Legal
Privacy Policy
Your trust matters. This policy explains how we collect, use, and protect your personal data in compliance with Thailand's Personal Data Protection Act B.E. 2562 (2019).
Last updated: July 2026
Your Data, Your Rights
Section 01
The Data Controller
Kokosnuss Tours is operated by Phuket Heute Magazine CO. Ltd., a company registered in the Kingdom of Thailand and licensed by the Tourism Authority of Thailand under TAT License No. 32/00551. Our registered office is at 73/120 Moo 3, Soi 7 Kamala Beach, Kathu, Phuket 83120. For the purposes of the Personal Data Protection Act B.E. 2562 (2019) (the "PDPA"), Phuket Heute Magazine CO. Ltd. is the Data Controller responsible for the personal data you provide to us. Our Data Protection Officer (DPO) can be reached at info@kokosnuss-phuket.com or +66 81 538 5285 for any matter concerning this policy or your personal data.
Section 02
Personal Data We Collect
We collect only the personal data necessary to provide and improve our services. This includes: contact details you give us voluntarily (name, email, phone, message) through our contact and enquiry forms; booking details (participant names and numbers, preferred dates, special requests) when you book a tour; affiliate program details (name, email, phone, referral code) when you join our partner program; account details (email and name) when you create an account; and basic usage data such as device type and pages visited, collected automatically to keep the app secure and reliable. Where we collect personal data from third parties (for example, a group organiser booking on behalf of others), we do so only with a lawful basis and limit it to what is necessary.
Section 03
Sensitive Personal Data
Under the PDPA, sensitive personal data includes information such as health, race, religion, and biometric data. We do not knowingly collect sensitive personal data as part of our standard booking and enquiry process. If you provide dietary, medical, or accessibility needs to help us deliver your tour, we will treat that information as sensitive data and handle it only with your explicit consent, and only for the purpose of serving you.
Section 04
Legal Bases for Processing
We process your personal data only where we have a lawful basis under the PDPA, namely: (1) your consent, which you may withdraw at any time; (2) the performance of a contract with you, such as processing and delivering a tour booking you have requested; (3) our legitimate interests as a business, such as improving our tours, preventing fraud, and keeping the app secure, balanced against your rights; and (4) compliance with a legal obligation under Thai law. Where we rely on consent, we will tell you at the point of collection, and you can withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
Section 05
How We Use Your Personal Data
We use your personal data to process bookings and enquiries, communicate with you about your tour, arrange pickups and schedules, process payments and refunds through Stripe, manage affiliate referrals and commissions, respond to your questions, and improve our tours and website. We never sell your personal data to anyone.
Section 06
Device Permissions & Location
When you use our app, we may ask permission to access certain features of your device. Location: with your permission, the app uses your device's location (while you are using the app) to sort tours and experiences by distance from you, so you can easily discover Phuket activities nearby — for example, showing how far each tour's meeting point is from your current location. Location is only accessed when you choose a 'near me' sort and is never collected in the background or tracked over time. You can decline or revoke this permission at any time in your device settings; the 'near me' sort will simply be unavailable, and all other features continue to work. We do not request access to your camera, microphone, contacts, photos, or other protected device resources.
Section 07
Consent & Withdrawal of Consent
Where we rely on your consent to process personal data, that consent is freely given, specific, informed, and unambiguous. You may withdraw your consent at any time by contacting our Data Protection Officer at info@kokosnuss-phuket.com. Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal, nor does it prevent processing based on other lawful bases such as contract performance or legal obligation.
Section 08
Disclosure to Third Parties
We share personal data only with the parties necessary to deliver your booking and operate our business: Stripe, which securely processes your card payments under PCI-DSS-compliant standards; tour operators and partner suppliers who deliver the experience you booked; and our hosting and platform providers who store and protect the data under data-processing agreements. We may also disclose personal data where required to do so by Thai law or a competent authority. Our service providers act as Data Processors on our behalf and may only use your data to provide the service we have instructed.
Section 09
Data Retention
We keep your personal data only for as long as necessary to fulfil the purpose for which it was collected, including to meet legal, accounting, or regulatory requirements under Thai law. Booking and payment records are retained for the period required by tax and commercial law; affiliate and commission records are retained while the relationship is active and for a reasonable period thereafter. When your personal data is no longer needed, we delete it or anonymise it so that it can no longer identify you.
Section 10
Data Security
We protect your personal data with secure, access-controlled storage and encrypted payment processing through Stripe. Access is limited to authorised team members who need it to serve you, and our service providers are bound by confidentiality and security obligations. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Office of the Personal Data Protection Committee (PDPC) and, where appropriate, affected individuals, in accordance with the PDPA.
Section 11
Cookies & Local Storage
Our app uses essential cookies and local storage to keep you logged in, remember your preferences, store your affiliate referral, and keep the app working correctly. We do not use advertising or cross-site tracking cookies. You can clear cookies and local storage in your browser or device settings at any time, though some features of the app may not function correctly without them.
Section 12
International Transfers
Your personal data may be processed in Thailand and on servers located in other countries (for example, where a hosting or payment provider operates). Where personal data is transferred outside Thailand, we do so only with appropriate safeguards in place, such as the use of providers operating under comparable data-protection standards, and in compliance with the PDPA. By using our services, you acknowledge that your data may be subject to such transfers.
Section 13
Your Rights Under the PDPA
As a data subject under the PDPA, you have the right to: be informed about how we collect, use, and disclose your personal data; access and obtain a copy of your personal data; have inaccurate or incomplete personal data rectified (corrected); request the erasure (deletion) of your personal data when it is no longer necessary; restrict or object to the processing of your personal data in certain circumstances; withdraw any consent you have given; and lodge a complaint with the PDPC if you believe we have not handled your data in accordance with the PDPA.
Section 14
How to Exercise Your Rights
To exercise any of your rights under the PDPA, contact our Data Protection Officer at info@kokosnuss-phuket.com or +66 81 538 5285. We will verify your identity to protect your data and respond to your request without undue delay, and in any case within 30 days. Where we are unable to act on a request, we will explain the reasons and inform you of your right to complain to the PDPC.
Section 15
Children's Privacy
Our services are intended for adults. We do not knowingly collect personal data from children under 10, and we do not knowingly collect data from minors under 16 without the consent of a parent or legal guardian where required by the PDPA. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Section 16
Complaints to the Authority
If you believe we have not handled your personal data in accordance with the PDPA and you have been unable to resolve the matter with us, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC), under the Ministry of Digital Economy and Society. The PDPC can be contacted at https://pdpc.or.th. This does not affect any other rights you may have under Thai law.
Section 17
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or the requirements of the PDPA. Any changes will be posted on this page with an updated date. Continued use of the app after changes are posted means you accept the revised policy.
Questions About Your Data?
Our Data Protection Officer is happy to explain anything in this policy or help you exercise your rights under the PDPA. Reach us directly — you'll always speak to a real person.