Privacy Policy

Who is responsible

The controller responsible for processing your data through this website is Oberhauser Law Group. You can reach us by email at office@oberhauser.com or by phone at +66 91 701 2646. The postal address is listed in our Imprint.

Data we collect through the contact form

When you submit the contact form, we process the information you enter: your name, email address, phone number (optional), the legal-concern category you select, and the message you write. We use this solely to respond to your enquiry and to advise you on the legal matter you describe.

Lawful basis under Thailand’s Personal Data Protection Act (PDPA): steps taken at your request before a possible engagement, and our legitimate interest in responding to enquiries (PDPA Section 24). Providing the data is voluntary, but without it we cannot reply.

How the contact form is delivered (EmailIt)

Form submissions are delivered to us as email through EmailIt, an email delivery service that acts as our processor. The data you enter is transmitted to EmailIt to route the message to our inbox. Where EmailIt processes the data on servers outside Thailand, any such cross-border transfer is made in accordance with the cross-border-transfer rules of the PDPA (Sections 28–29).

Spam protection (Cloudflare Turnstile)

To protect the contact form against automated abuse, we use Cloudflare Turnstile. When you submit the form, Turnstile runs a challenge in your browser and sends a token to Cloudflare to confirm you are likely human. This involves processing technical data (such as your IP address and browser characteristics) by Cloudflare. Lawful basis: our legitimate interest in keeping the form free of spam and abuse (PDPA Section 24).

We use Turnstile in “invisible” mode (no visible challenge appears). For details on how Cloudflare processes this data, please refer to Cloudflare’s Privacy Policy and the Turnstile Privacy Addendum: https://www.cloudflare.com/application-services/terms/turnstile-privacy-policy/.

Analytics and advertising (Google Tag Manager, Analytics, Ads)

We use Google Tag Manager to load Google Analytics 4 and Google Ads. Analytics helps us understand how the site is used; Google Ads measures the performance of our advertising and is used for remarketing (showing our ads to people who have visited the site).

We also use enhanced conversions: when you submit the contact form, the email address and phone number you entered are passed to Google Tag Manager, where Google’s tag hashes them (using SHA-256) before sending them to Google so it can attribute the conversion to an ad click. The hashing is performed by Google’s tag; the values are not sent to Google in plain text.

These tools set cookies and/or store identifiers in your browser. Where consent is required for such cookies, we rely on your consent under the PDPA.

Cookies and local storage

This site uses cookies and similar browser storage for the analytics and advertising tools described above, and for the basic functioning of the site. You can control or delete cookies through your browser settings; blocking some cookies may affect how parts of the site work.

How long we keep your data

We keep contact-form enquiries for as long as needed to handle your request and, where a mandate follows, for the period required by professional and statutory retention obligations. Analytics and advertising data are retained according to the retention settings of the respective Google product.

Your rights

Under the PDPA, you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to data portability (PDPA Sections 30–36). Where processing is based on consent, you may withdraw that consent at any time with effect for the future. To exercise any of these rights, contact us at office@oberhauser.com.

You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC), the data-protection authority in Thailand.