Privacy Policy

Baan Yin Dee Boutique Resort ("Baan Yin Dee", "we", "us") is the data controller for personal information collected through baanyindee.com, our booking channels, and during your stay. Our registered address is 7/5 Meun-Ngern Road, Patong, Kathu, Phuket 83150, Thailand.

This policy describes what personal data we collect, how we use it, how long we keep it, and the rights you have over it. It is aligned with the Thailand Personal Data Protection Act B.E. 2562 (PDPA) and with the EU General Data Protection Regulation (GDPR) for our European guests.

When you make a booking: your name, passport or ID details, email, phone number, home address, arrival and departure information, payment card details (handled by our PCI-compliant payment processor — we do not store full card numbers), dietary or accessibility requests, and any special preferences you share with us.

When you use our website: your IP address, browser type, pages visited, and approximate location (country / city level), via privacy-respecting analytics. We do not use advertising cookies or third-party tracking pixels.

When you contact us: the contents of your message by email, WhatsApp, contact form, or phone.

During your stay: room key activity, restaurant and bar charges, spa appointments, and CCTV footage in public areas of the resort for safety and security purposes.

To take and fulfil your reservation — confirm the booking, allocate a room, prepare the room to your preferences, bill the stay.

To comply with Thai law — under the Hotel Act and Immigration Act we are required to register every guest with the local authorities and keep those records for a minimum period.

To communicate with you — respond to enquiries, send confirmations, answer questions before, during, and after your stay.

To improve our service — review how guests use the website and the resort so we can make the experience better. Analytics are aggregated and do not identify individuals.

To send optional marketing — only to guests who have explicitly opted in to our monthly newsletter. You can unsubscribe at any time with one click.

Legal basis under GDPR: performance of a contract (reservations), legal obligation (Thai Hotel Act), legitimate interests (service improvement), and consent (marketing).

We keep your data private. We do not sell it. Ever.

We share minimum necessary data with: our booking channel manager (SiteMinder) and the OTAs you book through, our payment processor, Thai immigration and local police (as required by law on a per-guest basis), and third-party operators we book on your behalf (tours, drivers, external restaurants) — and only the information they need to deliver the service.

Our website uses Google Fonts and a minimal number of static assets from Google’s CDN. These providers may log standard connection metadata (IP, browser) but do not receive any booking or identity information.

Booking records and invoices: 7 years, as required by Thai accounting and tax law.

Guest registration records: 5 years after departure, as required by the Thai Hotel Act.

Marketing consent and newsletter data: until you unsubscribe, then deleted within 30 days.

Website analytics: aggregated and retained for 12 months.

CCTV footage in public areas: 30 days on rolling overwrite, unless required for an ongoing safety or legal matter.

All booking and guest data is stored on servers inside locked offices with access restricted to trained staff. Communication between your browser and our website is encrypted with TLS. Payment card details are handled by PCI-DSS compliant processors and never touch our servers.

Staff are trained on data handling and sign confidentiality agreements at the start of employment.

Under both PDPA and GDPR you have the right to: access the personal data we hold about you, correct it if it is wrong, ask us to delete it (subject to our legal retention obligations), withdraw any marketing consent, and object to processing in certain cases.

To exercise any of these rights, email reservations@baanyindee.com with the subject "Privacy request". We will respond within 30 days — usually the same week.

If you are in the EU and you feel we have not handled your request properly, you have the right to complain to your local data protection authority. In Thailand, complaints can be made to the Office of the Personal Data Protection Committee.

We use a minimal set of cookies: a session cookie that keeps you logged in while browsing the site, and a privacy-respecting analytics cookie that helps us see which pages are visited. We do not use advertising cookies and we do not track you across other sites.

Most browsers let you block or delete cookies through their settings if you prefer.

Our website and booking process are intended for adults. We do not knowingly collect personal information from children under 18 online. If a parent or guardian believes we have collected such information, please contact us and we will delete it.

If we update this policy we will post the new version here with an updated date at the top. Material changes will be emailed to active guests and newsletter subscribers at least 30 days before they take effect.