Privacy Policy

For the purposes of this Privacy Policy, the personal data controller is:

Sabuy Retreat Co., Ltd., the operator of the Hotel. 54 Moo 2, Bang Phrom, Bang Khonthi, Samut Songkhram 75120, Thailand.

For privacy-related questions, requests, or complaints, please contact us by email at [email protected].

Unless we are legally required to appoint a formal Data Protection Officer, privacy-related matters will be handled through the above contact channel.

We may collect the following categories of personal data, depending on how you interact with us:

We may collect personal data from:

• You directly
• Your travel companion, family member, representative, company, or travel agent
• Online travel agencies or booking platforms
• Reservation systems or property-management systems
• Payment service providers
• Website, analytics, hosting, and security tools
• Communication channels such as email, website forms, booking systems, or other service-related channels
• Public authorities, where applicable

If you provide personal data about another person, such as a companion or family member, you should ensure that you have the right to provide that information to us.

We use personal data only as reasonably necessary for lawful hospitality, operational, legal, security, and guest-service purposes, including:

Depending on the situation, we may process your personal data based on one or more of the following legal bases:

• Performance of contract: to process your booking, provide accommodation, and deliver related services.
• Legal obligation: to comply with hotel, immigration, tax, accounting, and other applicable laws.
• Consent: for marketing communications, optional services, or specific situations where consent is required.
• Legitimate interests: for property management, safety, security, fraud prevention, service improvement, business administration, and dispute handling, provided that such interests do not override your rights under applicable law.
• Vital interests or public interest: where processing is necessary in emergency, safety, legal, or public-interest situations.

You may withdraw consent at any time, but withdrawal will not affect processing already carried out lawfully before the withdrawal. In some cases, we may still need to process certain data to comply with legal obligations or to provide essential services.

To operate our property efficiently, we may use trusted third-party service providers and business partners, including:

• Reservation and property-management systems
• Online travel agencies and booking platforms
• Channel managers
• Payment gateways and financial institutions
• Guest messaging and communication tools
• Email and customer-support tools
• Website hosting providers
• Analytics and security tools
• Accounting, legal, IT, or professional advisers
• Tour operators or service partners, where relevant to your request

Depending on the services provided, these third parties may act as independent data controllers, joint controllers, or data processors.

Where they act as our processors, they are expected to process personal data in accordance with our instructions and applicable contractual obligations. Where they act as independent controllers, they process personal data according to their own legal obligations, privacy policies, and terms of service.

We do not sell your personal data to third parties.

If you book through an online travel agency, travel agent, payment provider, social-media platform, messaging platform, or other external service, that third party may collect and process your personal data independently.

Their privacy practices are governed by their own privacy policies and terms, which we do not control. We encourage you to review those policies directly.

We are not responsible for the independent privacy practices, security practices, or system failures of third-party platforms, except to the extent required by applicable law.

Some third-party systems, service providers, booking platforms, payment providers, communication tools, or website services may store or process data outside Thailand.

Where practicable, we seek to engage reputable providers that maintain appropriate privacy and security standards. Where applicable and reasonably possible, we rely on contractual terms, service-provider commitments, or other available mechanisms intended to protect personal data.

Third-party providers have their own legal and technical practices. Please consult their privacy information alongside this policy.

Payments may be processed through secure external payment providers, financial institutions, or payment gateways.

We do not intentionally collect or store full payment card numbers in our internal systems. Payment data may be tokenized, encrypted, or otherwise handled by third-party payment providers according to their own security standards and legal obligations.

In the event of a payment dispute, refund, fraud investigation, or chargeback, the procedures and policies of the relevant payment provider, bank, card network, or platform may apply.

We may use third-party tools to send or manage:

• Booking confirmations
• Pre-arrival information
• In-stay messages
• Payment reminders
• Post-stay follow-ups
• Feedback requests
• Service updates

These systems may temporarily process or store communication content and related guest information for operational purposes, maintenance, troubleshooting, system security, or service improvement.

We do not knowingly permit third-party providers to use guest data for unrelated purposes unless allowed under their own lawful basis and privacy terms.

Our website uses cookies, browser storage, and similar technologies for necessary website operation and, only with your permission, optional analytics.

• Remember your selected language and accessibility or readability preferences
• Store your first-party privacy and consent preference for up to 180 days
• Support form submission and retry processes, including necessary session storage
• Protect forms against spam and automated abuse through Cloudflare Turnstile
• Analyze website use and performance only after you allow Analytics

Analytics is disabled by default. Google Tag Manager is not initialized by the website unless a current saved preference allows Analytics. The website does not currently offer a Marketing consent category.

The Location page does not load the embedded Google Map automatically. The map connects to Google only after you choose to view the interactive map.

You may change your Analytics choice at any time through Cookie Settings in the website footer. Necessary technologies remain available so that security, language and readability preferences, and Hotel forms continue to work.

CCTV may be used in public areas, entrances, exits, parking areas, walkways, reception areas, restaurants, piers, and other operational or security-sensitive areas.

CCTV footage may be used for:

• Guest, staff, visitor, and property safety
• Crime prevention
• Incident verification
• Dispute resolution
• Insurance, legal, or authority-related matters
• Internal security review

CCTV footage is accessed only by authorized persons and retained only as long as reasonably necessary, unless a longer period is required for legal, security, insurance, or dispute-related purposes.

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may vary depending on the type of data:

• Reservation, invoice, accounting, and tax records may be retained for at least 7 years or as required by applicable law.
• Guest-registration and identity-related records may be retained as required by hotel, immigration, and other applicable laws.
• Payment records may be retained as required for accounting, tax, refund, chargeback, audit, or dispute purposes.
• Communication records may be retained for a reasonable period for service, dispute, or operational purposes.
• CCTV footage is generally retained for a limited period unless needed for incident investigation, legal claims, insurance matters, or authority requests.
• Marketing consent records may be retained until consent is withdrawn, the purpose expires, or retention is no longer necessary.

When personal data is no longer necessary, we will delete, destroy, anonymize, or restrict access to it where reasonably practicable.

We take reasonable technical, administrative, and organizational measures to protect personal data from unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

• Password protection
• Access controls
• Limited staff access
• Secure third-party systems
• Staff guidance and confidentiality expectations
• Physical security measures
• Use of reputable service providers
• Reasonable monitoring and review of data-handling practices

However, no method of transmission over the internet, electronic storage, cloud service, or third-party system is completely secure. We cannot guarantee absolute security or complete prevention of unauthorized access, cyberattacks, technical failures, or third-party incidents.

If we become aware of a personal data breach, we will take reasonable steps to assess, contain, mitigate, and respond to the incident.

Where required by applicable law, we will notify the relevant authority and/or affected individuals within the required legal timeframe.

Our response will depend on the nature, severity, likely risk, available information, and legal requirements applicable to the incident.

Subject to applicable law and legal exceptions, you may have the following rights:

• Right to access your personal data
• Right to request a copy of your personal data
• Right to correct inaccurate or incomplete data
• Right to request deletion, destruction, or anonymization
• Right to restrict processing
• Right to object to certain processing
• Right to withdraw consent
• Right to data portability, where applicable
• Right to lodge a complaint with the relevant authority

To exercise your rights, please contact us using the contact details in this Privacy Policy.

We may request reasonable information to verify your identity before processing your request. This is to protect your privacy and prevent unauthorized access to your data.

We respond within the timeframe required by applicable law or, where no specific statutory period applies, within a reasonable time considering the nature of the request.

Some requests may be refused or limited where permitted by law, such as where data must be retained for legal, tax, accounting, immigration, security, contractual, or dispute-related reasons.

Our services are not intended to collect personal data directly from minors without the involvement or consent of a parent, legal guardian, or responsible adult.

Where children or minors stay with us as part of a family, group, school, agency, or guardian-arranged booking, we may collect limited personal data as necessary for reservation, safety, legal compliance, and service delivery.

If you believe that a child or minor has provided personal data to us without proper authorization, please contact us.

If you have consented to receive marketing communications, you may withdraw your consent or opt out at any time by contacting us or using any unsubscribe method provided in the communication, where available.

Withdrawal of marketing consent does not affect our ability to send necessary operational or legal communications related to bookings, payments, stays, safety, or service matters.

The Hotel handles privacy questions, requests and complaints with careful consideration through [email protected]. Sabuy Retreat Co., Ltd. remains the legal operator and data controller.

We consider privacy requests, data incidents and guest concerns fairly, diligently and in good faith. This does not limit mandatory legal rights under applicable law.

To the fullest extent permitted by applicable law:

• We are not responsible for indirect, incidental, special, punitive, or consequential losses arising from data processing, website use, system interruptions, service outages, or third-party platform issues.
• We are not responsible for data breaches, leaks, unauthorized access, system failures, cyber incidents, or service interruptions caused by third-party providers, internet infrastructure, payment networks, booking platforms, hosting providers, telecommunications providers, or events beyond our reasonable control, provided that we have acted in good faith and without intentional misconduct or gross negligence.
• We are not responsible for the independent privacy practices or security measures of third-party platforms that operate under their own policies and legal obligations.

Nothing in this Privacy Policy excludes or limits liability where such exclusion or limitation is prohibited by applicable law.

We are not responsible for any failure or delay in performing privacy-related obligations where such failure or delay is caused by events beyond our reasonable control, including but not limited to:

• Natural disasters
• Fire, flood, storm, epidemic, or public emergency
• Power failure
• Internet or telecommunications outage
• Cyberattack
• System failure
• Government action
• Acts or omissions of third-party providers
• Other events that could not reasonably be prevented

Where possible, we will take reasonable steps to reduce the impact of such events.

This Privacy Policy is provided for transparency and information purposes. It does not create contractual obligations beyond those required by applicable law.

Nothing in this Privacy Policy affects any mandatory rights, obligations, or protections under applicable law.

We may update this Privacy Policy from time to time to reflect changes in our operations, systems, legal requirements, or business practices.

The latest version will be posted on our website with an updated “Last Updated” date.

Where required by law or where changes are material, we may provide additional notice or request consent.

If you believe that your personal data has been handled improperly or that your data protection rights have been violated, please contact us first so that we can try to resolve the matter.

You may also lodge a complaint with the Thailand Personal Data Protection Committee (PDPC) or another competent authority where applicable.