Chandler Mori Hamada Limited (referred to as “CMH”, “we”, “our”, or “us”) is committed to conducting our services and business under good corporate governance, including recognizing the importance of data security and privacy, and we intend to process your personal data with transparency.

The purpose of this Thailand Country-Specific Privacy Policy (“Privacy Policy”) is to maintain your trust and ensure that CMH will properly manage and process your personal data, including maintaining the security measures specified by the data protection laws, including the Personal Data Protection Act B.E. 2562 (2019) (the Data Protection Law), and meet international standards.

CMH operates as part of MH Group. References in this Privacy Policy to MH Group are references to Mori Hamada & Matsumoto (partnership), Mori Hamada & Matsumoto LPC, MH Tax Advisory Services, MH Legal Co., Ltd, associated offices in Japan, and overseas bases of those entities (including the following: Mori Hamada & Matsumoto Beijing Office; Mori Hamada & Matsumoto Shanghai Office; Mori Hamada Intellectual Property (Beijing) Co., Ltd.; Mori Hamada (Singapore) LLP; CMH; Myanmar Legal Mori Hamada Limited; Mori Hamada HCMC Branch; Mori Hamada Vietnam Hanoi office; ATD Law in association with Mori Hamada; PT MH ATD Strategic Intelligence; Tayag Ngochua & Chu, a member firm of Mori Hamada and Mori Hamada US LLP).

This Privacy Policy describes how CMH and MH Group process (including collect, use, and share) personal data in Thailand. References in this Privacy Policy to “you” or “your” are references to the individual whose personal data is processed by CMH and MH Group in connection with the transactions or other activities you have or deal with us, including the activities described in this Privacy Policy. If you wish to learn more about how the MH Group processes personal data in other jurisdictions, please refer to the information available at https://www.morihamada.com/en

We may⁠, directly or indirectly⁠, collect your personal data from the following sources⁠:

Information you or your representative or other related persons provide to us directly from time to time⁠, including through our website⁠, our electronic portals and platforms⁠, email communications sent to or from us⁠, speaking to us in person over the telephone⁠, or visiting our office in relation to the services provided by us or provide to us⁠; and

Information about you from other reliable sources or public sources, such as government bodies and other professional institutions.

Depending on purposes of use and requirement in processing personal data⁠, we may collect various types of your personal data including⁠:

Basic Information⁠: full name⁠, gender⁠, phone number⁠, email address⁠, postal address⁠, title and position⁠, identification number or passport number⁠;

Special categories of information⁠: religion or other similar belief⁠, racial or ethnic origin⁠, health data and details of trade union membership (⁠these information will only be collected in limited special circumstances⁠)⁠;

Personal Data of minors, quasi-incompetent persons and incompetent persons (“Incapacitated Person”): We will process the personal data of an Incapacitated Person only where it is permitted by the Data Protection Law. We will arrange to obtain consent from a parent, curator or guardian who is the legal representative of such Incapacitated Person (as the case may be). This does not apply in the case of obtaining consent for the processing of personal data of a minor over 10 years old that is strictly personal, suitable to his condition in life and actually required for reasonable needs, in which case such minor may provide consent to us directly;

Financial information⁠: bank account and payment related information⁠;

Technical information/ Registration data⁠: IP address⁠, unique device identifier⁠, cookies and other data linked to a device and data about usage of our website⁠;

Picture and Video Recordings⁠: Images or video recording taken during our events or captured by CCTV installed on our premises⁠; 

Job applicant data⁠: Data provided by job applicants or others on our websites or offline means in connection with recruitment process⁠, which also may be subject to an additional relevant local recruitment privacy policy⁠; and

Marketing and Communication data⁠: all marketing and communication with us through our event arrangement⁠, including seminar⁠, webinar or training activities and telephone communication when you contact us or we contact you⁠.

We will process your personal data⁠: (⁠i⁠) to perform contractual obligations⁠, (⁠ii⁠) to comply with legal obligations⁠, (⁠iii⁠) for the legitimate interest⁠, or (⁠iv⁠) for the preparation of the historical documents or for the purpose relating to research or statistics⁠. We will use personal data for the above mentioned purposes and scope⁠, including the following purposes⁠:

3⁠.1 Providing our legal service

- checking conflict of interest⁠;

- performing anti-money laundering⁠, anti-terrorism⁠, sanction screening⁠, fraud and other background check⁠;

- Carrying out legal services⁠;

- tax reporting obligations⁠; and

- managing payment, fees, charges and collecting and recovering money owed to us.

Note: In certain circumstances, in the course of our service, you may provide us with personal data of individuals who are not aware of our involvement or of our processing of their personal data. In such situations, we will not directly contact the data subjects whose personal data we are processing, or there may be other reasons that would make it inappropriate for us to provide them with a privacy notice. Before you pass any such personal data to us, you must therefore ensure that the relevant data subjects have received any requisite privacy notice in connection with the performance of our service.

3⁠.2 Marketing⁠, event⁠, seminar⁠, customer satisfaction⁠, and research and development

- summarizing and recording firm events to create event reports and promotional materials⁠;

- promoting firm events and services through internal and external communication channels⁠;

- asking you for feedback (for instance, in a survey) about our services and managing our review of and action on such feedback; and

- conducting research or strategy analysis in developing⁠, improving and maintaining the quality of our service⁠.

Note⁠: If you no longer wish to receive any marketing communications⁠, remain on a mailing list to which you previously subscribed⁠, or receive any other marketing communication⁠, please follow the unsubscribe link in the relevant communication or contact us as per described in this Privacy Policy⁠.

3⁠.3 Recruiting new employees

- conducting interviews and background checks⁠;

- evaluating individuals for employment and contractor opportunities⁠;

- managing onboarding procedures⁠; and

- considering candidates for future suitable opportunities⁠.

3⁠.4 Contacting with vendors⁠, service providers⁠, contractors or outsourced entities (⁠“Vendors”⁠)

- engaging Vendors for specific services⁠;

- registering Vendors for on-boarding⁠, agreement execution⁠, and payment processing⁠; 

- tax reporting obligations⁠; and

- maintaining communication for ongoing services⁠. 

3⁠.5 Security and Safety (⁠CCTV Monitoring⁠)

- Monitoring and ensuring the safety and security of our premises⁠, personnel⁠, assets⁠, and visitors⁠;

- Investigating and addressing security incidents or violations⁠;

- Preventing unauthorized access to our premises⁠; and

- Assisting in compliance with legal obligations or in responding to law enforcement requests where applicable⁠.

In many instances, we need to process your personal data in order to fulfil our obligations under contracts with you or to comply with applicable laws and regulations. If you do not provide the personal data requested, we may not be able to provide our services to you.

We will not disclose your personal data without any lawful basis. In the case where we are required to transfer your personal data to other third parties, we will proceed in accordance with appropriate procedures to ensure that such third parties will protect your personal data from any loss, unauthorized access, use, modification or disclosure. Your data may be disclosed to other third parties, including:

- MH Group⁠;

- Our networking law firms or other profession advisors as per your request for the case where we need to sub-contract our services to them⁠;

- Other third-party service providers, such as cloud service providers;

- Governmental and regulatory bodies⁠;

- Auditors⁠, and other advisors⁠;

- Any person or companies where required in connection with potential or actual corporate restructuring⁠, merger⁠, acquisition or takeover of our business or MH Group⁠; and

- Other data controller to whom you have instructed us to disclose or transfer your personal data⁠, etc⁠.

We will disclose your personal data to recipients outside of Thailand only where it is permitted by the Data Protection Law and/or other applicable laws. In this regard, we may follow the rules and regulations for the transfer of data outside Thailand by entering into the relevant agreements or using other tools available under the Data Protection Law, and we may rely on a data sharing agreement or data processing agreement (as the case may be) containing standard contractual clauses that require the data recipient to allow the data subject to exercise their rights with such data recipient in the case of a breach of the data sharing agreement or data processing agreement, or other permitted tools for the transfer of personal data to other countries.

We will retain your personal data for as long as it is necessary for the purpose of data processing. After that, we will delete and destroy your personal data, except as may be required by applicable laws or for the protection of CMH’s and MH Group’s interests. In general, personal data will be kept for a maximum period of 10 years, or otherwise longer if specifically provided by law or required for the protection of CMH’s and MH Group’s interests.

Upon completion of the above mentioned period, we will follow our deletion and destruction procedures to ensure that all your personal data is safely deleted from CMH’s servers or is retained in the form of anonymous data.

We will handle all personal information in an appropriate manner and put in place proper measures to prevent the disclosure or loss of⁠, tampering with⁠, or damage to⁠, any personal information in our custody⁠, by implementing operational procedures and instructing our staff⁠.

To achieve our intention as described above, we and MH Group adopt internal policies relating to personal information management rules (client information), an information security policy, and a handbook to prevent any unauthorized or unlawful access to, use, change, amendment or disclosure of personal data. We make substantial investments and devote effort and human resources to ensure that we maintain high-standard measures and that your personal data remains safe. We implement various measures to protect our computer systems, such as firewalls. We revisit such internal policies periodically in accordance with applicable laws.

Although we make our best efforts to protect personal data with our technical mechanisms, along with management by our personnel, to control access and safeguard personal data against unauthorized access, we cannot always guarantee the security and confidentiality of personal data from every incident that may arise, such as virus threats and unauthorized access. You should regularly keep up with technology news and install personal firewall software to protect your computer from threats or data theft. Also, monitoring your own account on a regular basis, such as monitoring balances and transaction dates, and keeping personal data and financial status confidential are strongly recommended.

In accordance with the Data Protection Law⁠, you have the following rights which may be amended pursuant to any regulations of the Data Protection Law⁠:

To access personal data⁠: you may request for a copy of your personal data and request to disclose about the source of your personal data⁠;

To rectify personal data⁠: you may file a request to rectify any of your personal data that has been changed to ensure that your personal data is accurate⁠, up-to-date⁠, complete and not misleading⁠;

To erase or destroy personal data: you may request to erase or make your personal data unidentifiable under any of the following circumstances: (1) your personal data is no longer needed to be processed for the intended purposes, (2) you withdraw your consent to the processing of your personal data and we no longer have any legal right to process your personal data for the intended purposes, (3) you object to our processing of your personal data, or (4) your personal data was processed in contravention of the Data Protection Law;

To suspend the use of your personal data⁠: you may request us to suspend the use of your personal data in any of the following events (⁠1⁠) when we are in the process of verifying certain information for the purpose of rectifying⁠, updating⁠, completing or avoiding any misleading about your personal data upon your request⁠; (⁠2⁠) when your personal data is to be erased⁠, but you instead request to suspend its use⁠; (⁠3⁠) when it is no longer necessary to store your personal data⁠, but you request us to continue the storage of your personal data for establishing legal claims⁠, legal compliance⁠, exercise of legal rights or defenses⁠; or (⁠4⁠) when we are in the process of verifying its legitimate rights in its data collection or processing for purposes specified by applicable law⁠;

To object to the collection, use and disclosure of personal data: you may object to the processing of your personal data in the case where (1) your personal data was collected by us for the purpose of (a) our public interest, (b) our compliance with a governmental order, or (c) our legitimate interest or legal basis; (2) we have processed your personal data for the purpose of direct marketing; or (3) we have processed your personal data for any research purposes as specified in relevant laws, including for statistical purposes;

To data portability: where it is technically available, you may request to receive your personal data in a commonly used and machine-readable format, or to have it automatically transferred; and

To withdraw consent: in the case where you have given consent for the processing of your personal data to us (where consent is not required by other applicable laws), you have the right to withdraw the consent at any time. Should the withdrawal of any consent affect any transactions or provision of services or activities carried out or offered by us, you will be informed at the time of the withdrawal request.

Upon your request, we may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data or exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request.

Please note that we may not be able to respond to your request if it does not meet the requirements of the Data Protection Law or if we are authorized by the Data Protection Law or other related legislations to refuse your request for disclosure or otherwise⁠.

In the event that we are unable to comply with your request to exercise your rights as a data subject, or if you believe that we have not acted in accordance with the requirements of the Data Protection Law, you may lodge a complaint with the relevant regulator, including the Personal Data Protection Committee, Ministry of Digital Economy and Society.

Note⁠: The procedures above will take no more than 30 (⁠thirty⁠) days following the receipt of your request and all supporting documents⁠. Please also note that the process may take longer than 30 (⁠thirty⁠) days if your request is particularly complex or you have made a number of requests⁠. In this case⁠, we will notify you and keep you updated⁠.

All requests⁠, opinions⁠, questions⁠, complaints and other inquiries with respect to our handling of personal data should be referred to our Data Protection Officer at the address below, which is the registered office of CMH in its capacity as the data controller⁠.

Data Protection Officer

Address:

Chandler Mori Hamada Limited

98 Sathorn Square Office Tower, 31^st and 36^th Floors, 

North Sathorn Road, Silom, Bangrak, Bangkok 10500 Thailand

Tel: 66 2 009-5000

Email : CMH-DPO@morihamada.com

Please note that our business hours are from 8:30 am to 12:00 noon and from 1:00 pm to 5:30 pm, Monday to Friday (excluding public holidays).

Cookies are small pieces of electronic information stored in the form of a text file and sent to the browser of the data subject for the purpose of sending the information back to the server every time you visit the website. The CMH website will send cookies to your browser, which may be recorded on the computer or devices you use to access the website. Cookies are important in enabling the website to remember the settings on your devices.

We will use cookies and other similar technologies for different purposes including as a technical measure and to improve our services as follows⁠:

- To help remember the information about your browser and setting and help you to access the website easily⁠;

- To help assess the efficiency and results of website services that are still not fully functional and need to be improved;

- To collect and analyze website visit information that allows us to understand users’ interests and how you use our services, which is important for optimizing efficiency and improving our services; and

- To enhance the website user experience, including allowing us to deliver services and information that meet your interests.

Our website uses both our cookies (⁠first party cookies⁠) and third-party cookies which are determined and set by third-party service provider such as our third-party service provider to enhance the functionality of the website⁠.

Additionally, we may embed content or video from other social media websites, such as Facebook and LinkedIn. These websites may have their own cookie settings that are beyond our control and responsibility. You should review the cookie policy of each relevant third party for more information regarding their use of cookies.

We use 2 types of cookies as follows⁠:

Session Cookies: Temporary cookies used to remember you during your visit to our website, for example, monitoring your default language. This type of cookie will be deleted from your computer or device when you leave the website or close the web browser.

Persistent Cookies: Cookies that exist for a certain period of time or until you delete them. This type of cookie allows our website to remember you and your preferred settings when you revisit the website, which helps you access the website more easily.
We use the above cookies for the purpose of use as follows⁠:

Strictly necessary cookies: these cookies are essential for providing the website service, allowing you to access any functions of the website, including remembering information you have provided via the website.

Analytical/Performance cookies: these cookies allow us to see user interactions when using our website and to understand which pages or areas of the website are popular, as well as to analyze other aspects of information. We also use this information to improve the website’s functionality and to understand user behavior. However, the information these cookies collect will be anonymous and used for statistical analysis only.

Functionality cookies: these cookies allow our website to remember options in your preference settings and deliver additional features and content that meet your preferences, such as helping to remember your user account name, changes in font size settings or page settings that you can customize.

Targeting/Advertising cookies: these cookies will be recorded on your computer or device to remember your visit, including pages and links that you visit or follow. We will use this information to adjust the website and arrange our marketing activities to meet your interests.

Our website may contain URLs that link to other social media platforms, such as Facebook, Twitter, or other social media platforms, which may allow you to share content on our website with others on social media and to engage in other interactions.

We continuously strive to improve our policies and procedures for the handling of personal information, and as a result this Privacy Policy may be amended, as required. As such, kindly note that you are reminded to check our website from time to time for updates.

This Privacy Policy is effective as of 1 May 2026