Privacy Policy

Last updated: September 2026

Phuket Bay Properties Co., Ltd. (registration N° 0835568000738), 100/98 Soi Khokmakram, Tambon Rawai, Amphoe Muang Phuket, 83130 Phuket, Thailand, is the data controller for the personal data described below. This notice is issued under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Personal data we collect

• Bookings: name, email, phone number, stay dates, number of guests and your messages. Card payments are processed by Stripe: we never see or store your full card number.
• Immigration reporting: for foreign guests, passport details required by Thai immigration law (TM30 notification of foreigners' residence).
• Enquiries (contact form, email or WhatsApp): request type, name, email, optional phone number and your message.
• Technical data: IP address and browser information recorded in our web host's server logs for security; an anonymised (one-way hashed) identifier used against spam; your cookie choice saved in your browser; audience statistics only if you accept them.

2. Why we use it, and on what legal basis

• Replying to your enquiries and preparing quotes — steps taken at your request before a contract (PDPA Section 24(3)).
• Managing your booking, stay, payment and communications — performance of a contract (Section 24(3)).
• Accounting, tax and immigration (TM30) obligations — legal obligation (Section 24(6)).
• Website security and prevention of spam and fraud — legitimate interests (Section 24(5)).
• Audience statistics (Google Analytics) and marketing messages — only with your consent (Section 19), which you can withdraw at any time.

3. If you do not provide your data

The data requested for an enquiry or a booking is needed to answer you or to perform the booking, and immigration data is required by law. Without it, we may be unable to reply, confirm a booking or welcome you in the villa.

4. Who receives your data

We never sell personal data. It is shared only when needed, with:

• service providers acting on our behalf: Hostfully (booking management), Stripe (payments), Hostinger (website hosting and email), Google (audience statistics, only with your consent);
• WhatsApp (Meta), if you choose to contact us through it; Airbnb or Booking.com, if you booked through them (their own privacy policies apply);
• the owner of the villa you stay in and our housekeeping or maintenance staff, limited to what is needed to prepare and manage your stay;
• public authorities (for example immigration or tax authorities) when the law requires it.

5. Transfers outside Thailand

Some of these providers store data outside Thailand (for example in the United States, the European Union or Singapore). Such transfers are made with safeguards recognised under PDPA Sections 28 and 29, such as the providers' data processing terms including standard contractual clauses, or where the transfer is necessary to perform your booking.

6. How long we keep it

• Enquiries not followed by a booking: 24 months after our last exchange, then deleted.
• Booking, invoicing and accounting records: for the period required by Thai accounting and tax laws (generally 5 years), longer only if the law requires it.
• Immigration (TM30) data: for the period required by law, then deleted.
• Anti-spam identifier: one hour at most. Server logs: a limited period set by our web host for security purposes.
• Marketing consent and related contact details: until you withdraw your consent.

7. Cookies and browser storage

This website does not use advertising cookies. Your cookie choice is saved in your browser so that we do not ask again. If you accept, Google Analytics is used to understand how visitors use the site (pages viewed, approximate country, device type), with IP addresses anonymised. If you decline, no analytics cookies are set. You can change your choice at any time by clearing this site's data in your browser. Fonts and currency exchange rates are served from our own server, so your IP address is not shared with those providers.

8. Marketing messages

We send news or offers (for example about villas for sale) only if you have given a specific consent, separate from your enquiry or booking. You can withdraw it at any time by replying to the message or by contacting us.

9. Your rights

Under the PDPA (Sections 30 to 36) you may ask us to: access your data and obtain a copy; know how it was obtained; receive it in a readable format or have it sent to another organisation; object to its use; delete, destroy or anonymise it; restrict its use; correct it. You may withdraw consent at any time, without affecting processing already carried out. Contact us using the details below; we may verify your identity and will reply within 30 days. You may also complain to the Office of the Personal Data Protection Committee (PDPC), Thailand — pdpc.or.th. Residents of the European Union may also contact the data protection authority of their country.

10. Security

We use encrypted connections (HTTPS), restricted access, two-factor authentication on our accounts, and keep technical keys outside the public parts of our server. If a personal data breach occurs, we notify the PDPC within 72 hours where required, and inform you without delay if there is a high risk to you.

11. Minors

Our services are intended for adults. We do not knowingly collect personal data from minors (under 20 under Thai law) without the consent of a parent or guardian, except where the law allows it.

12. Changes to this policy

We may update this policy. The date at the top of this page shows the latest version.

13. Contact

Phuket Bay Properties Co., Ltd.
Address: 100/98 Soi Khokmakram, Tambon Rawai, Amphoe Muang Phuket, 83130 Phuket, Thailand
Email: contact@phuketbayproperties.com
Phone: 092 918 8344 / 095 037 6464