At Puttaya Glow, we are committed to protecting your privacy and ensuring the highest level of security for your personal data. This Comprehensive Privacy Policy explains how we collect, use, process, and protect your personal information when you use our website (puttayaglow.com), make reservations, or visit our venue in Pattaya, Thailand.
This policy has been designed to comply strictly with both the Thai Personal Data Protection Act B.E. 2562 (PDPA) and the European Union General Data Protection Regulation (GDPR).
1. Data Controller Information
For the purposes of the GDPR and the PDPA, the Data Controller responsible for your personal data is Puttaya Glow, located in Pattaya City, Chon Buri, Thailand. We determine the purposes and means of processing your personal data.
2. Categories of Personal Data We Collect
We collect and process the following categories of personal data:
- Identity and Contact Data: Full name, email address, telephone number, and residential address (where necessary for hotel bookings).
- Financial and Transaction Data: Payment details required to secure bookings. (Note: All payments are processed via secure, PCI-compliant third-party gateways. We do not store your full credit or debit card details).
- Booking and Preference Data: Details of your reservations, including dietary requirements, room preferences, and event specifications.
- Technical and Usage Data: IP address, browser type, time zone setting, and website interaction data, collected via cookies (please refer to our Cookie Policy).
- Security Data: Closed-Circuit Television (CCTV) footage captured when you visit our physical venue, strictly for the purposes of security and crime prevention.
3. Lawful Basis and Purposes for Processing
Under the GDPR and PDPA, we must have a valid lawful basis to process your data. We process your data under the following legal grounds:
- Performance of a Contract: We process your Identity, Contact, Financial, and Booking Data to fulfil our contractual obligations to you. This includes managing your reservations, processing payments, and providing our golf, dining, karaoke, and hotel services.
- Legal Obligation: We may process and retain your Financial and Transaction Data to comply with statutory accounting, tax, and legal requirements under the laws of the Kingdom of Thailand.
- Legitimate Interests: We process Technical Data to maintain our website's functionality and Security Data (CCTV) to ensure the safety of our staff, guests, and property. We balance our legitimate interests against your fundamental rights and freedoms.
- Consent: We rely on your explicit, opt-in consent to send you marketing communications regarding promotions, events, and special offers. You may withdraw this consent at any time.
4. Disclosure and Sharing of Personal Data
We strictly do not sell, trade, or rent your personal data. We only share your data with trusted third parties under strict confidentiality agreements, including:
- Service Providers: Payment gateways, booking management systems, and IT support providers necessary for service delivery.
- Legal Authorities: Law enforcement agencies, courts, or government bodies in Thailand, but only where strictly required by law or to protect our legal rights.
5. International Data Transfers
Puttaya Glow is based in Thailand. If you are accessing our services from the European Economic Area (EEA) or the United Kingdom, your personal data will be transferred to and stored in Thailand.
To ensure your data receives a level of protection equivalent to the GDPR, we ensure that any cross-border data transfers are safeguarded by robust technical measures and legally binding instruments, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or we process the data based on your explicit consent for the performance of a contract (e.g., booking your holiday).
6. Data Retention Policy
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected:
- Booking and Transaction Records: Retained for up to ten (10) years following your transaction to comply with Thai tax and accounting laws.
- Marketing Data: Retained until you withdraw your consent or explicitly opt out of our communications.
- CCTV Footage: Retained for a maximum of thirty (30) days, after which it is automatically overwritten, unless required longer for an active security investigation.
7. Your Data Protection Rights
Under both the GDPR and the PDPA, you possess comprehensive rights regarding your personal data. You have the right to:
- Right to be Informed: To know how we use your data (as outlined in this policy).
- Right of Access: To request a copy of the personal data we hold about you.
- Right to Rectification: To request that we correct any inaccurate or incomplete data.
- Right to Erasure ('Right to be Forgotten'): To request the deletion of your personal data where there is no compelling reason for its continued processing.
- Right to Restrict Processing: To ask us to suspend the processing of your personal data under specific circumstances.
- Right to Data Portability: To request the transfer of your personal data to you or a nominated third party in a structured, commonly used, machine-readable format.
- Right to Object: To object to our processing of your data where we are relying on a legitimate interest, or to object to direct marketing.
- Right to Withdraw Consent: To withdraw your consent at any time for data processing based on consent (such as marketing newsletters).
8. Automated Decision-Making and Profiling
Puttaya Glow does not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning you.
9. Data Security
We have implemented robust technical and organisational measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered, or disclosed. This includes SSL encryption, secure network architectures, and limiting access to personal data to employees and contractors on a strict 'need-to-know' basis.
10. Right to Lodge a Complaint
If you believe that our processing of your personal data infringes data protection laws, you have the legal right to lodge a complaint with the relevant supervisory authority:
- In Thailand: The Personal Data Protection Committee (PDPC).
- In the EU/EEA: The local Data Protection Authority (DPA) within your country of residence.
However, we kindly request that you contact us first so that we may have the opportunity to address and resolve your concerns directly.
11. Contact Us
If you wish to exercise any of your data subject rights, or if you have any questions regarding this Comprehensive Privacy Policy, please contact our Data Protection Team at:
- Email: [email protected]
- Address: Puttaya Glow, Pattaya City, Chon Buri, Thailand
Note: Puttaya Glow reserves the right to amend this Privacy Policy at any time. Any changes will be posted immediately on this page, and we encourage you to review it periodically.