand Personal Data Protection Act B.E. 2562 (PDPA):

• Consent: Where you have given clear consent for a specific purpose, such as submitting our contact form.
• Contractual necessity: Where processing is necessary to perform a contract with you or to take steps prior to entering a contract.
• Legitimate interests: Where we have a legitimate interest in processing your data — for example, to maintain business records or improve our website.
• Legal obligation: Where we are required to process data to comply with applicable law.

4. Sharing of Personal Information

We do not sell, trade, or otherwise transfer your personal information to outside parties, except in the following limited circumstances:

• Service providers: We may share data with trusted third-party service providers who assist us in operating our website or conducting our business, subject to confidentiality obligations.
• Legal requirements: We may disclose information if required to do so by law or in response to a valid legal process.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, with appropriate safeguards.

5. Cookies and Tracking Technologies

Our website may use cookies and similar technologies to improve the browsing experience and to understand how our site is used. For a full description of the cookies we use and how to manage them, please see our Cookie Policy.

6. Data Retention

We retain personal information for as long as necessary for the purposes set out in this policy, or as required by law. Contact enquiry records are typically retained for two years. Engagement records are held for the duration required by our professional and legal obligations, which may extend to seven years.

7. Security

We take reasonable technical and organisational measures to protect personal information from unauthorised access, disclosure, alteration, or destruction. Our client engagements are conducted with confidentiality as a foundational principle. However, no method of transmission over the internet is completely secure.

8. Your Rights

Under applicable Thai data protection law, you may have the right to access, correct, erase, or restrict processing of your personal data, to object to certain processing, to withdraw consent, and to lodge a complaint with the relevant authority. To exercise any of these rights, please contact us using the details below.

9. Third-Party Links

Our website may contain links to third-party websites. This Privacy Policy applies only to our website and services. We encourage you to review the privacy policies of any third-party sites independently.

10. Children's Privacy

Our services are directed at business owners and organisational leaders. We do not knowingly collect personal information from persons under the age of 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised effective date. Continued use of our website following the posting of changes constitutes your acknowledgement of those changes.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: