Privacy Policy

🔐 Privacy Policy of Thaipol.com Co., Ltd.

This Privacy Policy sets out the rules for collecting, using, storing, sharing and protecting the data of users using the websites and services managed by Thaipol.com Co., Ltd.

The Policy covers in particular the following websites and brands:

• ThaiPol.com
• TajskieWakacje.pl
• ThaiTripGuide.com, including AI tools and applications related to the guide to Thailand
• TajlandiaPoPolsku.pl
• other websites, applications and systems belonging to Thaipol.com Co., Ltd. that refer to this Privacy Policy.

Individual websites perform different functions. They may be used, among other things, to present information about Thailand, prepare travel plans, handle enquiries, book travel services, use the AI guide and process payments.

We process data only to the extent necessary to provide services, serve users, process bookings, secure our systems and fulfil legal obligations.

🏢 Controller of personal data

The Controller of personal data is:

Thaipol.com Co., Ltd.
134/97 Nunpayom Road
Maptapud District, Rayong 21150
Thailand

Tax ID: 0215566007421
Tourism licence: TAT No. 11/12061
Official tourism licence register: check the licence in the register

E-mail: info@thaipol.com
Telephone / WhatsApp: +66 814 131 931

The websites managed by the Controller include, among others:

• https://www.thaipol.com
• https://www.tajskiewakacje.pl
• https://www.thaitripguide.com
• https://www.tajlandiapopolsku.pl

For matters concerning personal data, you may contact us using the e-mail address indicated above.

📌 What data may we collect?

The scope of data depends on the website, method of contact and type of service used by the user.

We may process, among other things:

• first name and surname,
• e-mail address,
• telephone number,
• data provided in contact forms,
• information provided when creating an enquiry or booking,
• information concerning the planned journey,
• dates of stay,
• number of participants,
• travel preferences,
• preferences concerning hotels, tours, transfers and other services,
• data needed to prepare and process a booking,
• billing data,
• payment information,
• contact and correspondence history,
• data provided during a conversation with the Travel Assistant or other AI functions,
• a travel profile voluntarily created in ThaiTripGuide,
• device location information, if the user consents to this,
• IP address,
• information about the browser, operating system and device,
• data concerning the way our websites are used,
• information stored in cookies and similar technologies.

For services requiring additional information, we may request data necessary to process a specific booking.

We do not require data that is not needed to perform a particular service.

🎯 What purposes do we use data for?

Data may be processed for the purpose of:

• responding to an enquiry,
• preparing a travel offer,
• creating a travel plan,
• preparing calculations and quotations,
• creating and handling a booking,
• organising tours and stays,
• booking accommodation,
• organising transfers provided by external service providers,
• organising cruises, ferry crossings and other travel services,
• contacting the Client,
• processing payments,
• issuing accounting and tax documents,
• handling complaints,
• maintaining a record of arrangements,
• operating AI functions,
• personalising travel recommendations,
• searching for places located near the user,
• improving the quality of our services,
• analysing the operation of the websites,
• preventing fraud and abuse,
• ensuring system security,
• producing statistics,
• marketing, if the user has given the required consent,
• fulfilling legal and tax obligations.

⚖️ Legal bases for data processing

Actions before entering into a contract

Data may be processed when the user:

• sends an enquiry,
• asks for an offer to be prepared,
• creates a Preliminary Reservation,
• uses a form,
• uses the Travel Assistant.

Performance of a contract

Data may be processed when it is necessary to perform a confirmed travel service, payment or other service ordered by the Client.

Legal obligations

Data may be processed when required by regulations concerning, among other things:

• accounting,
• taxes,
• settlements,
• documentation required by the competent authorities.

Legitimate interest of the Controller

This may include, among other things:

• website security,
• preventing abuse,
• maintaining a record of arrangements,
• improving service quality,
• handling complaints,
• securing potential claims.

User consent

Consent may constitute a basis for processing, among other things, in the case of:

• specific marketing activities,
• selected cookies,
• access to device location,
• functions requiring additional permissions.

For users covered by the GDPR, the Thai PDPA or other applicable data protection regulations, we apply the legal bases required by the relevant regulations.

🤖 AI, Travel Assistant and ThaiTripGuide

Our websites may use artificial intelligence systems to support users.

AI may assist, among other things, with:

• preparing a travel plan,
• answering questions,
• searching for attractions,
• recommending places,
• organising travel information,
• preparing a preliminary offer,
• serving the user.

ThaiTripGuide may use information such as:

• current location,
• time of day,
• travel preferences,
• the selected function,
• the user’s question,
• data concerning places and attractions.

A travel profile may be created without providing data that allows the user to be directly identified.

Data provided to AI systems is used only to the extent necessary to perform a specific function.

Some functions may use the services of external AI technology providers. In such a case, the scope of data necessary to perform the specific task is transferred.

The user should not provide AI systems with particularly sensitive information if it is not needed to provide the service.

📍 Location

Some ThaiTripGuide functions may use the device’s location.

Location may be used to:

• search for nearby places,
• present restaurants and attractions,
• search for pharmacies, ATMs, currency exchange offices or shops,
• prepare transport directions,
• adapt recommendations to the user’s current location.

Access to location requires the appropriate permission granted by the user in the browser or operating system.

The user may change or withdraw such permission at any time.

💳 Payments

Payments for our services may be processed by external payment operators.

These may include:

• Stripe,
• banks,
• payment card operators,
• other licensed payment service providers.

Payment card data may be transferred directly to the payment operator through its secure systems.

Thaipol.com Co., Ltd. may not have access to the full payment card data.

Payment operators process data in accordance with their own privacy policies, terms and security requirements.

We may store transaction data to the extent necessary for:

• confirming payment,
• processing the booking,
• accounting,
• settlements,
• handling complaints,
• preventing fraud.

🌍 To whom may we disclose data?

Data may be disclosed only when necessary to provide a specific service, process payments, ensure the operation of our systems or fulfil a legal obligation.

Data recipients may include:

• employees of Thaipol.com Co., Ltd.,
• authorised collaborators,
• guides,
• hotels and other accommodation facilities,
• transfer operators,
• local carriers,
• ferry and boat operators,
• tour operators,
• local tourism partners,
• payment operators,
• banks,
• IT service providers,
• hosting providers,
• e-mail providers,
• AI system providers,
• map and location service providers,
• accounting entities,
• lawyers and advisers,
• public administration authorities, where required by law.

Data is transferred only to the extent necessary to achieve a specific purpose.

We do not sell users’ personal data to third parties.

🔄 How may we transfer data?

Depending on the type of service, data may be transferred using:

• booking systems,
• secure online panels,
• payment systems,
• e-mail,
• APIs,
• messaging applications used for ongoing booking support,
• other communication channels necessary to provide a specific service.

We limit the scope of transferred data to the information needed by the particular service provider.

For example, a hotel may receive the data needed to create a booking, whereas a driver providing a transfer may receive only the Client’s name, date, pick-up location, flight number or contact details needed to provide the journey.

If a given system enables the use of encrypted or secure transmission channels, we use such solutions in accordance with their functionality and the nature of the data transferred.

🔄 Data flows between our websites

ThaiPol.com, TajskieWakacje.pl, ThaiTripGuide.com and TajlandiaPoPolsku.pl are managed by the same Controller.

Data may be used between our own systems if necessary for:

• serving the Client,
• processing a booking,
• preparing a travel plan,
• activating a purchased service,
• processing payments,
• providing access to ThaiTripGuide functions,
• maintaining a record of arrangements,
• system security.

The flow of information between our own websites does not mean that data is transferred to another independent enterprise.

The Controller remains Thaipol.com Co., Ltd.

✈️ Travel partners and how services are provided

Thaipol.com Co., Ltd. operates as a licensed travel agency and tour operator under TAT licence No. 11/12061.

We organise travel services for Clients, which may include, among other things:

• accommodation,
• tours,
• transfers,
• journeys,
• cruises,
• ferry crossings,
• guide services,
• other travel-related services.

Individual elements of a journey may be provided by independent external service providers.

These may include:

• hotels,
• local transfer companies,
• taxis,
• carriers,
• ferry operators,
• boat operators,
• guides,
• local tour organisers,
• other travel service providers.

Thaipol.com Co., Ltd. organises and sells such services as a travel agency or tour operator, but this does not mean that it provides each of these services itself.

In particular, organising a transfer, journey, cruise or ferry crossing as part of a travel service does not mean that Thaipol.com Co., Ltd. acts as a carrier or transport operator.

Transport is provided by independent suppliers providing the relevant service as part of their own business activities.

Similarly, booking accommodation for a Client does not mean that Thaipol.com Co., Ltd. is a hotel operator.

Individual service providers are responsible for holding the licences, permits and authorisations required for the activities they actually perform.

Our role consists of organising the entire travel service, communicating with the Client, preparing the booking and settling the relevant elements of the journey.

In connection with the provision of such services, we may transfer to an external provider the data necessary to perform the specific service.

We transfer only the information required to process the relevant booking.

🌏 Transfers of data between countries

Thaipol.com Co., Ltd. conducts business in Thailand.

For this reason, users’ data from other countries may be processed in Thailand or transferred to Thailand.

Data may also be processed by external technology providers with infrastructure in other countries.

This may concern, among other things:

• hosting,
• payments,
• AI systems,
• e-mail,
• analytics,
• mapping services.

We use providers that apply their own security measures and data protection rules.

Where the regulations applicable to the user require additional safeguards concerning international data transfers, we apply the required solutions to the extent applicable to our activities.

Private journeys: operational data and journey documentation

When handling private journeys, we process the Client’s data, the route and date, contact details, service parameters, the quotation, payment status, order identifiers and event history. The history may contain the exact time in UTC and Thailand time, the version of the accepted documents, the IP address, browser information and technical request identifiers. This data is used to enter into and perform the contract, process payments, ensure security and demonstrate the course of the order.

The driver may add to a specific journey a photograph of the assigned vehicle and photographs taken at pick-up and at the end of the journey. The materials are used to identify the vehicle, serve the Client, document performance of the service and clarify complaints or disputes. Access is granted only to the Client for that journey to the extent necessary for its performance, the assigned driver and authorised staff.

Maps, address suggestions, translations and providers

Suggestions and verification of locations may use Google Maps or Google Places services. The content of queries, routes and notes may be translated using language service or AI providers solely to the extent necessary to serve the Client, driver and Operator. Please do not enter special-category data or information that is not needed to provide the journey in the notes.

Data may be transferred to the assigned driver or dispatcher, payment operators and banks, providers of hosting, e-mail, mapping, translation and technical tools, to the extent necessary for them to perform their tasks and with appropriate safeguards.

Retention periods for journeys

• unconfirmed enquiries and expired quotations: generally up to 12 months from the last activity;
• booking, acceptance and performance data and documentary photographs: generally up to 24 months after performance or cancellation, and longer where necessary to consider a complaint or dispute or defend claims;
• accounting, tax and payment data: for the period required by law;
• technical and security logs: generally up to 12 months, unless a specific record is needed as evidence of an event or to investigate abuse.

The basis for processing is performance of a contract or taking steps before entering into a contract, a legal obligation and a legitimate interest consisting in ensuring security, accountability and the defence of claims. Acceptance of the terms and conditions is not marketing consent.

⏳ How long do we retain data?

We retain data for the period needed to achieve the purpose for which it was collected.

Data concerning enquiries may be retained for the time needed to:

• prepare a response,
• serve the Client,
• maintain a record of arrangements,
• return to the prepared offer, if necessary.

Data concerning confirmed bookings may be retained:

• for the duration of the service,
• for the period required by tax and accounting regulations,
• for the period needed to handle complaints,
• for the period necessary to secure potential claims.

Data processed on the basis of consent may be retained until that consent is withdrawn, unless another legal basis exists for further processing.

Technical data may be retained for a period justified by security, analysis of system operation and the functioning of the relevant tools.

🍪 Cookies and similar technologies

Our websites may use cookies and similar technologies.

They may be used for:

• the proper operation of the website,
• maintaining sessions,
• remembering settings,
• handling forms,
• analysing traffic,
• improving security,
• measuring website effectiveness,
• marketing activities, if the user has given the appropriate consent.

The user may manage cookie settings in their browser and using the available consent management tools.

Limiting certain cookies may affect the operation of selected website functions.

📊 Analytics and advertising

We may use external analytics and advertising tools.

Depending on the solution used, they may process information such as:

• IP address,
• device type,
• browser information,
• pages visited,
• visit time,
• source from which the website was accessed,
• the way selected website functions are used.

Tools requiring user consent are activated in accordance with applicable regulations and consent settings.

We do not sell users’ data to advertising entities.

🔗 Links to external websites and services

Our websites may contain links leading to:

• hotels,
• travel partners,
• payment operators,
• maps,
• social media services,
• carriers,
• other independent websites and services.

External entities operate independently and may apply their own privacy policies and terms and conditions.

Thaipol.com Co., Ltd. is not responsible for the way independent external services process data.

We recommend reviewing the privacy rules applicable to the relevant provider.

🛡️ Data security

We apply technical and organisational measures designed to protect data against:

• unauthorised access,
• loss,
• accidental alteration,
• destruction,
• unauthorised disclosure,
• use contrary to its intended purpose.

Depending on the system, these measures may include, among other things:

• encrypted HTTPS connections,
• access control,
• authentication of administrative users,
• restricting access to data,
• backups,
• security monitoring,
• software updates,
• server infrastructure security,
• using external providers with their own security mechanisms.

Access to data is granted only to persons or entities that need it to perform a specific task.

No information system can guarantee the complete elimination of risk; therefore, the security measures applied are adapted to the nature of the data and the way it is processed.

✅ User rights

Depending on the applicable regulations, the user may have the right to:

• access their data,
• receive a copy of their data,
• correct their data,
• delete their data,
• restrict processing,
• data portability,
• object,
• withdraw consent,
• obtain information about how data is processed,
• lodge a complaint with the competent data protection authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise your rights, you may contact us at:

E-mail: info@thaipol.com

📣 Marketing and communications

Data may be used for marketing purposes only where permitted by applicable regulations or where the user has given the required consent.

The user may opt out of marketing communications at any time:

• using the available opt-out mechanism,
• replying to a received message,
• contacting us directly.

We do not sell user databases to advertising entities or other third parties.

🧾 Updates to the Privacy Policy

The Privacy Policy may be updated in the event of:

• changes in legislation,
• the development of our websites,
• the launch of new functions,
• changes in technology providers,
• changes in the way services are provided,
• the implementation of new AI tools,
• changes in payment systems,
• changes in the way data is processed.

The current version of the Privacy Policy is published on our websites.

📬 Contact

For questions concerning the Privacy Policy or data processing, you may contact us:

Thaipol.com Co., Ltd.
134/97 Nunpayom Road
Maptapud District, Rayong 21150
Thailand

Tax ID: 0215566007421
Tourism licence: TAT No. 11/12061
Official tourism licence register in Thailand

E-mail: info@thaipol.com
Telephone / WhatsApp: +66 814 131 931