Privacy Notice

Corporly (“Corporly,” “we,” “us,” or “our”) acts as the data controller for the personal data described in this notice. At this stage, Corporly operates under the name “Corporly” as described here. [confirm the legal entity (name and registration) once formalised — must match the Terms of Service]

Contact for privacy matters: contact@corporly.com.

All personal data described here is collected, stored, and processed in digital form through our platform, database, and connected service providers. Depending on the service you use, we may collect:

• Identity data — full name, nationality, date of birth, ID card or passport number.
• Contact data — address, email address, phone number.
• Corporate data — company name, registration number, registered address, shareholder and director details, capital structure.
• Financial data — payment references (we do not store full card numbers), invoice and billing information.
• Documents you upload — ID/passport copies, bank statements, house registration documents, signed resolutions, and other supporting documents required for your service.
• Usage data — how you interact with our website and platform (see section 10, Cookies).

We process personal data on the following legal bases. Where processing is necessary to deliver a service you have requested, we rely on performance of a contract; in addition, at the point of collection on every form, you actively acknowledge and consent to the collection and use of your data as described on that form.

• To deliver the document generation, incorporation, compliance, or consultation service you requested — performance of a contract (PDPA Section 24(3)) and your acknowledgement and consent.
• To verify your identity before generating legal documents in your name (KYC) — performance of a contract, compliance with legal obligations, and your consent.
• To process payments and issue tax invoices — performance of a contract and compliance with legal obligations.
• To send service-related communications (confirmations, deadline reminders, status updates) — performance of a contract.
• To send marketing communications, where applicable — your consent, which you may withdraw at any time.
• To improve our services through aggregate, anonymized analytics — legitimate interest.

We only collect the personal data necessary for the specific service you requested, and we do not use data collected for one service to inform decisions about unrelated services without your consent.

In addition to relying on performance of a contract where applicable, we ask you to actively acknowledge and consent at the point of data collection. Every form that collects personal data includes an acknowledgement and consent checkbox that you must tick before submitting. This checkbox:

• Is not pre-ticked — you must actively select it.
• States clearly what data is being collected and for what purpose on that specific form.
• Confirms that you understand the data is required to provide the service, where applicable, and that you agree to its collection and use as described.
• Links to this Privacy Notice for full detail.
• Must be ticked before the form can be submitted — submission is blocked otherwise.

Where a form collects data for more than one purpose (for example, service delivery and optional marketing follow-up), separate checkboxes are used so you can consent to each purpose independently rather than through a single bundled checkbox.

We may disclose your personal data to the following categories of recipients, only as necessary to deliver your requested service:

• Reviewing lawyers within Corporly, who validate and finalize all generated documents before delivery.
• Government authorities, where your service requires filing or registration — for example, the Department of Business Development (DBD), the Board of Investment (BOI), or other relevant agencies.
• Service providers, who support our platform infrastructure, including our database and file storage provider (Supabase), our email service provider (Resend), our business email and communications provider (Google Workspace), and our payment processor (Stripe). These providers process data solely on our instructions and are bound by data processing agreements.

Some of these providers store or process data outside Thailand, as described in section 9. We do not sell personal data, and we do not share your data with other clients.

We retain personal data only as long as necessary for the purposes described in this notice, or as required by law. Approximate retention periods by data category:

Under the PDPA, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete personal data.
• Deletion — request deletion of your personal data, subject to our legal retention obligations.
• Data portability — request your data in a machine-readable format.
• Object — object to processing based on legitimate interest or for direct marketing purposes.
• Withdraw consent — where processing is based on your consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Restrict processing — request that we temporarily restrict processing, for example during a dispute about accuracy.

To exercise any of these rights, contact us at contact@corporly.com. We will respond within the timeframe required by law, and in any case will complete deletion requests within 30 days unless a legal exception applies.

We protect your personal data through:

• Encryption of data in transit and at rest.
• Access controls limiting who can view your data, enforced at the database level.
• Private, access-restricted storage for uploaded documents and identification copies.
• Regular security review of our platform and infrastructure.

Some of our service providers — including Supabase, Resend, Google Workspace, and Stripe — store or process personal data on servers located outside Thailand. Where this occurs, we rely on the safeguards provided under our agreements with these providers, including their standard data processing terms, and on your acknowledgement and consent as described in section 4, to ensure your personal data continues to receive an appropriate standard of protection as required under PDPA Section 28.

Our website uses cookies to operate and improve your experience. We ask for your consent to non-essential cookies through the banner shown on your first visit; you can decline without losing access to the core service. [a standalone Cookie Policy page is referenced in the reviewed draft but not yet built — decide whether to add one or keep this summary]

We may update this Privacy Notice from time to time. We will post the updated version on our website with a new “Effective” date. Where changes are material, we will provide additional notice as appropriate.

If you have questions about this Privacy Notice or how we handle your personal data, contact us at contact@corporly.com.