Privacy notice
Last updated 2 October 2026
This notice explains what personal data Thara Tropical Villa collects when you request or book a stay on this website, why, who we share it with, how long we keep it, and your rights under Thailand's Personal Data Protection Act (PDPA).
Who we are
Thara Tropical Villa is a privately owned, owner-operated holiday villa in Baan Tai, Koh Samui, Thailand. Its owner decides how your personal data is used (the "data controller"). For anything about your data, including your rights below, email book@tharatropical.com.
What we collect
- Your booking details: your name, email address, phone number (if you give one), your dates, the number of guests, and anything you write in the "Anything we should know?" box.
- Payment information: your card details go straight to our payment provider, Stripe, and never reach us. Stripe tells us whether a payment or card hold succeeded, the amount, and a reference number.
- Your email preference: whether you ticked the box to receive occasional emails about discounts and promotions, and when.
- Technical information: your IP address and browser details, used to protect the site from abuse (for example, limiting repeated requests) and kept in short-lived server logs. A security check from Cloudflare runs on the booking form to stop automated spam.
Why we use it
- To handle your request and your stay (to take steps you asked for and to perform our agreement with you): checking availability, holding and charging your card, confirming or declining your request, sending booking emails, and looking after you during your stay.
- To keep records we are required to keep (legal obligation): accounting and tax records of bookings and payments.
- To keep the site and payments safe (our legitimate interest): preventing fraud, card testing and spam.
- To send you offers (your consent): only if you ticked the box. You can withdraw at any time by replying to any of our emails or writing to book@tharatropical.com, and we will stop.
We do not sell your personal data, and we do not use it for anything unrelated to your stay.
Who receives it
We use a small number of service providers who handle data for us under their own privacy and security terms:
- Stripe - card payments and card holds.
- Resend - sending our booking emails.
- Cloudflare - the security check on the booking form, and delivering email sent to our address.
- Hostinger - the server this website runs on (in Singapore).
- Backblaze - encrypted backup copies of our booking records.
- Discord - private notifications to us about new and changed bookings (your name, email address and dates).
Some of these providers process data outside Thailand, including in Singapore, the United States and the European Union. We only use established providers that protect personal data to a recognised standard.
How long we keep it
- Bookings that went ahead (including ones later cancelled): for 5 years after the stay, for our accounting and tax records. After that we remove your name and contact details and keep only anonymous figures (dates, number of guests, price).
- Requests that did not become a stay (declined, expired, or payment not completed): for 12 months. After that we remove your name, contact details and message, and keep only anonymous figures (dates, number of guests, price) that cannot identify you.
- Your email preference: until you withdraw it.
- Server logs: a few weeks. Encrypted backups: up to 90 days.
Your rights
Under the PDPA you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, move it to another provider, or withdraw any consent you gave. Some requests may be limited where we must keep records by law (for example, accounting records). To make a request, email book@tharatropical.com; we will reply within 30 days. If you are unhappy with how we handle your data, you can complain to Thailand's Office of the Personal Data Protection Committee (PDPC).
Cookies
Our own booking pages do not set cookies. Stripe (on the payment step) and Cloudflare (on the security check) may set cookies needed to prevent fraud and keep the service secure.
Changes
If we change this notice, we will update the date at the top of this page.