Privacy and data handling

Key definitions

To ensure clarity in this policy, we define terms used throughout. These definitions apply when discussing the types of data we process, the parties involved, and the services hyperinsureova provides to entrepreneurs and business clients.

Personal data means any information relating to an identifiable individual, including contact details, identification numbers, business registration information, and case-specific facts provided in the course of legal engagement.

Processing means any operation performed on personal data, whether automated or manual, including collection, storage, organization, adaptation, disclosure, use, analysis and deletion carried out to deliver legal and advisory services.

User refers to any natural person acting on behalf of a business or as an individual who interacts with hyperinsureova for professional legal services, consultation, or related requests.

Service denotes the legal advice, contract drafting, compliance assessments, dispute support and other professional services hyperinsureova provides to entrepreneurs and business clients within Thailand and cross-border where required.

Cookies are small text files placed on your device by websites to identify sessions, remember preferences, and collect analytics. We use cookies to improve functionality and performance of our site and portal services.

Why we process personal data

We process personal data for specific, legitimate purposes necessary to deliver legal services, maintain client relationships and meet legal and regulatory obligations applicable to our practice.

• To provide and manage legal services and advice requested by clients, including drafting, negotiation and representation.
• To carry out identity verification, client due diligence and anti-funds laundering checks required by law.
• To invoice, collect fees and manage business administration related to legal engagements.
• To communicate with clients about matters, updates, deadlines and to respond to queries and requests.
• To improve and secure our website, client portal and internal systems through analytics and security monitoring.
• To comply with court orders, regulatory obligations and legitimate requests from public authorities.
• To assess potential conflicts of interest and maintain professional standards relevant to legal practice.
• To conduct anonymized research and business planning using aggregated data that does not identify individuals.

Legal basis for processing

We rely on appropriate legal grounds to process personal data, which vary depending on the purpose and the nature of the client relationship under applicable Thai and international data protection standards.

• Performance of a contract: processing necessary to provide the legal services you have requested.
• Legal obligation: processing required to comply with statutory or regulatory duties such as anti-funds laundering, tax or court orders.
• Consent: where processing is optional and you have given clear consent, for instance to receive marketing communications.
• Legitimate interests: for business administration, fraud prevention, security, and safeguarding the rights of the firm and other clients, balanced against individual rights.

Your rights under data protection laws

Subject to applicable law and professional confidentiality obligations, you have rights relating to your personal data. This policy was reviewed and updated on 26-05-2026 to reflect current practices and legal expectations.

• Right of access: the right to obtain confirmation whether we process your personal data and to request a copy of that data.
• Right to rectification: the right to request correction of inaccurate or incomplete personal data.
• Right to erasure: the right to request deletion of personal data where processing is no longer necessary, subject to legal retention duties.
• Right to restriction of processing: the right to request temporary limits on processing where disputes about accuracy or necessity exist.
• Right to data portability: the right, in certain situations, to receive personal data in a structured, commonly used format where processing is based on consent or contract.
• Right to object and withdraw consent: the right to object to particular processing activities and to withdraw consent for marketing communications at any time.

Cookies and similar technologies

hyperinsureova uses cookies and similar tools to enable core functionality, measure performance and support analytics. We limit use to what is necessary for service delivery and improvement.

We use session cookies for site operation, persistent cookies for remembering preferences, and third-party cookies for analytics and performance measurement provided by trusted vendors.

Categories include strictly necessary cookies, performance/analytics cookies, functionality cookies, and occasionally targeted cookies only with explicit consent for marketing purposes.

You may manage cookie preferences via our cookie banner and browser settings. Disabling certain cookies may affect site features or access to the client portal functionality.

Read our full cookie policy at hyperinsureova.click/cookie-policy for detailed information on specific cookies and retention periods.

When we share personal data

We share personal data only when necessary to deliver services, comply with legal obligations, or with parties that provide contracted services to hyperinsureova under appropriate confidentiality and security measures.

• With external counsel and professional advisers when needed to provide representation or specialized legal support for a matter.
• With cloud hosting and IT service providers who process data on our behalf under instructions and contractual safeguards.
• With payment processors and banks to facilitate billing and business transactions connected to services.
• With regulators, courts or law enforcement where disclosure is required or permitted by law.
• With potential acquirers or advisors in the event of a bona fide business transaction, subject to due diligence and confidentiality protections.
• With analytics providers to improve service quality; such sharing is governed by data sharing agreements and limited scopes of access.

International data transfers

As a firm serving entrepreneurial clients, some processing may occur outside Thailand. We apply contractual safeguards, data protection clauses, and appropriate technical and organizational measures when transferring personal data internationally.

Where transfers occur, we rely on approved safeguards such as standard contractual clauses, data processing agreements and, where relevant, assessments of the recipient's legal framework to ensure adequate protection.

Data retention

We retain personal data only for as long as necessary to fulfill purposes described in this policy, to meet statutory retention periods and to protect professional and legal interests related to client matters.

Account and client records are typically retained for a period consistent with professional practice and regulatory requirements in Thailand, generally a minimum number of years depending on document type and legal obligations.

Communications, case notes and correspondence are kept for the duration of an engagement and for a defined retention period thereafter to preserve rights, manage potential disputes and comply with record-keeping rules.

System logs and security records are retained for the time reasonably required for security monitoring, incident response and compliance, balancing utility against privacy considerations.

Upon expiry of retention periods or resolution of requests for erasure where permitted, data will be securely deleted or anonymized in a manner appropriate to the data type and applicable legal duties.

Data security

hyperinsureova maintains administrative, technical and physical safeguards to protect personal data against unauthorized access, disclosure, alteration and destruction. Security measures are reviewed regularly and updated in line with technological and regulatory developments.

• Encryption of data in transit and at rest for systems that hold client information, alongside secure authentication controls for client access.
• Access controls and role-based permissions to limit who can view or handle personal data to those with a legitimate need.
• Regular security assessments, staff training on data protection practices and incident response procedures to reduce risks and support rapid remediation.

Exercising your rights

If you wish to exercise any data subject right, please submit a request using the contact information provided. We will verify your identity and respond in accordance with applicable legal timelines.

• Access: request a copy of the personal data we hold about you and details of processing activities.
• Rectification: request correction of inaccurate or incomplete data about you.
• Erasure: request deletion of personal data where legal conditions permit, taking into account retention obligations.
• Restriction: request limitation on processing while accuracy or lawfulness is being verified.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Portability: where applicable, request transfer of data in a structured, commonly used format.
• Withdraw consent: withdraw consent for processing where consent was the basis for processing, without affecting lawfulness of prior processing.
• Lodge a complaint: if you consider your rights have been infringed, you may contact us and, where appropriate, the supervisory authority in Thailand or other relevant regulator.

How to make a rights request

Submit requests by email to [email protected] or by post to hyperinsureova, Thanon Sihaburanukit, Bangkok District, Bangkok 10510, Thailand. Include sufficient details to identify the records and a copy of a government-issued ID for verification where required.

[email protected]

We aim to respond to rights requests within 30 days of receipt. Complex requests or those requiring additional verification may require more time; in such cases we will inform you and provide an estimated timeframe, not exceeding 60 days where permitted by law.