TH ThaiHotelMinder
Home / PDPA notice

Thailand PDPA notice

Personal Data Protection Act B.E. 2562 · Regulator: Personal Data Protection Committee (PDPC) of Thailand

This notice describes how ThaiHotelMinder Co., Ltd. ("we", "us") complies with the Personal Data Protection Act B.E. 2562 ("PDPA"), the primary Thai law governing the processing of personal data. It applies to every category of personal data we process in the context of our advisory workspace and modules for hotels operating on the HotelMinder ecosystem in Thailand. This notice complements — and does not replace — our Privacy Policy and our Data-Processing Agreement.

1. Regulatory framework

The PDPA, enacted in 2019 and fully enforceable since 1 June 2022, is the principal legislation governing the collection, use, disclosure and cross-border transfer of personal data of natural persons located in Thailand. It is supplemented by ministerial regulations issued by the Ministry of Digital Economy and Society and by notifications issued by the Personal Data Protection Committee (PDPC). The PDPA applies extraterritorially: any organisation that offers goods or services to individuals in Thailand, or monitors their behaviour in Thailand, is within scope regardless of where the organisation itself is established. ThaiHotelMinder, as a Thai-registered company operating from Bangkok, is squarely within scope.

2. Roles under the PDPA

In respect of our Subscriber (a Thai hotel property using ThaiHotelMinder advisory modules), the roles are as follows:

  • The hotel is the Data Controller in respect of guest personal data. It decides which categories of guest data to collect, the purposes of collection, and the retention periods.
  • ThaiHotelMinder is the Data Processor, processing guest personal data solely on the documented instructions of the hotel, in accordance with our Data-Processing Agreement.
  • In respect of the hotel's own personnel (revenue managers, GMs, distribution leads) who use the ThaiHotelMinder workspace, ThaiHotelMinder is a separate Data Controller — because we determine the means and purposes of processing their account, authentication and support-request data.

3. Categories of guest personal data we process as a Processor

  • Guest identifiers: full name, salutation, date of birth (if provided by the hotel), nationality, passport or Thai national ID number (only where the hotel elects to enable the PDPA Guest Consent module).
  • Guest contact details: email address, mobile phone number, postal address.
  • Reservation data: arrival and departure dates, room type, booking channel, rate plan, cancellation reason.
  • Guest preferences: room preferences, F&B allergies and preferences, marketing preferences.
  • Guest review content: text of guest reviews and hotel responses across Google, TripAdvisor, Agoda, Booking.com, Trip.com, Traveloka.
  • Loyalty programme identifiers (if the hotel operates a loyalty programme integrated with HotelMinder).

4. Lawful bases relied upon by the hotel

The hotel typically relies on the following PDPA lawful bases for guest personal data — but the choice is the hotel's, not ThaiHotelMinder's:

  • Performance of contract for the reservation itself (PDPA s.24(3)).
  • Consent for marketing communications and loyalty enrolment (PDPA s.19).
  • Legal obligation for retention of guest registration under Thai Hotel Act B.E. 2547 (PDPA s.24(6)).
  • Legitimate interest for internal analytics and mystery-guest programmes (PDPA s.24(5)), subject to a balancing test that the hotel is responsible for documenting.

5. Data-subject rights

Every guest, hotelier and workspace user enjoys the following PDPA rights:

  • Right of access (s.30) — obtain a copy of their personal data.
  • Right of rectification (s.35) — correct inaccurate or incomplete personal data.
  • Right of erasure (s.33) — request deletion of personal data no longer necessary for the original purpose.
  • Right to restrict processing (s.34) — suspend processing pending resolution of a dispute.
  • Right to data portability (s.31) — receive personal data in a structured, commonly used, machine-readable format.
  • Right to object (s.32) — object to processing based on legitimate interest or for direct marketing.
  • Right to withdraw consent (s.19) — as easily as consent was given.

Data-subject requests should be addressed to dpo@thaihotelminder.org. We respond within 30 days. Guest requests received by ThaiHotelMinder are automatically routed to the hotel's DPO of record within 5 working days, because the hotel is the Data Controller in respect of guest personal data.

6. Data-Protection Officer

ThaiHotelMinder has appointed a Data-Protection Officer under PDPA s.41. Contact: dpo@thaihotelminder.org. Postal address: Attn. Data-Protection Officer, ThaiHotelMinder Co., Ltd., 88/24 Sukhumvit Soi 21 (Asoke), Klongtoey Nuea, Watthana, Bangkok 10110, Thailand. Our DPO is registered with the Personal Data Protection Committee (PDPC) of Thailand and holds the CIPP/A certification.

7. Data residency and cross-border transfers

All personal data ingested through the ThaiHotelMinder workspace is stored in Thailand-resident infrastructure: primary storage at AIS Cloud's Bangkok data centre, off-site backup at True IDC's Chiang Mai facility. Cross-border transfers, when strictly necessary (e.g. for legal counsel outside Thailand or for a Sub-Processor whose Thailand endpoint is temporarily unavailable), are authorised only under the mechanisms permitted by the PDPA: an adequacy decision, PDPC-approved Standard Contractual Clauses, or your explicit consent. The current list of authorised transfers is maintained in our Security Whitepaper.

8. Breach notification

In line with PDPA s.37(4), we notify the PDPC within 72 hours of becoming aware of a personal data breach that may result in a risk to individuals' rights and freedoms. Where the breach is likely to result in a high risk, we also notify affected individuals without undue delay. Our internal incident-response process, tested quarterly, is described in the Security Whitepaper.

9. Sensitive personal data

Under PDPA s.26, sensitive personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behaviour, criminal records, health data, biometric data, disability) requires explicit consent. ThaiHotelMinder does not solicit sensitive personal data. If the hotel chooses to store dietary restrictions that reveal religious observance (e.g. halal, kosher), the hotel is responsible for obtaining the necessary explicit consent from the guest and for documenting it in the guest profile.

10. Complaint to the regulator

If a data subject is dissatisfied with the handling of a request by ThaiHotelMinder or by the hotel, they may lodge a complaint with the Personal Data Protection Committee (PDPC), Ministry of Digital Economy and Society, 120 Moo 3 The Government Complex Commemorating His Majesty the King's 80th Birthday Anniversary, Chaeng Wattana Road, Thung Song Hong, Lak Si, Bangkok 10210. Website: pdpc.or.th. The PDPC has jurisdiction over administrative penalties, which can reach up to THB 5,000,000 per infringement plus criminal liability in aggravated cases.

11. Data-protection impact assessment (DPIA)

Where a module or feature is likely to result in a high risk to the rights and freedoms of data subjects — as assessed against the PDPC's published criteria — ThaiHotelMinder conducts a Data-Protection Impact Assessment before deployment. The DPIA covers the nature, scope, context and purposes of processing; the necessity and proportionality; the risks to data subjects; and the measures envisaged to address those risks. Copies of the DPIA for any module you have activated are available on request from the DPO.

12. Records of processing activities

In line with PDPA s.39, ThaiHotelMinder maintains records of processing activities covering, for each processing operation: the categories of data subjects and Personal Data; the purposes of processing; the recipients; the retention periods; the security measures; and the cross-border transfer mechanisms. These records are reviewed quarterly by the DPO and made available to the PDPC on request.

13. Marketing consent

PDPA marketing consent is granular and withdrawable. We separately capture consent for (a) product newsletter emails, (b) invitation to Thai hospitality industry events, (c) product-usage tips inside the workspace. Withdrawing consent to one does not affect the others. To manage your consents at any time, visit Settings → Communication preferences inside your workspace, or write to optout@thaihotelminder.org.

14. Employee monitoring — internal use only

Where a hotel Subscriber activates the Guest Experience Mystery-Guest module or the Review Response Thai/EN module, staff members of the hotel may indirectly appear in review content or in mystery-guest observations. The hotel is responsible under PDPA for informing its own staff of this processing, obtaining any required consent under Thai labour and PDPA law, and maintaining an appropriate retention schedule. ThaiHotelMinder acts strictly as Processor in that context.

15. Contact

For all PDPA-related matters, please contact our Data-Protection Officer: dpo@thaihotelminder.org. For general privacy questions, please refer to our Privacy Policy. For the terms of our processor role, please refer to our Data-Processing Agreement.