Privacy Policy

This Privacy Policy (the "Policy") is issued by Siam Luxury Adventure Co., Ltd. (Thai: บริษัท สยาม ลัคชูรี่ แอดเวนเจอร์ จำกัด), a limited company registered in Thailand under the Civil and Commercial Code on 6 July 2023 (B.E. 2566) with the Phuket Provincial Business Registration Office, Department of Business Development, Ministry of Commerce, juristic person registration number 0835566027493, with its registered office at 88/384 Moo 2, Ko Kaeo Sub-district, Mueang Phuket District, Phuket Province, Thailand (the "Company", "we", "us", "our").

The Company is the data controller of the personal data described in this Policy under the Personal Data Protection Act B.E. 2562 (2019) (the "PDPA"). This Policy is our privacy notice under sections 23 and 25 of the PDPA.

This Policy applies when you use siam-luxury.com, its language versions and the subdomains open to the public (the "Website"), send us a Booking Request, book or use a Service, write to or call us, use a Partner Account or the Partner API, take part in our Affiliate Program, or deal with us as a business contact.

In this Policy, "you" means the person whose personal data we process: a User, a Guest or a member of a Guest's party, a Partner or a person who works for a Partner, an Affiliate, or anyone else who contacts us. "Personal data" means information about a living person that can identify that person, directly or indirectly. Other capitalised terms have the meanings given in the Terms of Use, the User Agreement, the Partner Program Terms and the Affiliate Program Terms.

The Cookie Policy forms part of this Policy. It lists the cookies and similar browser storage used on the Website and explains how to refuse or delete them.

This Policy does not cover the processing of personal data by Suppliers, messengers, social networks, banks, payment providers or other businesses that decide for themselves how to use personal data, even when you reach them through the Website. Their own privacy notices apply to them. This Policy also does not cover the data of the Company's employees in their capacity as employees.

This Policy is published in English, Russian and Thai. If the versions differ, the English version prevails, to the extent the law allows.

This Policy covers the following people:

1. (a)anyone who visits or uses the Website (a "User");
2. (b)Guests who send a Booking Request, make a Booking or use a Service, including the Lead Guest and every member of the party;
3. (c)people who write to or call us by WhatsApp, Telegram, LINE, Instagram, Facebook, LinkedIn, phone or email, or through a form on the Website;
4. (d)Partners and their owners, directors, staff and other contact persons, such as managers, captains and drivers;
5. (e)Affiliates who bring guests to us with a Referral Link or Referral Code, and the people who act for them;
6. (f)people who represent businesses that we contact, or that contact us, about working together, including businesses whose contact details we find in public sources.

The data we hold about you depends on how you deal with us. The main categories are:

We collect only the personal data we need for the purposes in Purposes and legal bases. Apart from the details of the request itself, the booking and contact forms on the Website ask only for your name and a phone number or messenger username; an email address and a note are optional.

The Website does not take payments and never asks for card details. Please do not send card numbers, card security codes or passwords to us through the Website, a messenger or email.

We collect personal data:

1. (a)from you, when you fill in a form, write to or call us, sign up for a Partner Account, add Cards, use the Partner API or send us documents;
2. (b)automatically, when you use the Website, through our server logs, cookies and similar technologies, PostHog analytics and the Google Ads tag;
3. (c)from the Lead Guest, about the other members of the party;
4. (d)from Suppliers, for example when a Supplier confirms availability, reports damage or a fine, or passes your feedback on to us;
5. (e)from the Affiliate or Partner whose Referral Link or Referral Code brought you to us;
6. (f)from messengers and social networks, which show us your profile name, username or photo when you write to us;
7. (g)from public sources, such as business websites, maps, listing platforms and social media pages, for business contacts;
8. (h)from banks and payment providers (confirmations of payments and refunds), insurers, and authorities (for example, notices of traffic fines).

Where we receive personal data about you from someone else, this Policy is our notice to you under section 25 of the PDPA. When we first contact a business using details found in public sources, we say who we are, and the business can ask us at any time not to contact it again.

We use personal data only for the purposes below, each on a legal basis that the PDPA allows: your consent (section 19); the performance of a contract with you, or steps you ask for before a contract is made (section 24(3)); the legitimate interests of the Company or of another person, where your fundamental rights do not override them (section 24(5)); compliance with a law that applies to us (section 24(6)); and the prevention or suppression of a danger to a person's life, body or health (section 24(2)). For sensitive data we rely on section 26 of the PDPA, as explained in Sensitive data and identity documents.

Where we rely on legitimate interests, we have weighed them against your rights and reasonable expectations and limit the data and its use accordingly. You may object to this processing as described in Your rights.

If we want to use personal data for a purpose that this Policy does not describe, we will tell you before we do so and ask for your consent where section 21 of the PDPA requires it.

We need your name and a phone number or messenger username to answer a request. Without them we cannot reply to you.

To make and perform a Booking, we and the Supplier need the data the Service requires, such as the names of the people in the party, the dates, a valid driving licence for a vehicle, passenger details for a flight, and passport details for a stay in a villa or condo where the law requires the notification of foreign guests. If this data is not provided, we may be unable to confirm the Booking and the Supplier may refuse to provide the Service, with the consequences set out in the User Agreement.

Consent to marketing, to the publication of your photos or reviews, and to optional health or accessibility information is your choice. Refusing it does not affect your Booking, except that a Supplier may decline an activity for safety reasons if it lacks information it needs.

Sensitive data under section 26 of the PDPA includes data about health, disability, racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behaviour, criminal records, trade union membership, genetic data and biometric data. We do not ask for sensitive data unless a Service requires it.

We collect health or accessibility information, such as an allergy, a pregnancy, reduced mobility or a medical condition relevant to a boat trip, a flight or a tour, only in one of these cases: with the explicit consent of the person concerned; where it is necessary to prevent or suppress a danger to a person's life, body or health and that person cannot give consent (section 26(1)); or where it is necessary to establish, exercise or defend legal claims (section 26(4)). We share it only with the Supplier and the people who need it for the Service or the emergency.

The owner, landlord or person in charge of a property where foreigners stay must notify the immigration authorities of their stay under section 38 of the Immigration Act B.E. 2522 (1979), known as the TM30 notification. For a villa or condo we may therefore ask for the passport details of each foreign guest and pass them to the Supplier, who makes the notification. The Supplier is responsible for the notification and for its own handling of the data.

For the rental of a car or motorbike, the Supplier, or the Company for its own fleet, may see or copy your driving licence and your passport or identity card, to check that you may drive the vehicle lawfully and to secure the rental.

Some documents show details that we do not need, such as religion or blood type. Please cover them before you send a copy. If such details reach us, we do not use them.

We do not collect criminal records and do not use biometric data, such as facial recognition. Information about traffic fines, accidents or damage connected with a Booking is used only to settle them and to establish, exercise or defend legal claims.

If you give us personal data about another person, such as a member of your party, a driver or a colleague, you confirm that you are entitled to do so, that you have told that person about this Policy, and that you have that person's explicit consent for any sensitive data. For a minor, you confirm that you are the holder of parental responsibility or act with that person's agreement.

We disclose personal data only as needed for the purposes in this Policy, to:

1. (a)the Supplier that provides the Service you book or ask about, such as the owner or operator of the vehicle, boat, villa, condo or aircraft, the tour operator or the captain. We give the Supplier the data the Service needs, such as names, contact details, dates, the party and any special requests;
2. (b)the Affiliate or Partner whose Referral Link or Referral Code came with your request, limited to the details needed to credit and check the Booking, such as the Service, the dates and the price. We do not give them your contact details for this purpose;
3. (c)service providers that process data for us: our hosting provider in Thailand; Cloudflare, which delivers and protects the Website; PostHog, which provides our analytics; Microsoft, which provides our email and office tools (Microsoft 365); email delivery services, such as Twilio SendGrid, and messaging services that bring new requests to our team; and providers of artificial intelligence tools, such as Anthropic, that help our team translate, summarise and prepare texts and replies;
4. (d)Google, which receives data from the Google Ads tag on the Website and uses some of it for its own purposes under its own policies;
5. (e)banks and payment providers that process payments, refunds and Security Deposits, and insurers where a claim concerns them;
6. (f)our professional advisers, such as lawyers, accountants and auditors, who are bound by a duty of confidentiality;
7. (g)government authorities, courts, the police, the immigration authorities and other officials, where the law requires it, under a lawful order, or where it is needed to establish, exercise or defend legal claims;
8. (h)a buyer, investor or successor in a merger, sale, restructuring or transfer of all or part of our business, which must protect the data in line with this Policy;
9. (i)anyone else, with your consent or at your request.

Service providers that process data for us may use it only on our instructions and must protect it, under the data protection terms we accept from or agree with them (section 40 of the PDPA). Suppliers, the operators of messengers and social networks, Google for its own advertising purposes, banks and authorities use the data they receive as separate data controllers.

Cards and the texts and photos that Partners submit for publication become public on the Website and may appear in our advertising and social media posts, as the Partner Program Terms describe. A Partner who submits photos of identifiable people must have their permission.

We do not sell personal data.

The Website uses PostHog, the analytics service of PostHog, Inc. (United States), including its session replay, which records how our pages looked and changed during a visit. What you type into form fields is masked in recordings, but other text and links shown on the page can appear in them. We do not tell PostHog who you are. Our team may look at the visit that led to a particular Booking Request, to learn which page or campaign brought it.

The Website also uses the Google Ads tag of Google LLC (United States) to measure which ads lead to contact clicks and sent forms and to show our ads again to people who visited the Website. Google receives your IP address, the pages you visit, your scrolling, form use and clicks on links to other websites, and identifiers stored in cookies. The tag is also set to detect email addresses and phone numbers that you enter on our pages and to send them to Google in hashed (encoded) form, so that Google can match the results of our ads with its users. Google uses some of this data for its own purposes.

For visitors in the European Economic Area, the United Kingdom and Switzerland, the Google tag works without advertising and analytics cookies and without hashed contact details, and PostHog sets no cookie for visitors whose browser uses a European time zone. The Website does not show a cookie banner at present. The Cookie Policy describes what these services collect, lists every cookie and storage key and explains how to refuse or delete them.

We keep Booking Requests, our order records and Partner data on our server in Bangkok, Thailand. Some personal data is transferred to, or accessed from, other countries:

1. (a)Singapore: the owner and some members of our team work from Singapore and access our systems from there, and some records, such as correspondence with Partners and business contacts, are kept on their computers and accounts;
2. (b)the United States and other countries where our service providers operate: PostHog and Google (United States), Cloudflare (a global network operated from the United States), Microsoft (data centres that may be outside Thailand), and our email delivery and artificial intelligence providers (United States);
3. (c)the countries where WhatsApp, Telegram, LINE, Instagram, Facebook and LinkedIn store and process messages, when you choose to contact us through them;
4. (d)the country where a Service takes place, if it takes place outside Thailand, for example the destination of a private flight.

Where the Personal Data Protection Committee has not recognised the destination country as having adequate data protection standards, we transfer personal data only as sections 28 and 29 of the PDPA and the Committee's notifications on transfers abroad allow: for example, where the transfer is necessary to perform a contract with you or to take steps you ask for before a contract, where it is needed for a contract made in your interest, where you have consented after being told about the standards of the destination country, or under the data protection terms of our service providers, including standard contractual clauses where the provider offers them.

Team members in Singapore act for the Company and on its instructions, must keep the data confidential, and use it only for the purposes in this Policy.

You can ask us about the safeguards for a particular transfer through the channels in Contact us.

We keep personal data only as long as we need it for the purposes in this Policy, or as long as the law requires or allows. The usual periods are:

When the period ends, we delete or destroy the data, or make it anonymous so that it no longer identifies you. We may keep data longer where it is needed to establish, exercise or defend legal claims or where the law requires it.

We maintain administrative, technical and physical security measures suited to the risks, as section 37(1) of the PDPA requires. They include encrypted connections to the Website (HTTPS); access to our systems only for team members who need it; sign-in to our admin systems with a personal password and a one-time code from an authenticator app; Partner passwords and API keys stored only as hashes; limits on the number of requests and sign-in attempts; and filters against malicious requests.

No method of transmission or storage is completely secure, and messages sent by email or messenger pass through systems that we do not control. Please send identity documents only through the channel your manager gives you, and never send card details.

If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee without delay and, where feasible, within 72 hours after we become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of persons. If the breach is likely to result in a high risk, we will also tell the people affected, together with the measures we are taking (section 37(4) of the PDPA).

Subject to the conditions and exceptions in the PDPA, you have the right:

1. (a)to withdraw your consent at any time, without affecting processing that took place before the withdrawal (section 19);
2. (b)to access and obtain a copy of your personal data, and to ask how we obtained data that we collected without your consent (section 30);
3. (c)to receive your personal data in a commonly used machine-readable format and to have it sent to another controller, where the PDPA provides for this (section 31);
4. (d)to object to processing based on legitimate interests, and to object at any time to direct marketing (section 32);
5. (e)to have your personal data deleted, destroyed or made anonymous (section 33);
6. (f)to have the use of your personal data restricted (section 34);
7. (g)to have your personal data corrected, completed and kept up to date (sections 35 and 36);
8. (h)to complain to the Personal Data Protection Committee (section 73).

To use a right, write to info@siam-luxury.com with the subject "Personal data", or contact us through any channel in Contact us. Say which right you want to use and which data it concerns. Before we act, we may ask you to confirm your identity, for example through the phone number, messenger account or Partner Account that the data belongs to.

We act on a request without delay and within 30 days of receiving it. We may refuse a request where the law allows, for example where we must keep the data to comply with the law or to establish, exercise or defend legal claims, or where the request would harm the rights and freedoms of others. If we refuse, we tell you why and record the refusal as the PDPA requires.

We do not charge for handling requests. If a request is clearly unfounded or excessive, we may refuse it or ask for a reasonable fee, to the extent the law allows.

If you believe that we have breached the PDPA, you can tell us and we will try to put it right. You may also complain to the Office of the Personal Data Protection Committee (www.pdpc.or.th).

If the data protection law of another country, such as the General Data Protection Regulation in the European Union or the United Kingdom, applies to our processing of your data, you also have the rights that law gives you, including the right to complain to the data protection authority of your country.

We send offers and news to Guests and Users only with their consent or where the law otherwise allows it. We may write to businesses about the Partner Program and the Affiliate Program on the basis of our legitimate interests.

You can stop marketing messages at any time by replying "stop" in the same chat or email, by using the unsubscribe link where there is one, or by writing to info@siam-luxury.com. We then stop and keep only the record we need to respect your choice. As the Computer Crime Act B.E. 2550 (2007) requires, you can refuse our marketing emails easily in these ways.

Messages about your own Booking Request, Booking or Partner Account, such as confirmations, changes and payment reminders, are not marketing. They continue for as long as the Booking or the account requires them.

Under Thai law a person under 20 years of age is a minor, unless they have become sui juris by marriage. Bookings must be made by adults, and the Website is not intended for minors to send us Booking Requests or personal data.

We collect data about children in a Guest's party, such as names and ages, from the parent, guardian or adult who books for them, so that the Service can be arranged safely. Where the PDPA requires consent for a minor's data, we ask the holder of parental responsibility, and for a child aged 10 or under only the holder of parental responsibility can give it (section 20).

If we learn that we have received a minor's personal data without the consent the law requires, we delete it unless another legal basis applies.

When you contact us through WhatsApp, Telegram, LINE, Instagram, Facebook or LinkedIn, or follow our pages there, the company that runs the platform processes your data under its own privacy policy and terms. We receive the messages and the profile details the platform shows us, and handle them under this Policy.

The Website links to other websites and shows content from other services, such as photos and maps. Those websites and services follow their own privacy practices, for which the Company is not responsible.

A Supplier may also collect data from you directly, for example for a rental agreement, a copy of your documents or the tracking of a vehicle or boat. It does so as a separate data controller and must give you its own notice.

We may update this Policy when our processing, our Services or the law change. The current version is always on this page with its effective date. If a change is significant, we will also tell you by email, by messenger or by a notice on the Website where we can. Where a change requires your consent, we will ask for it.

For questions about this Policy or to use your rights, contact Siam Luxury Adventure Co., Ltd.:

1. email: info@siam-luxury.com, with the subject "Personal data";
2. phone: +66 61 497 0336;
3. WhatsApp: +65 8986 8291;
4. Telegram: t.me/siam_luxury_adventure;
5. LINE: timoteobir (line.me/ti/p/~timoteobir);
6. post: 88/384 Moo 2, Ko Kaeo Sub-district, Mueang Phuket District, Phuket Province, Thailand.

We prefer requests about personal data in writing, by email, so that both sides have a record of them.