Privacy policy overview

Key terms used in this policy are defined below to clarify how we describe data subjects, processing activities and the services provided by metalxzen.

We collect personal data necessary to provide legal services, maintain client records and comply with professional and legal obligations. Data collection is limited to what is relevant and proportionate for those purposes.

We process personal data to deliver contracted services, meet legal and regulatory obligations, maintain client relationships and improve service delivery. Processing activities are limited to necessary purposes.

• To provide legal advice, prepare documents and represent clients in administrative or court processes related to pensions and elder law.
• To verify identity and eligibility when interacting with government agencies or third-party service providers.
• To communicate with clients about case status, appointments, billing and administrative matters.
• To process payments and manage billing where applicable.
• To comply with legal and professional obligations, including recordkeeping and responding to lawful requests from authorities.
• To maintain internal records, improve service quality and carry out business administration and analytics.
• To manage risk, prevent fraud and ensure the security of systems and client data.
• To obtain and record consent where required for marketing communications or optional services.

We rely on appropriate legal bases to process personal data depending on the activity, including contractual necessity, consent, compliance with legal obligations and legitimate interests.

• Performance of a contract or taking steps at the request of the individual prior to entering a contract (e.g., providing legal services and advice).
• Compliance with legal obligations (e.g., recordkeeping, responding to official inquiries).
• Consent, where processing is optional (e.g., marketing communications).
• Legitimate interests pursued by metalxzen, such as ensuring service security, preventing fraud, and maintaining business operations, provided these do not override the rights and freedoms of individuals.

Although GDPR is an EU framework, many of the rights it outlines reflect common principles that metalxzen applies to the extent permitted by local law. These include transparency, access and control over personal data.

• Right of access: You may request confirmation of whether we process your personal data and request a copy of that data.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: Subject to legal and professional obligations, you can request deletion of your personal data where there is no overriding legal reason to retain it.
• Right to restrict or object to processing: You may request restriction of processing or object where processing is based on legitimate interests or consent where applicable.
• Right to data portability: Where applicable, you may request a machine-readable copy of data you provided to metalxzen to transfer to another provider.
• Right to lodge a complaint with a supervisory authority if you consider your data protection rights have been infringed.

The metalxzen website uses cookies and similar technologies to support site functionality, measure usage and deliver a better user experience. You can manage preferences via browser settings and available in-site controls.

We use essential cookies for site operation, preference cookies to remember choices, analytics cookies to understand site usage, and optional marketing cookies when consent is provided.

Categories include: essential (required for core functionality), performance/analytics (usage statistics), functionality (site preferences), and marketing (advertising and tracking when consented).

Most browsers allow you to refuse or delete cookies. Changing cookie settings may affect website functionality. The site provides a cookie management option where applicable to permit or withdraw non-essential cookies.

Detailed cookie information

We only share personal data when necessary for service delivery, when required by law, or with parties that provide services to support our operations under contractual safeguards.

• Service providers engaged to support delivery of legal services (document storage, case management platforms, IT hosting).
• Government agencies, courts or pension authorities when required for claims, appeals or legal compliance.
• Professional advisors and external counsel engaged with your consent or when necessary for legal proceedings.
• Payment processors for billing and transaction handling, under strict contractual terms.
• Law enforcement or regulators when disclosure is required by law or to protect legal rights.
• Affiliates or business successors in the event of a business reorganization, merger or sale, under confidentiality terms.

Some service providers or partners may be based outside Thailand. When personal data is transferred internationally, we apply contractual and organizational safeguards to protect the data in accordance with applicable law.

Safeguards may include standard contractual clauses, data processing agreements and careful selection of providers that implement appropriate security measures.

We retain personal data only as long as necessary for the purposes described, subject to legal and professional retention obligations and legitimate business needs.

Account and client files are retained for the duration of the client relationship and for a period thereafter consistent with professional and tax recordkeeping requirements, typically several years as required by law.

Communications and case-related records are retained for the time necessary to manage and conclude matters, respond to enquiries and meet legal obligations.

Technical logs and analytics data are retained for a limited period to support system operation, security and troubleshooting, and then anonymized or deleted.

When retention periods expire or upon a valid deletion request where no overriding legal reason exists to retain data, we securely delete or anonymize personal data in our systems.

metalxzen implements industry-appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration or destruction. Measures are regularly reviewed and updated as needed.

• Encryption of data in transit and where feasible at rest to protect confidentiality.
• Access controls and role-based permissions to limit data access to authorized personnel only.
• Regular security assessments, staff training and incident response procedures to detect and address potential vulnerabilities.

As a visitor or client of metalxzen, you have certain rights regarding your personal information. These include the right to access the data we hold about you, request corrections, ask for deletion or restriction of processing, request data portability where applicable, and object to certain processing activities. We describe below how to exercise these rights and what to expect from our response process.

• Right to access: You may request confirmation of whether we process your personal data and receive a copy of the processed information.
• Right to rectification: You may request correction of inaccurate or incomplete personal information we maintain about you.
• Right to erasure: You may request removal of personal data when retention is no longer necessary or processing has no lawful basis. Certain legal records may be retained as required by law.
• Right to restriction of processing: You may request that we limit how we use your personal data while a dispute or verification is ongoing.
• Right to data portability: Where processing is based on consent or contract and is automated, you may request a copy of your personal data in a commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or to direct marketing processing. We will review such requests and explain any lawful basis for continued processing.
• Right to withdraw consent: If we rely on your consent for processing, you may withdraw that consent at any time without affecting processing prior to withdrawal.
• Right to lodge a complaint: If you believe our processing of your personal data violates applicable law, you may lodge a complaint with the relevant supervisory authority in Thailand.

To make a request regarding your personal information, contact us with a clear description of the right you wish to exercise and any relevant details to help us locate your records. Send correspondence to: metalxzen, 1048, Amphoe Thung Saliam District, Sukhothai Province 64150, Thailand. You may also call +66917725514 or include Business ID 1898434392080 in written requests to help us verify your identity. We may require additional information to verify identity before processing requests.

[email protected]

We typically acknowledge receipt of privacy requests promptly and aim to respond substantively within 30 calendar days. If a request is complex or numerous, we will inform you and may extend this period with a reasoned explanation.