1. Data Controller Identity & Channels
Siam Aurum Luxury Wellness Bangkok ("Siam Aurum", "we", "us", "our") is the Data Controller under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") responsible for personal data collected across our website (`https://siamaurum.com/`), our official WhatsApp Concierge (`+66 65 825 5161`), and our official LINE account (`https://line.me/ti/p/jCUcsNtuHA`).
- Email (Data Protection Desk): [email protected]
- WhatsApp Concierge: +66 65 825 5161
- LINE Official: https://line.me/ti/p/jCUcsNtuHA
- Operating Jurisdiction: Bangkok, Kingdom of Thailand
2. Information We Collect
2.1 Information You Provide Directly
When you reserve an in-suite massage or contact our Concierge Desk, we collect only what is operationally necessary:
- Identity Data: First name, last name, or preferred guest alias.
- Contact Data: WhatsApp telephone number, LINE display name/ID, or email address.
- Dispatch Location Data: Hotel name, suite/room number, serviced apartment tower, or private residential address in Bangkok or Pan-Thailand.
- Booking Preference Data: Selected treatment modality, duration (`60`, `90`, `120`, or `180` mins), preferred specialist to, and appointment time.
- Health & Contraindication Disclosures (Optional): Any medical conditions, pregnancy status, allergies, or injuries you voluntarily share so your specialist can safely calibrate pressure and botanical oils (processed strictly under PDPA Section 26 Explicit Consent).
- Payment Method Selection: Whether you prefer to settle post-session via Cash (THB), Visa/Mastercard, or Thai QR PromptPay. We never collect or store payment card numbers on our website.
2.2 Information Collected Automatically
When browsing `siamaurum.com`, standard non-identifying technical telemetry may be logged:
- Anonymized IP region, browser user-agent, and viewport dimensions.
- Local browser preferences (`localStorage` keys `sa-theme` for Dark/Light UI and `sa-currency` for currency display).
3. How We Use Your Information
Your personal data is processed exclusively for the following legitimate clinical and hospitality purposes:
- 45-Minute Suite Dispatch: Assigning and routing your chosen independently registered specialist to your hotel reception or residence.
- 5-Star Hotel Security Coordination: Confirming visitor registration and ETA updates (`T+15m` confirmation and arrival notification).
- Clinical Contraindication Safety: Ensuring your practitioner avoids contraindicated pressure zones or allergens.
- Regulatory & Tax Compliance: Issuing itemized corporate wellness receipts upon request and complying with Thai Ministry of Public Health (MoPH) standards.
4. Legal Basis for Processing Under Thailand PDPA B.E. 2562
Every processing activity is anchored to a specific statutory provision of Thailand's Personal Data Protection Act B.E. 2562:
| Processing Activity | Thailand PDPA Statutory Basis | Practical Scope |
|---|---|---|
| Booking & 45-Min Suite Dispatch | Section 24(3) — Contract Performance | Routing your specialist to your hotel suite & confirming ETA |
| Health & Contraindication Notes | Section 26 — Explicit Consent | Calibrating pressure/oils for pregnancy, injuries, or allergies |
| Newsletter & Wellness Briefs | Section 19 — Opt-In Consent | Sending clinical journal updates only when you subscribe |
| Specialist Safety & Fraud Prevention | Section 24(5) — Legitimate Interests | Enforcing our 100% non-sexual ethics charter & hotel safety |
| MoPH & Thai Tax Accounting | Section 24(1) — Legal Obligation | Maintaining statutory accounting & health-establishment records |
5. Strict Limits on Information Sharing
We never sell, rent, or disclose your personal data to third-party advertisers or data brokers. Information is shared strictly on a need-to-know basis:
- Assigned MoPH Specialist: Only your assigned practitioner receives your first name/alias, hotel/room number, and session modality to complete the dispatch. All specialists sign binding non-disclosure agreements (NDAs).
- Encrypted Messaging Providers: Booking coordination takes place over WhatsApp (Meta Platforms) or LINE Official (LY Corporation) according to the channel you initiate.
- Lawful Authorities: Disclosed only if mandated by a valid order of a Thai court or the Personal Data Protection Committee (PDPC).
6. Data Retention & Automatic Purge Schedule
We retain personal data only for as long as necessary to fulfill the purpose for which it was collected:
| Data Category | Standard Retention Window | Early Erasure Option |
|---|---|---|
| Hotel Room & WhatsApp/LINE Chat Logs | 12 Months from last interaction | Immediate purge available upon Guest request |
| Health / Contraindication Disclosures | 12 Months maximum | Immediate purge available upon Guest request |
| Accounting & Invoice Records | 3 Years (Thai Consumer & Revenue Code) | Anonymized after statutory tax audit window |
| Anonymized Web Telemetry | 26 Months (Aggregated, non-PII) | Opt-out anytime via browser settings |
7. Encryption & Technical Data Security
To prevent unauthorized access, disclosure, or alteration of guest records, we maintain enterprise-grade technical controls:
- TLS 1.3 Web Encryption: All traffic across `https://siamaurum.com/` is encrypted in transit via HTTPS/TLS 1.3.
- End-to-End Messaging Encryption: WhatsApp (`+66 65 825 5161`) and LINE (`jCUcsNtuHA`) chats utilize platform-level end-to-end encryption.
- Zero Card Data Storage: Siam Aurum never stores raw credit/debit card numbers; card settlements occur via encrypted bank POS/tap terminals or Thai QR PromptPay upon session completion.
- PDPA Breach Notification SLA: In the unlikely event of a high-risk personal data breach, we notify the Office of the Personal Data Protection Committee (PDPC) within 72 hours and affected data subjects without undue delay under PDPA Section 37(4).
8. Cookies, LocalStorage & Privacy Sandbox Shield
Our platform minimizes tracking cookies and enforces a strict browser `Permissions-Policy` header disabling third-party ad-auction topics (`join-ad-interest-group=(), run-ad-auction=(), browsing-topics=()`):
- Essential UI Preferences (`localStorage`): Stores only `sa-theme` (`dark` or `light`) and `sa-currency` (`THB`, `USD`, `EUR`, `GBP`, `SGD`) locally on your device so your visual and currency settings persist across pages.
- Anonymized Performance Telemetry: Used solely to monitor Core Web Vitals (`LCP`, `INP`, `CLS`) and page load health.
9. Your 8 Statutory Rights Under Thailand PDPA (Sections 30–36)
Under the Personal Data Protection Act B.E. 2562, every Guest holds the following enforceable rights:
- Right to Be Informed: Clear notice of what data is collected and why (fulfilled by this Charter).
- Right of Access (Section 30): Request a copy of the personal data we hold about you.
- Right to Data Portability (Section 31): Receive your booking history in a structured, machine-readable format.
- Right to Object (Section 32): Object to data processing based on legitimate interests or direct marketing.
- Right to Erasure / Deletion (Section 33): Request immediate deletion or anonymization of your hotel room number, contact details, and chat history.
- Right to Restrict Processing (Section 34): Temporarily suspend processing of your data during a verification inquiry.
- Right to Rectification (Section 35): Correct inaccurate or outdated contact details.
- Right to Withdraw Consent (Section 19): Withdraw explicit consent for health disclosures or marketing at any time.
10. Minors & Age 18+ Policy
Siam Aurum's outcall wellness services are strictly reserved for adults aged 18 years and older (unless accompanied in-suite by a parent or legal guardian for family wellness). We do not knowingly collect personal data from minors under 18.
11. Updates to This Privacy Charter
We review this Privacy Policy quarterly to maintain alignment with guidance issued by Thailand's Personal Data Protection Committee (PDPC) and the Ministry of Public Health. Material updates are timestamped at the top of this page.
12. Data Protection Desk Contact & PDPC Recourse
To exercise your Right to Erasure, Access, or Rectification—or to ask any question regarding data confidentiality—contact our Data Protection Desk directly. We acknowledge all inquiries within 2 business days and complete formal PDPA requests within 30 days:
- Email: [email protected]
- WhatsApp Desk: +66 65 825 5161
- LINE Official: https://line.me/ti/p/jCUcsNtuHA
- Supervisory Authority: Office of the Personal Data Protection Committee (PDPC Thailand) — www.pdpc.or.th
