Who We Are

Thai Garden Resort
179/168 M.5, North Pattaya Road
Naklua, Banglamung
Chonburi 20150
Thailand

For purposes of applicable data protection laws, Thai Garden Resort acts as the **Data Controller** for the personal data described in this Privacy Policy.

If you have questions about how we process your personal data or wish to exercise your privacy rights, please contact us using the details provided in the Contact Us section.

Who This Privacy Policy Applies to

This Privacy Policy applies to individuals who interact with Thai Garden Resort, including:

* Hotel guests and visitors
* Individuals making or enquiring about reservations
* Individuals using our resort facilities and services
* Visitors to our website
* Individuals contacting us by email, telephone, contact forms, or other communication channels
* Travel agents, tour operators, corporate customers, and business partners
* Individuals attending events or activities at the resort
* Individuals who otherwise provide personal data to us

Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data.

Identification Information

This may include:

* Full name
* Date of birth or age
* Nationality
* Passport or identification information where required
* Signature
* Other information required for guest registration or legal compliance

Contact Information

This may include:

* Residential or mailing address
* Telephone number
* Email address
* Emergency contact details
* Other contact information you provide to us

Reservation and Stay Information

This may include:

* Reservation details
* Arrival and departure dates
* Room information
* Number of guests
* Special requests
* Preferences relating to your stay
* Dining, spa, massage, or other service preferences
* Information relating to previous or current stays
* Guest feedback and requests

Payment and Transaction Information

Where necessary to process payments or manage transactions, we may process:

* Payment method
* Transaction details
* Billing information
* Invoice information
* Purchase history

Where payment card information is processed through an external payment provider, the relevant payment provider may process your information directly in accordance with its own privacy policy.

Communications

We may collect information contained in communications you send to us, including:

* Emails
* Contact form submissions
* Telephone enquiries
* Requests
* Complaints
* Feedback
* Other correspondence

Website and Technical Information

When you visit our website, certain technical information may be collected automatically, depending on the technologies used on the website.

This may include:

* IP address
* Browser type
* Device type
* Operating system
* Approximate location derived from technical information
* Pages visited
* Referring website
* Date and time of visits
* Website interactions
* Cookies and similar technologies

Images and CCTV

For security, safety, operational, and other legitimate purposes, CCTV cameras may operate in appropriate areas of the resort.

We may also take photographs or videos during events or activities at the resort. Where required by applicable law, appropriate notices or consent mechanisms will be used.

Sensitive Personal Data

Certain types of personal data are considered sensitive personal data under the Thai PDPA.

This may include information relating to health or medical conditions, where such information is voluntarily provided to us and is necessary for a particular service or request.

For example, you may provide health-related information when:

* Requesting special accommodation
* Requesting accessibility assistance
* Using certain spa or massage services
* Informing us of a medical condition relevant to your stay
* Requesting assistance in an emergency

We will process sensitive personal data only where permitted by applicable law and, where required, with your explicit consent or another applicable legal basis.

Please do not provide sensitive personal data unless it is necessary for the service or request concerned.

How We Collect Personal Data

We may collect personal data directly from you when you:

* Make a reservation
* Contact us
* Check in at the resort
* Stay at the resort
* Use our services or facilities
* Submit a contact form
* Subscribe to communications
* Provide feedback
* Participate in activities or events
* Make a payment
* Communicate with our staff

We may also receive personal data from third parties, including:

* Travel agencies
* Tour operators
* Booking platforms
* Corporate customers
* Business partners
* Service providers
* Individuals travelling with you
* Other parties acting on your behalf

Where permitted by law, we may combine information received from different sources.

How We Use Personal Data

We may use personal data for the following purposes:

Reservations and Guest Services

* Processing and managing reservations
* Providing accommodation and requested services
* Managing check-in and check-out
* Responding to enquiries
* Providing customer service
* Managing special requests
* Improving your experience at the resort

Payments and Administration

* Processing payments
* Issuing invoices and receipts
* Managing financial records
* Preventing fraud
* Managing accounting and administrative activities

Communication

* Responding to enquiries
* Sending reservation confirmations
* Providing important information about your stay
* Communicating about services you have requested
* Handling complaints and feedback

Resort Operations

* Managing resort operations
* Improving our services and facilities
* Conducting internal analysis
* Monitoring service quality
* Maintaining website functionality
* Troubleshooting technical problems

Security and Safety

* Protecting guests, employees, visitors, and property
* Operating security systems and CCTV
* Preventing and investigating fraud, theft, abuse, or other unlawful activity
* Responding to emergencies

Legal and Regulatory Compliance

We may process personal data when necessary to:

* Comply with applicable laws and regulations
* Meet guest registration requirements
* Respond to lawful requests from authorities
* Establish, exercise, or defend legal claims
* Protect our legal rights and interests

Marketing

Where permitted by applicable law and, where required, with your consent, we may use your contact information to send:

* Newsletters
* Special offers
* Resort promotions
* Events and announcements
* Other marketing communications

You may unsubscribe from marketing communications at any time.

Legal Bases for Processing Personal Data

Under the Thai PDPA, we process personal data on one or more applicable legal bases, depending on the circumstances.

These may include:

Performance of a Contract

Processing may be necessary to enter into or perform a contract with you, such as processing a reservation or providing accommodation and other services.

Legal Obligations

We may process personal data where necessary to comply with legal or regulatory obligations.

Legitimate Interests

We may process personal data where necessary for our legitimate interests, provided that such interests are not overridden by your fundamental rights and freedoms.

Examples may include:

* Resort security
* Fraud prevention
* IT security
* Service improvement
* Business administration
* Protection of property
* Handling complaints and disputes

Consent

Where required by law, we will obtain your consent before processing personal data for specific purposes.

You may withdraw consent at any time, subject to applicable legal restrictions and the consequences explained when consent was obtained.

Vital Interests

In exceptional circumstances, personal data may be processed where necessary to protect your life, health, or safety, or that of another person.

Disclosure of Personal Data to Third Parties

We may disclose personal data to appropriate third parties where necessary for the purposes described in this Privacy Policy.

These parties may include:

* Service providers
* Payment providers
* IT and website service providers
* Reservation and booking service providers
* Accounting and financial service providers
* Professional advisers
* Security service providers
* Government authorities
* Law enforcement agencies
* Insurance providers
* Business partners
* Other parties where disclosure is required or permitted by law

We require service providers who process personal data on our behalf to maintain appropriate confidentiality and security measures and to process personal data only as permitted by applicable law and our instructions.

We do not sell your personal data.

International Transfers of Personal Data

Some of our service providers, technology providers, reservation systems, payment providers, or other business partners may operate outside Thailand.

As a result, personal data may be transferred to or processed in countries outside Thailand.

Where personal data is transferred outside Thailand, we will take appropriate measures to ensure that the transfer complies with applicable requirements of the Thai PDPA, including applicable requirements concerning adequate protection, appropriate safeguards, contractual safeguards, or other lawful transfer mechanisms.

The Thai PDPC's own Privacy Notice describes international transfers as a specific component of PDPA compliance and provides for appropriate safeguards and lawful transfer mechanisms.

Cookies and Similar Technologies

Our website may use cookies and similar technologies to provide essential website functionality, remember preferences, understand website usage, and improve the user experience.

Depending on the technologies implemented on our website, cookies may be used for:

* Essential website functions
* Security
* Remembering preferences
* Website analytics
* Performance measurement
* Marketing or advertising purposes

Where required by applicable law, we will request your consent before placing or using non-essential cookies.

You may manage or disable cookies through your browser settings or, where available, through our website's cookie preference tools.

Disabling certain cookies may affect the functionality of parts of our website.

A separate **Cookie Policy** may provide additional information about the specific cookies and technologies used on our website.

Third-Party Services and Websites

Our website may contain links to or integrations with third-party websites and services.

These may include services such as:

* Mapping services
* Social media platforms
* Online booking services
* Payment services
* Analytics services
* Other third-party tools

Third-party services may collect and process personal data according to their own privacy policies.

Thai Garden Resort is not responsible for the privacy practices, security, or content of third-party websites or services.

We recommend reviewing the privacy policies of third parties before providing them with personal information.

Google Maps and Similar Services

Where our website uses mapping or location services, such as Google Maps, these services may process technical information such as IP addresses, device information, or location-related information.

The use of such services is subject to the relevant provider's privacy policy and terms.

We recommend reviewing the applicable privacy information provided by the relevant service provider.

 Data Security

We take reasonable and appropriate technical, organizational, and administrative measures to protect personal data against:

* Unauthorized access
* Loss
* Misuse
* Alteration
* Disclosure
* Destruction
* Other unlawful or unauthorized processing

Security measures may include access controls, authentication, monitoring, encryption where appropriate, employee awareness, and other safeguards appropriate to the nature of the personal data and the risks involved.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

Personal Data Breaches

In the event of a personal data breach, Thai Garden Resort will take appropriate measures to identify, contain, investigate, and mitigate the incident.

Where required by the Thai PDPA, we will notify the Personal Data Protection Committee (PDPC) within the applicable statutory timeframe.

Thai PDPC guidance identifies a **72-hour notification period** for reportable personal data breaches under Section 37 of the PDPA.

Where required by applicable law, we will also notify affected individuals when the breach is likely to result in a high risk to their rights and freedoms.

Data Retention

We retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.

The applicable retention period depends on:

* The nature of the information
* The purpose for which it was collected
* Our legal and regulatory obligations
* Accounting and financial requirements
* Contractual obligations
* The resolution of disputes
* The establishment or defense of legal claims

When personal data is no longer required, we will take reasonable steps to securely delete, destroy, or anonymize it.

Your Rights Under the Thai PDPA

Subject to applicable laws and legal conditions, you may have the following rights regarding your personal data:

Right of Access

You may request access to personal data we hold about you.

Right to Rectification

You may request correction of inaccurate, incomplete, or outdated personal data.

Right to Erasure

You may request deletion of your personal data where the applicable legal requirements are met.

Right to Restrict Processing

In certain circumstances, you may request that we restrict the processing of your personal data.

Right to Object

You may object to certain processing activities where permitted by applicable law, including certain processing based on legitimate interests.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Right to Data Portability

Where applicable under Thai law, you may have the right to receive certain personal data in a commonly used, machine-readable format or request that it be transferred to another data controller.

Right to Lodge a Complaint

If you believe that your personal data has been processed in violation of applicable law, you may have the right to lodge a complaint with the **Personal Data Protection Committee (PDPC)** or another competent authority.

The Thai PDPC identifies rights requests under Sections 30–36 of the PDPA as an important part of personal data protection compliance.

How to Exercise Your Privacy Rights

To exercise your rights, please contact us using the contact details below.

To protect your personal data, we may need to verify your identity before processing your request.

We will consider and respond to requests within the timeframe required by applicable law.

In certain circumstances, we may be legally permitted or required to refuse or limit a request.

Marketing Communications

If you receive marketing communications from us, you may unsubscribe at any time by:

* Using the unsubscribe function included in the relevant communication; or
* Contacting us using the details provided below.

Even if you opt out of marketing communications, we may continue to send essential service-related communications, such as:

* Reservation confirmations
* Booking changes
* Payment information
* Important information concerning your stay
* Security or account-related communications

Children's Personal Data

Our services may be used by families and guests travelling with children.

Where we knowingly collect personal data relating to children, we will process such data in accordance with applicable Thai law and take appropriate measures where parental or guardian consent is required.026**

Information You Should Not Send by Email

Email communications may not provide the same level of security as dedicated secure payment or reservation systems.

For your protection, please do not send sensitive information such as:

* Credit card numbers
* Passwords
* Copies of identity documents
* Detailed medical information

by ordinary email unless specifically requested through an appropriate secure process.0, 2026**

Third-Party Marketing and Advertising

We do not sell personal data.

Where third-party advertising, analytics, social media, or similar technologies are used on our website, they may process certain technical or online identifiers in accordance with their own terms and privacy policies.

Where consent is required by applicable law, such technologies will only be activated after the relevant consent has been obtained.26**

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

* Changes to our services
* Changes to our website
* Changes to technology
* Changes to applicable laws or regulations
* Changes to our data processing practices

When we update this Privacy Policy, we will revise the **Last Updated** date at the top of this document.

We encourage you to review this Privacy Policy periodically.26**

Contact Us

If you have any questions about this Privacy Policy, our handling of personal data, or your privacy rights, please contact us:

Thai Garden Resort
179/168 M.5, North Pattaya Road
Naklua, Banglamung
Chonburi 20150
Thailand

Email: guestservices@thaigarden.com

Telephone: +66 38 370 614