Privacy Policy
What personal data we collect, why, who we share it with, how long we keep it and your rights under the PDPA and the GDPR.
This policy explains what personal data we collect on phkt.rent ("the Platform"), why, who we share it with, how long we keep it and what your rights are. It follows Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and, for visitors in the European Union, the General Data Protection Regulation ("GDPR").
1. Who is responsible for your data
Prestige Phuket Properties Co., Ltd. (Tax ID 0835568016928), Boat Avenue, 49/75 Bandon-Cherngtalay Rd, Bang Tao Beach, Choeng Thale, Thalang, Phuket 83110, Thailand, is the data controller.
Privacy questions and requests: via our Contact page, or by post to the address above. We have not appointed a Data Protection Officer or an EU representative.
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account and contact details | name, email, phone, WhatsApp or Telegram contact, language, role | you |
| Identity details | passport or ID details and copy, nationality, date of birth | you, for a rental agreement and the Immigration report |
| Booking and payment details | homes, dates, guests, invoices, payments, deposits | you, owners, our staff, our payment provider |
| Messages | messages on the Platform, by email and WhatsApp, call notes | you and the people you talk to |
| Owner details | property details, photos, prices, calendar, bank details for payouts | owners and management companies |
| Ownership documents | title deed, lease, management agreement, power of attorney, hotel licence or non-hotel registration | owners |
| Agent details | company name, where the agent works, proof of agent work if we ask, payout details | agents |
| Use of the Platform | favourites, notes, searches, selections, pages viewed | your device |
| Technical data | IP address, device and browser type, approximate location, cookie IDs | your device, see the Cookie Policy |
If you visit without an account, your favourites and notes are kept under a random browser identifier. When you sign up, they move to your account.
If you give us data about other people (for example, your fellow guests), please make sure they know about this policy.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account | contract |
| Arranging bookings, agreements, payments, deposits and payouts | contract |
| Verifying owners and their right to let a property | contract; legitimate interest in preventing fraud |
| Reporting foreign guests to Immigration (TM30), keeping accounting and tax records | legal obligation |
| Answering enquiries and supporting you, including AI-prepared reply drafts reviewed by our staff | contract; legitimate interest |
| Translating listings and checking their quality with AI | contract; legitimate interest |
| Keeping the Platform secure, preventing spam and abuse | legitimate interest |
| Measuring and improving the Platform (analytics) | legitimate interest |
| Sending you our journal and offers | legitimate interest; you can opt out at any time |
| Advertising our homes on social networks | legitimate interest |
| Handling claims and disputes | legal obligation; legitimate interest |
Where we rely on legitimate interest, we have balanced it against your rights. You may object at any time (see section 9).
4. Who we share it with
- Owners receive the renter's name, booking dates, number of guests and the details needed for check-in. Owners must keep this data confidential and may not use it for anything else — see the Listing Rules.
- Agents see the data of their own clients and of the bookings those clients make.
- Immigration Bureau receives foreign guests' details in the TM30 report.
- Service providers process data for us under contract (section 5).
- Authorities, courts and advisers where the law requires it or to protect our rights.
- If our business is sold or reorganised, data may pass to the new owner under the same protections.
We never sell your personal data.
5. Service providers
These kinds of service providers process personal data for us under contract and only on our instructions:
- hosting and database
- content delivery and security
- e-mail delivery
- payment processing
- web analytics
- advertising measurement
- messaging
- AI models
- backups
- maps
Some of them process data outside Thailand (section 6).
6. Transfers outside Thailand
Some providers process data outside Thailand, including in Singapore, the EU, the UK and the US. We use providers that commit by contract to protect personal data to standards comparable to the PDPA and, for EU data, the GDPR (for example, standard contractual clauses).
7. How long we keep it
| Data | Kept for |
|---|---|
| Rental agreements, invoices, payments and booking messages | 7 years after the rental ends (accounting and tax rules) |
| Passport copies | 1 year after check-out |
| Ownership documents and licences | while the property is listed, plus 12 months after removal |
| Account data | while your account is active; deleted within 30 days of your request, except the records above |
| Analytics data | 14 months |
All data is stored online, with encrypted backups. When the period ends, we delete or anonymise the data.
8. Security
We use access controls, so staff see only what their work needs; encrypted connections; backups; and providers with recognised security standards. Ownership documents and passport copies are private and visible only to staff who need them. If a breach puts your rights at risk, we will tell the authority and, where required, you.
9. Your rights
Under the PDPA and, where it applies, the GDPR, you can ask us to:
- give you access to your data and a copy of it;
- send your data to you or another company in a common format;
- correct wrong or incomplete data;
- delete your data, or restrict how we use it;
- stop using your data for a purpose based on legitimate interest, including marketing;
- withdraw any consent you gave.
Send your request via our Contact page, or by post to the address in section 1. We reply within 30 days. We may ask you to confirm your identity. Some data must be kept by law even if you ask us to delete it.
If you are not happy with our answer, you can complain to the Office of the Personal Data Protection Committee in Thailand, or, if you are in the EU, to your local data protection authority.
10. Messages from us
- Service messages — about your account, bookings, payments, listing and messages from your agent or our staff — are part of the service and are always sent.
- Our journal and offers are switched on by default when you sign up. You can switch them off in the "Notifications" block under the sign-up form, at any time on your Notifications page, or with the unsubscribe link in every email.
- We may send messages by email, WhatsApp, our Telegram bot or app notifications.
- If an agent works with you, we do not send you marketing — your agent is your contact.
11. AI processing
We use AI models provided by our service providers to translate listings, check their quality and prepare reply drafts. Our staff review reply drafts before they are sent. We do not use AI to make decisions that have legal or similarly significant effects on you.
12. Children
The Platform is for people aged 20 and over. We do not knowingly collect data from children, except the names and ages of children travelling with a guest, which the guest gives us for the booking.
13. Cookies
See the Cookie Policy.
14. Changes
We may update this policy. The date at the top shows the latest version. If a change is important, we will tell registered users before it applies.
15. Contact
Prestige Phuket Properties Co., Ltd., Boat Avenue, 49/75 Bandon-Cherngtalay Rd, Bang Tao Beach, Choeng Thale, Thalang, Phuket 83110, Thailand
Contact us via our Contact page.