Privacy Policy

1. Data Controller

As the data controller, we determine the purposes and means of processing your personal data. If you have questions about how your data is handled, please contact our Data Protection Officer at privacy@samui.tours.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Information You Provide

• Identity data: Full name, nationality, passport or ID number (when required for tour bookings)
• Contact data: Email address, phone number, WhatsApp number
• Booking data: Tour preferences, travel dates, number of travellers, hotel pickup location, special requirements
• Payment data: Billing name, billing address. Credit/debit card details are processed directly by our payment processor (Authorize.net) and are never stored on our servers.
• Communication data: Messages sent via contact forms, email, WhatsApp, or phone
• Health data: Medical conditions or dietary requirements you voluntarily disclose for tour safety purposes

2.2 Information Collected Automatically

• Device data: Browser type and version, operating system, screen resolution
• Usage data: Pages visited, time spent on pages, click paths, referral source
• Network data: IP address, approximate geographic location (country/city level)
• Cookie data: See our Cookies section and full Cookie Policy

3. Purposes of Processing

We use your personal data for the following purposes:

4. Legal Bases for Processing

4.1 Under the GDPR (EU/EEA Visitors)

• Contract performance (Article 6(1)(b)): Processing necessary to fulfill your booking and provide our tour services
• Consent (Article 6(1)(a)): Marketing communications, non-essential cookies, and processing of health data you voluntarily provide
• Legitimate interest (Article 6(1)(f)): Website analytics, fraud prevention, improving our services — balanced against your privacy rights
• Legal obligation (Article 6(1)(c)): Tax records and accounting requirements under Thai law

4.2 Under the PDPA (Thailand)

• Consent (Section 19): We obtain your consent before collecting and processing your personal data, unless an exemption applies
• Contractual necessity (Section 24(3)): Processing necessary to perform a contract to which you are a party (tour bookings)
• Legitimate interest (Section 24(5)): Processing necessary for our legitimate interests, provided it does not override your fundamental rights
• Legal obligation (Section 24(6)): Compliance with Thai laws including tax and consumer protection regulations

4.3 Under the UK GDPR (UK Visitors)

The same legal bases as described in Section 4.1 above apply to the processing of personal data of individuals in the United Kingdom, in accordance with the UK GDPR and the UK Data Protection Act 2018.

5. Third-Party Data Recipients

We share your personal data with the following third-party service providers, each for specific and limited purposes:

We do not sell, rent, or trade your personal data to any third parties. Data is shared only as described above and under appropriate contractual safeguards.

6. Cross-Border Data Transfers

As our business operates from Thailand and uses international service providers, your personal data may be transferred outside your country of residence. Specifically:

• Thailand → United States: Data shared with Google (Analytics, Ads, Maps), Meta (Facebook Pixel, WhatsApp), and Authorize.net for the purposes described above
• Thailand → European Union: Data shared with WPML/OnTheGoSystems for translation services

6.1 Safeguards

For transfers of personal data from the EU/EEA or UK, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): We ensure that our US-based service providers have implemented appropriate SCCs as approved by the European Commission
• Data Processing Agreements: All third-party processors are bound by data processing agreements that require them to protect your data to an equivalent standard
• Adequacy decisions: Where applicable, transfers are made to countries that the European Commission has determined provide an adequate level of data protection

For transfers under the PDPA, we ensure that the receiving country has adequate data protection standards or that appropriate safeguards are in place, in accordance with the notifications issued by the Personal Data Protection Committee (PDPC).

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law.

When the retention period expires, your data is securely deleted or anonymized so that it can no longer be linked to you.

8. Your Rights

Depending on your location and the applicable data protection law, you have the following rights regarding your personal data:

8.1 How to Exercise Your Rights

To exercise any of the above rights, please contact our Data Protection Officer:

We may ask you to verify your identity before processing your request to ensure we are acting on behalf of the rightful data subject.

8.2 Right to Complain

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority:

• Thailand: Personal Data Protection Committee (PDPC) — www.pdpc.or.th
• European Union: Your local Data Protection Authority (DPA) — see EDPB member list
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk

9. Children's Privacy

Our services are not directed at children under the age of 16. We do not intentionally collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete that data promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@samui.tours.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. All booking confirmations and customer-related decisions are made by our team members.

11. Cookies

Our website uses cookies and similar tracking technologies. Cookies are small text files stored on your device that help us provide and improve our services. We use the following categories of cookies:

• Strictly necessary cookies: Essential for website functionality (e.g., session management, language preferences). These do not require consent.
• Analytics cookies: Help us understand how visitors use our website (Google Analytics). Loaded only with your consent.
• Marketing cookies: Used to deliver relevant advertisements (Google Ads, Meta Pixel). Loaded only with your consent.

You can manage your cookie preferences at any time using the cookie settings banner on our website. For full details, please read our Cookie Policy.

12. EU Representative

In accordance with Article 27 of the GDPR, we have appointed a representative in the European Union for data subjects in the EU/EEA:

13. UK Representative

In accordance with Article 27 of the UK GDPR, we have appointed a representative in the United Kingdom:

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes:

• The "Last Updated" date at the top of this page will be revised
• For material changes that significantly affect your rights, we will notify you via email (if we have your email address) or through a prominent notice on our website
• We encourage you to review this policy periodically

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: