This policy explains how Siam Lanna Villas ("we", "us") collects, uses, shares, protects and deletes your personal data when you visit siamlannavillas.com, book a stay, order extras, or stay at Villa Siam Lanna or Villa Ayutthaya. It is written to comply with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). If you are visiting from the European Union or the UK, we apply the same principles you are protected by under the GDPR.
1. Who we are
Siam Lanna Villas operates two private pool villas at Kantiang Bay, Koh Lanta, Krabi, Thailand. We are the data controller for the personal data described in this policy.
Contact for anything about your data: siamlannavillas@gmail.com.
2. What we collect and why
We only collect data you give us, plus a small amount of technical data your browser sends automatically.
| When | What we collect | Why |
|---|---|---|
| Booking a villa | Name, email, villa, dates, number of guests, breakfast choice, booking reference | To manage your booking, send confirmations and a private link to your booking |
| Paying by card | Card details are typed directly into the secure form of our payment provider, Opn Payments (Omise). We never see or store your full card number. We receive only the payment status and amount. | To take your deposit and balance |
| Paying by Wise | Name, amount and reference shown on the transfer | To match your payment to your booking |
| Immigration registration (TM30) | For each non-Thai guest: surname, given names, nationality, passport number, gender, date of birth. Plus villa, dates, and the contact person's name, email and (optional) phone. No passport copy or photo. | To file the notification of residence required by Thai law. See section 3. |
| Breakfast requests | Name, email, villa, dates, choices, notes (e.g. allergies), payment method | To prepare and serve your breakfast |
| Contact form & emails | Name, email, and whatever you write to us | To answer you |
| "My Booking" login | Booking reference, email, and a Google reCAPTCHA check | To show you your booking and to block automated attacks |
| Visiting the website | IP address, browser type, pages viewed, approximate location (country/city) | Security (rate-limiting abuse) and anonymous visitor statistics (Google Analytics) |
We do not sell your data, use it for automated decisions about you, or send you marketing emails unless you ask us to.
3. Immigration (TM30) details
Section 38 of Thailand's Immigration Act B.E. 2522 (1979) requires the owner or manager of any accommodation to notify the Immigration Bureau of every foreign guest within 24 hours of their arrival (form TM30). Failing to do so is an offence for the host and can cause problems for the guest. More information is on our immigration registration page.
- Minimum data: we ask only for the details needed for the TM30 form. We do not ask for, copy or keep passport scans or photos. At check-in we simply look at each passport to make sure the details match.
- Not stored on our website: the form sends your details over an encrypted connection directly to our private, password- and 2-step-verification-protected mailbox. Nothing is saved on the web server.
- One purpose only: the details are used solely to file your TM30 with the Thai Immigration Bureau, and to answer any question Immigration asks us about that filing.
- Deleted after 30 days: we permanently delete your details from our mailbox no later than 30 days after your check-out. The email receipt sent to you shows only the last 4 characters of each passport number.
- Immigration's copy: once filed, the data is held by the Thai Immigration Bureau under Thai law. We cannot change or delete their record.
- Accuracy: the guest who submits the form is responsible for the details being complete and correct, and confirms they are allowed to share the details of the other guests listed.
4. Legal bases (PDPA Section 24)
- Contract: booking details, payments, breakfast and extras, needed to provide the stay you booked.
- Legal obligation: TM30 immigration details (Immigration Act Section 38), and accounting records (Thai accounting and tax law).
- Legitimate interests: website security, fraud prevention, and anonymous statistics to improve the site, always balanced against your rights.
- Consent: anything optional you choose to give us, such as notes or a phone number. You can withdraw consent at any time.
5. Who we share data with
Only with the parties below, and only what each one needs:
- Thai Immigration Bureau: TM30 details only, through its official online service.
- Opn Payments (Omise) and Wise: to process your payments.
- Google: Gmail hosts our mailbox, Google Analytics gives anonymous visitor statistics, and Google reCAPTCHA protects the login page.
- Formspree: delivers messages sent through our contact form to our mailbox.
- Our web host: runs the website server (it does not receive TM30 details, which are never stored there).
- Authorities: when Thai law requires it, for example a request from the police or the courts.
Our villa team (owners, managers and the person checking you in) see only what they need to look after you.
6. Transfers outside Thailand
Some of the providers above (Google, Formspree, payment providers) may process data on servers outside Thailand. We use only well-known providers that apply recognised safeguards, such as standard contractual clauses and certified security standards, as required by PDPA Section 28–29.
7. How long we keep data
| Data | How long |
|---|---|
| Immigration (TM30) details | Deleted no later than 30 days after check-out |
| Booking and payment records | Up to 5 years after your stay, as required by Thai accounting law, then deleted |
| Breakfast requests, contact messages and general emails | Up to 12 months after your stay |
| Security logs and rate-limit counters (IP based) | From a few hours up to 30 days |
| Google Analytics data | Up to 14 months, anonymised |
8. How we protect data
- The whole website runs on encrypted HTTPS. Emails are sent over encrypted connections.
- Our mailbox is protected by a strong password and 2-step verification. Only the people who need it have access.
- Booking records on the server are kept in a folder blocked from public access. Card details never touch our server.
- Forms are protected against spam and abuse (rate limits, bot traps, reCAPTCHA).
- If a data breach ever put your rights at risk, we would notify the Thai Personal Data Protection Committee within 72 hours and inform you without delay, as the PDPA requires.
9. Cookies & analytics
- Google Analytics sets cookies to count visits and see which pages are useful. It does not tell us who you are.
- Google reCAPTCHA on the "My Booking" login uses cookies to tell humans from bots.
- Your language choice and shopping basket are saved in your own browser (local storage), not on our server.
You can block or delete cookies in your browser settings at any time. The site still works, apart from the login check.
10. Your rights
Under the PDPA (and the GDPR, if it applies to you) you have the right to:
- access your data and get a copy of it;
- correct data that is wrong or incomplete;
- delete your data, or have it made anonymous;
- restrict or object to how we use it;
- receive your data in a common format, or have it sent to someone else (portability);
- withdraw consent at any time, for anything based on consent;
- complain to the Office of the Personal Data Protection Committee (PDPC), Thailand, at pdpc.or.th.
To use any of these rights, email siamlannavillas@gmail.com. We reply within 30 days. Some rights are limited by law: for example, we cannot delete TM30 details before they have been filed, or delete accounting records we must legally keep.
11. Children
We do not knowingly collect data directly from children. Thai law requires children who are not Thai nationals to be registered (TM30) like adults, so their details are provided by a parent or the adult organising the stay, and are protected and deleted in exactly the same way.
12. Changes & contact
We may update this policy when the law or our services change. The date at the top always shows the latest version, and important changes will be highlighted on this page.
Questions, requests or concerns: siamlannavillas@gmail.com, Siam Lanna Villas, Kantiang Bay, Koh Lanta, Krabi, Thailand.