Privacy Policy

1. Introduction

Baan Sabai Garden Spa (“we,” “us,” or “our”), located at 22 Chao Fah West Road, Chalong 83130, TH, operates the website demo.nawaspa.com and the services it describes. This policy explains what personal data we collect when you visit our site, book a treatment, or contact us, why we collect it, who we share it with, and the rights available to you.

We are the data controller for information collected through this website. This policy is designed to address the requirements of Thailand's Personal Data Protection Act B.E. 2562 (PDPA) — the law that governs us as a Thailand-based business — and, for visitors in the European Economic Area, the UK, or Switzerland, the General Data Protection Regulation (GDPR).

2. Information We Collect

Information you provide directly

When you submit a booking or enquiry, message our chatbot, or contact us through the site, we may collect: your name, phone number, email address (optional), preferred treatment and date, party size, and any notes you choose to include (for example, allergies or preferences you mention to our chatbot).

Information collected automatically

With your consent, given through the cookie banner on your first visit, we use Google Analytics 4 to understand how visitors use our website — pages visited, approximate location from IP address, browser type, and time spent on the site. This data is aggregated and is not used to identify you personally. No analytics cookie is set unless you actively accept it; see “Cookies” below.

Our hosting and security providers (Vercel, Cloudflare, Upstash) automatically log technical data such as IP address and request timestamps for the limited purposes of running the site, rate-limiting abusive traffic, and detecting bots on our forms.

3. How We Use Your Information

We use the information you provide to:

• Respond to your booking requests and enquiries, and confirm bookings by email and WhatsApp/Line
• Operate our AI chatbot, which uses your messages to answer questions and help you book
• Maintain records required for tax and business-accounting compliance under Thai law
• Detect and prevent spam or abuse of our booking and enquiry forms
• Understand and improve our website, only where you have consented to analytics cookies

We do not sell, rent, or share your personal information with third parties for their own marketing purposes, and we do not use advertising or cross-site tracking cookies.

4. Who We Share Your Information With

We use the following sub-processors to run our website and business. Each only receives the data it needs to perform its function:

We may also disclose personal data where required by Thai law, court order, or to protect the rights, property, or safety of Baan Sabai Garden Spa, our guests, or the public.

5. International Data Transfers

Several of the services above (including Supabase, Brevo, Cloudinary, Cloudflare, Upstash, MiniMax, Google, and Vercel) process data on servers located outside Thailand, including in the United States and the European Union. Where we transfer personal data internationally, we rely on the standard contractual and security safeguards these providers make available to their customers, consistent with PDPA Section 28–29 requirements for cross-border transfer and, for EEA visitors, the GDPR's transfer mechanisms.

6. Data Retention

We keep personal data only as long as needed for the purposes described in this policy:

• Booking and enquiry records — up to 24 months, for guest service and Thai tax/accounting compliance, unless you ask us to delete them sooner.
• Chat history — retained alongside your booking/enquiry record for the same period, to give context if you contact us again.
• Cookie consent log — up to 24 months. This record contains only a randomly generated ID, a hashed IP address, your category choices, and a timestamp — never your name or contact details.

7. Your Rights

If you are in Thailand (PDPA)

Under Sections 30–36 of the PDPA, you have the right to: request access to and a copy of your personal data; request correction of inaccurate data; request deletion, suspension, or anonymisation of your data; object to or restrict our processing; and withdraw consent at any time (which does not affect processing carried out before withdrawal). You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee.

If you are in the EEA, UK, or Switzerland (GDPR)

You have the same core rights as above, described in GDPR terms as the right to access, rectification, erasure, restriction of processing, data portability, and objection. Where we rely on your consent (such as analytics cookies), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us using the details in Section 11. We will respond within the timeframe required by applicable law (30 days under PDPA).

8. Cookies

When you first visit our site, a banner asks you to choose which cookies to allow. We use two categories:

• Necessary — required for the site to work (remembering your cookie choice, session security). These are always on and don't require consent, as they're strictly necessary to provide the service you've requested.
• Analytics (Google Analytics) — only set if you click “Accept All” or enable it under “Customize.” Nothing is set if you click “Reject Non-Essential.”

We do not use advertising or marketing cookies. You can change your choice at any time via the “Cookie Settings” link in the footer of every page, or by clearing your browser's site data. See Section 6 for how long we keep the record of your decision.

9. Children's Privacy

Our website and services are directed at adults. Treatments have a minimum age of 12, requiring adult supervision where applicable and as posted. We do not knowingly collect personal data from children, and we do not offer services to unaccompanied minors. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS) between your browser and our servers and database, role-based access controls limiting staff access to the information needed for their role, and reputable, security-audited infrastructure providers (Supabase, Vercel, Cloudflare) for hosting and storage. No method of transmission or storage is 100% secure; if we become aware of a data breach affecting your personal information, we will notify affected individuals and the relevant authority as required by the PDPA and, where applicable, the GDPR.

11. Changes to This Policy

We may update this policy from time to time as our services or legal obligations change. The “Last updated” date at the top of this page reflects the most recent revision. If a change is significant — for example, a new category of data or a new third-party processor — we will highlight it on this page or, where required by law, seek renewed consent.

12. Contact

For any privacy-related questions, requests, or complaints, contact us at:

Baan Sabai Garden Spa
22 Chao Fah West Road, Chalong 83130, TH
WhatsApp: +66931584912
Line: @baansabai