This Privacy Policy (the “Policy”) explains how Satva Samui Retreat Hotel (yoga retreat hotel on Koh Samui, Kingdom of Thailand; “Satva Samui”, “we”, “us”, the “Controller”) collects, uses, stores, shares, and protects personal data when you use satvasamui.com (the “Website”).
The Policy is designed to align with the EU General Data Protection Regulation (GDPR), the UK GDPR, Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA), and other applicable privacy laws as of 2026. Where your local law grants stronger rights, those rights apply.
Data controller: Satva Samui Retreat Hotel, Koh Samui, Surat Thani Province, Thailand.
Privacy requests (access, correction, deletion, consent withdrawal, complaints):
We respond within a reasonable period, typically within 30 calendar days (EU/UK: up to one month, extendable to two months where permitted, with notice).
This Policy covers:
Third-party platforms linked from the Website (Instagram, Telegram, Google Maps, etc.) have their own privacy policies.
2026-05-29), IP address, User-Agent, Referer (on form submission).We do not knowingly collect data from children without parental consent (see section 15).
| Purpose | Legal basis (GDPR / PDPA) |
|---|---|
| Respond to enquiries, consultations, bookings | Consent; contract / pre-contract steps; legitimate interests |
| Lead management and staff notifications | Legitimate interests; consent |
| Proof of consent to Policy and terms | Legal obligation; consent |
| Spam and abuse prevention (Turnstile) | Legitimate interests; consent where required for cookies |
| Understand Website traffic and improve content (Umami analytics) | Legitimate interests |
| Promotional emails (only if you opt in via the email field) | Separate consent; withdraw anytime |
| Legal compliance and claims | Legal obligation |
We do not sell personal data or share it with third parties for their marketing without your separate consent.
By submitting a form you confirm that you have read this Policy, our Terms & Conditions and Cancellation Policy, and consent to processing as described. Consent is logged in our database (timestamp, IP, policy version, request headers). Withdrawal of consent does not affect lawfulness of processing before withdrawal.
Email is optional. If you provide an email to receive offers and promotions, that constitutes separate marketing consent. You may opt out anytime (unsubscribe link or message us on WhatsApp/Telegram). Opting out of marketing does not prevent us from responding to your enquiry using your main contact details.
We may use:
We do not use advertising pixels or behavioural analytics for ad targeting (Google Analytics with advertising features, Meta Pixel, etc.). Umami does not build marketing profiles or share data with ad networks. If we add other tracking tools, we will update this Policy and obtain consent where required by law.
You may restrict cookies in your browser; chat and forms may not work fully.
Processors are bound by contractual confidentiality and security obligations.
We are based in Thailand. Servers and email/chat providers may be located outside Thailand, the EU, and the UK (including the US and EU). Transfers rely on your consent, adequacy decisions, Standard Contractual Clauses (SCCs), or other lawful mechanisms under GDPR and PDPA.
After retention periods, data is deleted or anonymised unless law requires otherwise.
We use organisational and technical measures: restricted database access, HTTPS, honeypot and Turnstile on forms, hashed admin passwords, backups, and data minimisation. No internet transmission is 100% secure; we use industry-standard safeguards.
Depending on applicable law, you may:
Contact us using section 1. We may ask you to verify your identity before disclosing data.
We act as data controller for processing described here. You may lodge a complaint with your supervisory authority. EU authorities: EDPB; UK: ICO.
We process personal data fairly, transparently, and with appropriate security. You may contact Thailand’s Personal Data Protection Committee (PDPC) if unsatisfied with our response.
Our Website and services are intended for adults. We do not knowingly collect data from anyone under 18. If you believe a child provided data without parental consent, contact us and we will delete it.
We do not use fully automated processing that produces legal or similarly significant effects without human involvement. Turnstile is a technical anti-abuse measure only.
We may update this Policy. The current version is published here with date and version (2026-05-29). Material changes may be highlighted on the Website. Continued use after changes take effect may constitute acceptance where permitted by law.
Last updated: 29 May 2026. Document version: 2026-05-29.
← Back to website