Government data request procedure

Scope

This procedure applies to any request from a government authority, official or law-enforcement officer for personal data of customers or users of siamfilament.com — account data, order data, shipping addresses, and data received from third-party login providers (Google, LINE, Microsoft, Facebook/Meta).

Legality review before disclosure

Personal data is disclosed only upon a formal written request: a court warrant, a court order, or an official letter that clearly states its legal basis.

No data is disclosed in response to phone calls, chat messages, informal emails or verbal requests, whatever position the requester claims to hold.

Before disclosing, we verify that the document is genuine and issued by a real authority, that it states a legal basis, and that it specifies the data requested. If in doubt we contact the issuing authority through official channels to confirm it first.

Data minimisation

We disclose only the data fields named in the request, never the full customer record. If only a name and phone number are requested, order history and addresses are not included.

If a request is overly broad or unspecific, we ask the authority to narrow its scope before any disclosure.

Documentation

Every request, including refused ones, is logged: the date received, the requesting authority and officer, the legal basis cited, the data requested and the data actually disclosed, the date of disclosure or the reason for refusal, and who handled it.

Copies of request documents and disclosure evidence are kept for at least five years and form part of the processing records required by Section 39 of Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

Emergency exception

Where urgently necessary to prevent danger to a person's life, body or health, data may be disclosed to the extent the law permits; the reasons and details are logged immediately afterwards.