Last updated: 14 October 2026
This policy explains how Thailand Visa Corp collects and uses your personal data when you use thailandvisacorp.com, contact us, or buy our services.
1. Who we are
Thailand Visa Corp is a trading name of YAI SIAM LEGAL GROUP CO., LTD. (บริษัท ใหญ่สยาม ลีกัล กรุ๊ป จำกัด), company registration no. 0835569009810, registered office 49/18 Moo 3, Ratsada, Mueang Phuket 83000, Thailand ("we", "us"). We are the data controller for the personal data described here. Contact for privacy questions: contact@thailandvisacorp.com · +66 61 161 1979 · Office: 98 Supalai Hill, 66 Srisoonthorn Rd, Si Sunthon, Thalang, Phuket 83110 (by appointment).
We are a private service. We are not the Thai government, Immigration, the Ministry of Foreign Affairs or an embassy.
2. What we collect
| Category | Examples | When |
|---|---|---|
| Contact details | name, email, phone/WhatsApp number, preferred language | eligibility-check email step, checkout, contact or partner forms, messages to us |
| Eligibility-check answers | purpose of stay, age band, nationality, where you'd apply, savings/income bands (not exact amounts), family situation, current stay status, visa history (e.g. a refusal or overstay you choose to tell us) | when you use the free self-assessment |
| Order and payment data | service bought, order reference, amount, payment status, credit claimed | checkout and payment |
| Booking data | consultation date/time, language/interpreter choice | after a paid consultation |
| Documents you upload | the documents needed for a Document Review or managed application | only after you buy those services, via our secure upload |
| Correspondence | emails, WhatsApp and other messages with us, call summaries | when you contact us or we handle your case |
| Reminder dates | your permitted-stay end date or 90-day report date | only if you choose to receive reminders |
| Technical and usage data | pages visited, device and browser type, approximate location, referral source | analytics cookies, only if you accept them |
| Partner referrals | the details a referral partner gives us with your permission | when a partner refers you |
| Download sign-ups | your email address, the download you asked for (e.g. a document checklist), your consent (the wording, date and time) and whether you confirmed your email | when you ask for a free download on our website |
Card details: card numbers are entered on Stripe's secure page. We never see or store your full card number. We don't ask for passport numbers, ID numbers or bank account details on our website or by email. If a managed application needs identity documents, we tell you how to provide them securely.
WhatsApp messages: if you message us on WhatsApp, we keep a copy of the text of our conversation in our secure database, together with your WhatsApp number and the first name on your WhatsApp profile, so our team can reply to you and keep track of your enquiry. We don't copy or keep photos, videos or files you send on WhatsApp, and we automatically remove anything that looks like a passport, ID, card or bank number from the stored text. Please don't send identity documents on WhatsApp: if we need them, we'll send you a secure upload link.
Facebook Messenger and Instagram messages: if you message us on Facebook Messenger or Instagram, or comment on our posts, our team reads and answers you through Meta's business tools. We don't copy these messages into our database. If you comment a keyword under one of our posts (for example "DTV"), Meta's automation sends you one message with a link to the guide; a person answers anything after that.
Sensitive data: some answers or documents may reveal sensitive information (for example health information for a medical visa, or a criminal-record certificate). We use it only for your visa service, and only with your explicit consent where the law requires it.
3. Why we use it, and the legal basis
| Purpose | Legal basis (PDPA / GDPR) |
|---|---|
| Run the free eligibility check and email your results | Your request / contract steps before a contract; consent for the email |
| Answer your enquiry and give one follow-up about it | Legitimate interest in replying to people who contacted us |
| Provide paid services (consultation, Document Review, Full Legal Service), bookings, order pages and case updates | Performance of a contract |
| Take payments, issue receipts and invoices, keep accounting records | Contract; legal obligation |
| Stay-end and 90-day-report reminders | Consent (you can stop them at any time) |
| A single follow-up email a week after your eligibility check | Legitimate interest, with an easy opt-out |
| Newsletters or other marketing | Only with your consent |
| Sending a download you asked for (e.g. a checklist), and our visa-update emails if you tick the box | Consent (you can unsubscribe at any time) |
| Answering your messages and comments on Facebook, Instagram and WhatsApp | Legitimate interest in replying to people who contact us; contract steps if you become a client |
| Website analytics (GA4, Yandex Metrica) | Consent via the cookie banner |
| Measuring our Facebook and Instagram ads (Meta pixel) | Consent via the cookie banner |
| Preventing spam and fraud (Cloudflare Turnstile, payment fraud checks) | Legitimate interest |
| Handling referrals from partners | Legitimate interest; the partner confirms they have your permission |
| Complying with the law and defending legal claims | Legal obligation; legitimate interest |
We don't sell your personal data, and we don't use it for automated decisions with legal effect. The eligibility check is automated and preliminary: it gives general information, not a decision or a legal opinion.
4. Who we share it with
We share personal data only as needed to provide our services:
- Our lawyers and team at YAI SIAM LEGAL GROUP CO., LTD., who provide the legal services.
- Our payment-collection partner (United Kingdom), which collects online card payments on our behalf through Stripe.
- Service providers (processors) acting on our instructions:
Provider What for Where data may be processed Supabase Database and secure file storage Singapore Stripe Online payments and receipts Thailand and other countries where Stripe operates Resend Sending emails (results, receipts, links, reminders) United States Calendly and Zoom Booking and holding video consultations United States Google Analytics 4 Website analytics (only with consent) United States and other Google locations Yandex Metrica Website analytics (only with consent) Russia and other Yandex locations Cloudflare Turnstile Spam protection on forms Global Netlify Website hosting Global Google Workspace Email and internal records Global Meta (WhatsApp) Delivering WhatsApp messages between you and us, and passing a copy to our database Global Meta (Facebook Messenger, Instagram) Messages you send us on Facebook Messenger or Instagram, which we read and answer there United States and other Meta locations Kapso Connecting our WhatsApp Business number to our systems (receiving and storing WhatsApp messages) United States and other countries Meta (Facebook/Instagram pixel) Measuring our Facebook and Instagram ads (only with consent) United States and other Meta locations - Thai authorities and embassies: only when you ask us to prepare or file an application for you, and only what that application requires.
- Referral partners: we may confirm to a partner that a referral was received and whether the referred client went ahead, but never your case details.
- When the law requires it, or to protect our legal rights.
5. International transfers
Some providers process data outside Thailand (see the table). Where we transfer personal data abroad, we use providers with appropriate safeguards (such as standard contractual clauses or their published data-protection terms), or rely on your consent or on the transfer being necessary to provide the service you asked for.
6. How long we keep it
| Data | Kept for |
|---|---|
| Enquiries and leads that didn't become clients | 2 years after the last contact, then deleted |
| Client records (orders, correspondence, case status, invoices) | 5 years after the case closes (accounting and legal claims) |
| Documents uploaded for a Document Review or application | 1 year after the case closes, then deleted automatically |
| Reminder dates | until the date has passed or you stop reminders, then deleted |
| Copies of WhatsApp messages | 2 years after our last message with you, then deleted automatically. If you reply "stop", within 30 days, except the do-not-contact entry |
| Download sign-ups | until you unsubscribe or 2 years after your last contact with us, whichever comes first; we then keep only the do-not-contact entry and the record of your consent, as proof |
| "Do not contact" list | as long as needed to respect your request (only the minimum contact detail and the date) |
| Analytics data | per the analytics provider's retention setting (GA4 set to 14 months) |
7. Your rights
Under the PDPA (and the GDPR if it applies to you), you can ask us to:
- give you access to your data and a copy of it;
- correct inaccurate data;
- delete your data, or restrict or object to its use, including for direct marketing;
- move your data to another provider (data portability);
- withdraw your consent at any time (this doesn't affect use before the withdrawal).
To use these rights, email contact@thailandvisacorp.com. We reply within 30 days. We may need to confirm your identity first, but we will never ask for your passport by email. You can also complain to Thailand's Personal Data Protection Committee (PDPC), or to the data-protection authority where you live.
Stop messages: reply "stop" (or «стоп») to any message, or use the unsubscribe or "stop reminders" link. We then add you to our do-not-contact list.
8. Cookies and analytics
We use strictly necessary cookies to run the site (e.g. language, security, your order link). Analytics cookies (Google Analytics 4 and Yandex Metrica) and the Meta pixel, which measures our Facebook and Instagram ads, load only if you accept them in the cookie banner. You can change your choice at any time via "Cookie settings" in the footer. Session-recording features are switched off.
9. Security
We use encrypted connections, access controls, private storage with time-limited links for uploaded documents, and automatic deletion. No system is perfectly secure. If a breach is likely to affect your rights, we will notify you and the authorities as the law requires (PDPA: within 72 hours to the PDPC where required).
10. Children
Our services are for adults. We handle a child's data only when a parent or guardian gives it to us for a family application.
11. Changes
We may update this policy. We will post the new version here with its date, and tell clients about important changes.