Privacy

Data controller: Pride Legal Co., Ltd., registered office at TT02, 24th Floor, Chamchuri Square Building, 319 Phayathai Road, Pathumwan, Bangkok 10330, Thailand, company registration no. 0105569087213.

Privacy contact / Data Protection Officer: Tanik Tangburanakij, email help@pridelegal.co.th, telephone +66 64 959 0676. Use these details for any question about this Notice or to exercise your rights.

• Identity and account: full name, email address, account password (held in encrypted or hashed form), preferred language.
• Nationality and eligibility: the nationality of each partner, civil status (that you are single and free to marry), and the document route you choose.
• Travel and scheduling: intended arrival date and time, preferred region and district, preferred wedding date, and document start dates.
• Identity and civil-status documents: passport, affidavit or certificate of freedom to marry, and the relationship evidence you upload (for example proof of shared payments, photographs, and travel records).
• Communications: messages you send us by WhatsApp, email, the portal, or other channels, and our replies.
• Payment: we take payment through third-party providers. We receive confirmation and limited transaction details; we do not store full card numbers on our systems.
• Website and device data: information your browser provides, and the answers the planner stores locally in your browser before you create an account.

Sensitive personal data. The following are sensitive personal data under section 26 of the PDPA, which we process only with your explicit consent: personal data that reveals your sexual orientation (which is inherent in a same-sex marriage service); and any religion, ethnicity, or similar information that appears in your passport, civil-status documents, or supporting documents.

We collect personal data directly from you, through the planner, your account, your uploads, and your messages; from your partner, where you apply together; from public authorities and from your embassy or consulate, while preparing and legalizing your documents; and from partners and service providers you ask us to engage on your behalf.

• To provide the service — to prepare, translate, legalize, and submit your documents, and to book the embassy, the Ministry of Foreign Affairs (MFA), the district office, and your timeline. Basis: performance of our agreement with you, and your consent.
• To process sensitive data (data revealing sexual orientation, and any sensitive content of your documents) for the purposes above. Basis: your explicit consent.
• To manage your account — portal access, your timeline, and our communications with you. Basis: performance of our agreement, and your consent.
• To take and reconcile payment. Basis: performance of our agreement, and our legal obligations (accounting and tax).
• To comply with law — tax, accounting, and other legal and regulatory duties, and to establish, exercise, or defend legal claims. Basis: legal obligation, and legitimate interest.
• To secure and improve our website and services. Basis: legitimate interest.
• To send you information about partner services, offers, and updates, where you have opted in. Basis: your consent, which you may withdraw at any time.

We disclose your personal data only as needed to deliver the service or as required by law. Recipients may include: our lawyers, staff, and assistants working on your matter; certified translators and legalization agents; the Thai Ministry of Foreign Affairs and the district registration office; your embassy or consulate, where an appointment or certificate is required; payment providers to process payment; IT, cloud, and document-storage providers that host our systems; partner venues, hotels, and service providers that you ask us to arrange, limited to the data needed for that booking; and professional advisers, and government authorities or courts where the law requires.

We do not sell your personal data. We use advertising platforms only to measure our own advertising, as section 11 describes.

Delivering your marriage, and any international use of your certificate, may require us to send your personal data outside Thailand — for example to your embassy or its home authority, to cloud providers that store data abroad, to international payment providers, or to a partner in another country that you ask us to engage. Some destinations may not have data-protection laws that the PDPA treats as adequate. Where that is so, we transfer your data on the basis of your consent (recorded below) or another lawful ground under sections 28 to 29 of the PDPA, and we take reasonable steps to keep it protected.

We keep your personal data only for as long as necessary for the purposes above. As a general rule we keep your matter file for the duration of your engagement and for up to 10 years afterwards, to meet legal, tax, accounting, and professional record-keeping obligations and to answer any later questions about your marriage. We keep accounting records for at least the period required by Thai law. Sensitive documents are deleted or anonymized sooner where they are no longer needed. After the retention period we delete or anonymize your personal data.

• Access and copy: ask for a copy of your personal data and information about how we use it.
• Rectification: ask us to correct data that is inaccurate or incomplete.
• Erasure: ask us to delete or anonymize your data where the law allows.
• Restriction: ask us to suspend the use of your data in certain cases.
• Portability: ask us to send certain data to you or another controller in a machine-readable form.
• Objection: object to certain processing of your data.
• Withdraw consent: withdraw any consent you have given, at any time.

To exercise any right, contact us using the details in section 1. We may need to verify your identity first. You also have the right to complain to the Personal Data Protection Committee (PDPC) in Thailand.

You may withdraw your consent at any time, and we will make this as easy as giving it. If you withdraw consent that we rely on to deliver the service, including consent to process the sensitive personal data the service requires, we may no longer be able to continue your marriage registration. Withdrawal does not affect the lawfulness of any processing carried out before you withdrew, and it does not affect processing we are required or permitted to carry out on another legal basis.

We use reasonable organizational and technical measures to protect your personal data, including access controls, encrypted storage and transfer where appropriate, and limiting access to staff who need it. No system is perfectly secure, but we work to keep your data safe and will notify you and the PDPC of a data breach where the law requires.

Our website and planner store information in your browser, including the answers you give the planner before you create an account. This stays on your device until you create an account or clear it.

Our website sets two cookies of its own: pl_vid, a random identifier kept for about 13 months, and pl_ses, which lasts one visit. They record which page and which advertisement brought you here, and they link your conversation with ELSA to your visit.

We use analytics to understand how the public parts of our website are used: cookieless visit and performance analytics (Vercel), session analytics that replay anonymized page interactions with anything you type masked (Microsoft Clarity), and visit measurement (Google Analytics). These run on our public pages only — never inside your client portal.

To measure our advertising, tags from Google, Meta and TikTok on our public pages record when a visitor who came from an advertisement starts the planner, contacts us on WhatsApp, creates an account or pays the platform fee. When the platform fee is paid, our server also tells Meta and TikTok, with your email address in hashed (irreversibly scrambled) form, so that we can measure which advertisement worked. We do not sell your personal data. You can block these cookies and tags in your browser settings or with an ad blocker without affecting the planner or the portal.

When you chat with ELSA, our website assistant, we keep a record of the conversation, linked to an identifier stored in your browser, so that we can improve our answers and follow up your request. We never keep passwords or verification codes. ELSA’s replies are produced by an AI model provided by Anthropic.

We may update this Notice. We will post the current version on our website with its effective date, and where a change is significant we will tell you and, where required, ask for your consent again.

Please confirm your consent below. Online, you give consent by ticking the boxes and selecting “I consent”. Ticking is required where shown; the marketing item is optional.

• (1) General consent. I have read and understood this Notice. I consent to Pride Legal collecting, using, and disclosing my personal data as described, for the purposes set out above.
• (2) Explicit consent to sensitive personal data. I expressly consent to Pride Legal collecting, using, and disclosing my sensitive personal data — including data that reveals my sexual orientation and any sensitive information in my passport, civil-status documents, and supporting documents — for the purpose of providing the marriage registration service.
• (3) Consent to international transfer. I consent to Pride Legal transferring my personal data outside Thailand as described in section 6, including to destinations that may not provide protection equivalent to the PDPA.
• (4) Optional — marketing. I would like to receive information about partner services, offers, and updates from Pride Legal. I understand I can withdraw this at any time.

1.1 This policy states how Pride Legal collects, uses, discloses, keeps and deletes personal data under the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”). It binds every staff member and every processor that handles personal data for Pride Legal.

1.2 It covers the personal data of clients and their partners; prospective clients and people who contact Pride Legal through the website, ELSA, WhatsApp or e-mail; referral partners and their contacts; translators, witnesses, couriers and other suppliers; staff members and job applicants; and people photographed or recorded for Pride Legal’s channels.

1.3 Pride Legal is the data controller of that personal data. Where Pride Legal processes personal data on the written instructions of another business — for example a hotel that sells the service under its own name — Pride Legal acts as that business’s processor and follows its instructions as well as this policy.

1.4 The privacy documents work as one set: this policy states the rules; the Privacy Notice for clients and website users and the Privacy Notice for staff members and job applicants state what Pride Legal tells the people whose data it holds; the separate Consent Forms record what those people agree to. Until version 1.0 of this policy is issued, where the Privacy Notice published at pridelegal.co.th/privacy differs from this policy, the Privacy Notice applies.

1.5 Staff member means the Director, every employee (including an employee on probation) and every intern. Processor means a person or business that processes personal data on Pride Legal’s behalf and on its instructions.

2.1 The Director is accountable for compliance, approves this policy, approves every processor and every new use of personal data, and provides the resources the rules require.

2.2 The Data Protection Officer is Tanik Tangburanakij, reachable at help@pridelegal.co.th and +66 64 959 0676. The Data Protection Officer advises staff, monitors compliance, keeps the record of processing (clause 14), handles requests (clause 12) and breaches (clause 13), and deals with the Office of the Personal Data Protection Committee. Because the core activity of Pride Legal is processing data that it treats as sensitive personal data (clause 5.1), Pride Legal appoints the Data Protection Officer under section 41(3) of the PDPA, which sets no minimum size, and gives the Officer’s contact details to the Office of the Personal Data Protection Committee.

2.3 Every staff member handles only the personal data needed for the matters assigned to them, follows clauses 5 to 9, and reports any breach at once under clause 13.

3.1 Pride Legal collects only the personal data that a stated purpose needs, tells people what it collects and why at or before collection, uses the data only for that purpose or a purpose compatible with it, keeps it accurate, keeps it no longer than clause 8 allows, protects it under clause 9, and keeps records that show it has done so.

3.2 A new purpose requires a new notice and, where consent is the basis, a new consent before the data is used for it.

4.1 Pride Legal processes personal data only on one of the bases below (sections 24 and 26 of the PDPA).

4.2 Legitimate interest is relied on only after the Data Protection Officer has recorded, in the record of processing, why the interest is not overridden by the rights of the people concerned (a legitimate interest assessment, which the PDPC’s guidelines recommend).

5.1 In this business, sensitive personal data means above all data that reveals a client’s sexual orientation, because a same-sex marriage record reveals it. Section 26 of the PDPA lists “sexual behaviour” among sensitive personal data, and neither the Act nor the Personal Data Protection Committee has said whether data that reveals sexual orientation falls within it; Pride Legal applies the stricter reading and treats that data as sensitive personal data. It also includes religion, race or ethnicity shown in passports or civil-status documents, health data (for example a staff member’s medical certificate), and criminal-record data where a country requires a police certificate.

5.2 Pride Legal collects sensitive personal data only with the person’s explicit consent (Consent Form A, or the consent step in the planner and ELSA), or where another exception in section 26 applies. Each partner in a couple gives consent for themselves; one partner cannot consent for the other.

5.3 Sensitive personal data is seen only by the staff assigned to the matter; is never used in marketing without a separate consent (Consent Form B); and is never disclosed to anyone — including a family member, an employer or a partner business — without the person’s consent or a legal duty.

5.4 Clients from states that criminalise same-sex relations. Pride Legal sends no data to the home state’s authorities unless the client has chosen that document route in writing; contacts the client only through the channel the client chose; and tells the client, before the registration, that the Thai marriage register is not public but that relatives such as parents may qualify as interested persons entitled to see or copy it.

6.1 Pride Legal gives a notice at or before collection: the Privacy Notice to clients, prospective clients and website users (published at pridelegal.co.th/privacy, shown at account creation and at the consent step in ELSA, and linked in the first reply on WhatsApp and e-mail); the staff Privacy Notice to staff members and job applicants; and the text of Consent Form B to people photographed or recorded.

6.2 Consent is asked for in writing or electronically, separately from any other terms, in plain words, one item per purpose. Consent is never placed inside the Service Agreement and is never made a condition of the service for data the service does not need (section 19 of the PDPA).

6.3 For every consent, Pride Legal records who gave it, which items, the version of the text, the date and time, and how it was given (a signed form or a tick in the portal). A withdrawal is recorded the same way and acted on within seven days.

6.4 The second partner in a couple has no portal account. That partner gives consent on a signed Consent Form A or through a consent link sent to that partner’s own e-mail address.

7.1 Company channels only. Client personal data is received and kept only in the company systems: the client portal, Elsa, the office server, the company Microsoft 365 accounts and the company WhatsApp Business number. No staff member uses a personal WhatsApp or LINE account, a personal e-mail address or personal cloud storage for client data.

7.2 Devices. Staff use devices administered by Pride Legal, locked when unattended. A document downloaded to a device for a task is deleted from the device once the task is done.

7.3 AI tools. Client personal data is entered only into AI tools that the Director has approved under a data processing agreement, and never into a personal or free AI account.

7.4 Original documents. An original document received from a client is logged on receipt, kept in the locked cabinet, and returned against the client’s signature as soon as the step that needs it is complete.

7.5 Paper. Documents are printed only where an office requires paper; copies no longer needed are shredded.

7.6 Sharing. Personal data is disclosed only to the recipients named in the notices, and only what that recipient needs. A copy of a passport or a civil-status document is never sent to a hotel, a planner or any other partner.

7.7 Photographs. Clients are photographed only with Consent Form B. Officials and other members of the public are not photographed.

8.1 Pride Legal keeps personal data for the periods below and then deletes it or makes it anonymous, so that no person can be identified from it.

8.2 Deletion runs automatically where the system supports it. Where it does not, the Data Protection Officer carries it out at the December review and records it.

9.1 Organisational measures. Access is given by role and only for assigned matters; access is removed on the day a person leaves; every employment contract carries a confidentiality duty; staff are trained under clause 15.

9.2 Technical measures. Client records are kept on Pride Legal’s own server in Thailand, whose disk is fully encrypted; the server accepts no connection from the open internet, and staff reach it only through an encrypted private network; the application cannot delete records and every change is logged; records are backed up every night in encrypted form; card payments are handled by Stripe, so card numbers never reach Pride Legal; location data is removed from uploaded photographs. These measures follow the PDPC Notification on Security Measures B.E. 2565 (2022).

9.3 Physical measures. Original documents are kept in a locked cabinet in the office, in a building with controlled entry.

10.1 A processor is engaged only with the Director’s approval and under a written data processing agreement that limits it to Pride Legal’s instructions, requires security and confidentiality, and requires it to report a breach to Pride Legal within 72 hours, and requires it to return or delete the data at the end (section 40 of the PDPA). The providers in use on the date of this policy are listed below. Where a provider also uses data for its own purposes — the advertising platforms and Stripe — it does so as a separate controller under its own terms.

10.2 District offices, the Ministry of Foreign Affairs, embassies and consulates, courts and other authorities receive personal data under their own legal powers; they are recipients, not processors.

11.1 Personal data leaves Thailand when it is sent to a client’s embassy or home authorities, when it is stored by a processor in clause 10 that holds data abroad, and when a client asks Pride Legal to engage a partner in another country.

11.2 Pride Legal transfers personal data abroad only on a ground the PDPA allows: that the transfer is needed to perform the contract with the client or steps the client asked for; that the processor applies safeguards recognised by the Personal Data Protection Committee, such as the ASEAN Model Contractual Clauses or the EU standard contractual clauses; or, where no other ground applies, the person’s consent given after being told that the destination may not protect the data to the Thai standard (sections 28 and 29 of the PDPA, and the two PDPC notifications on transfers abroad B.E. 2566, in force since 24 March 2024).

12.1 Every person may ask for access to and a copy of their data, for its transfer to them or to another controller, for its correction, deletion or restriction, may object to its use, may withdraw consent, and may complain to the expert committee of the Personal Data Protection Committee (sections 19, 30 to 36 and 73 of the PDPA).

12.2 Pride Legal accepts a request in person, by post or by e-mail. A staff member who receives one passes it to the Data Protection Officer the same day. The Data Protection Officer records it in the Rights Request Log, confirms the person’s identity within 15 days from contact details already held (asking for a new identity document only where there is no other way), and answers within 30 days of receipt, free of charge; the period is extended by at most 30 days, and only with written reasons given to the person (section 30 of the PDPA and the PDPC Notification on access requests B.E. 2569 (2026)). A refused request is answered with the reason and with the person’s right to complain, and the refusal is entered in the record of processing.

12.3 A person may use Consent Form C, but no form is required.

13.1 A breach is any event in which personal data is lost, or is accessed, used, changed or disclosed without authority: a lost telephone, an e-mail sent to the wrong person, a document uploaded to the wrong client’s portal, or an account taken over by another person.

13.2 A staff member who learns of a breach, or suspects one, telephones the Data Protection Officer at once.

13.3 The Data Protection Officer contains the breach, assesses the risk, notifies the Office of the Personal Data Protection Committee without delay and, where feasible, within 72 hours of Pride Legal becoming aware of it, unless it is unlikely to create a risk to the people concerned, and notifies those people without delay, with the steps they can take, where the risk is high (section 37(4) of the PDPA and the PDPC Notification on breach notification B.E. 2565 (2022)). Every breach is entered in the Breach Log, including one that was not notified.

13.4 A breach that involves client documents or data that reveals sexual orientation is treated as high risk.

14.1 The Data Protection Officer keeps a record of every processing activity — its purpose, the data and the people concerned, the basis, the recipients, any transfer abroad, the retention period and the security measures — in the company SharePoint, and updates it whenever a system or a processor is added (section 39 of the PDPA). The small-business exemption does not apply to Pride Legal, because its processing is not occasional, involves sensitive personal data, and requires a Data Protection Officer.

15.1 Every staff member reads this policy within the first week of starting work and every December, and signs the acknowledgment in the Work Rules.

15.2 A breach of this policy is a disciplinary matter under the Work Rules. Deliberate disclosure of a client’s sensitive personal data is a serious case for which the Work Rules do not require a prior warning.

16.1 The Data Protection Officer reviews this policy, the record of processing, the Rights Request Log and the Breach Log every December. A change produces a new version; a significant change to a Privacy Notice is announced to the people concerned and, where consent is the basis, consent is asked for again.

17.1 This policy takes effect on the date of the Director’s signature below.

For Pride Legal Co., Ltd.
Signed: Tanik Tangburanakij
Director and Data Protection Officer · 7 October 2026