Privacy Policy

Who we are

Baanpong Lodge, 97 Moo 8, T. Ontai, San Kamphaeng District, Chiang Mai 50130, Thailand. Telephone +66 83 9696 555.

We are responsible for the personal information described here. In Thai law we are the data controller under the Personal Data Protection Act B.E. 2562 (2019), and where European or UK visitors are concerned, the controller under the GDPR.

What this policy covers, and what it does not

This policy is about this website: what it collects, where an enquiry goes and what we then do with it. It is not a full account of everything the lodge does with personal information, because staying here involves records the website never sees.

The main one is check-in. As our terms and conditions set out, we may ask you to confirm your identity with a passport, identity card or driving licence, and where a booking was paid by card we may ask to see that card. Those records are kept for at least twelve months and may have to be shown to the police or produced where Thai law requires it — hotels in Thailand are obliged to register their guests. Bookings, invoices and payments are likewise kept for as long as Thai accounting law requires.

All of that is handled at the lodge, on paper and in our own systems, and none of it passes through this website. If you want to know what we hold about you from a stay rather than from the website, ask and we will tell you — the rights set out below apply to both.

What the website collects on its own

Nothing that identifies you, and nothing at all about your visit unless you agree to it:

• No cookies are set, by us or by anyone else
• Visit statistics, only if you press Accept on the banner — see below. Until you choose, and if you press Decline, nothing about your visit is recorded
• One small note in your browser, unless you accept visit statistics. The mailing-list script remembers when you last closed its sign-up box, whether you have signed up, and that it has already shown itself once this visit, so that it does not keep asking. It holds no name, address or identifier, stays on your device and is never sent to us or anyone else; clearing this site’s data in your browser removes it. A second note is kept only if you send us a chat message — see Chat
• No Google Analytics, no tag manager, no advertising or social media pixels
• No third-party scripts, and no fonts loaded from another company — the typefaces are served from this site. The three exceptions are the visit statistics, the mailing-list sign-up box and, on some pages, the call button: all are small scripts served by the developer who maintains this website, and none of them sets a cookie

Two features run entirely on your own device. The site search reads a set of index files from this website and matches your words in your browser: what you search for is never sent anywhere. The menu page reads a file of dishes and prices from this website; it sends nothing back.

Like every web server, our hosting provider handles the technical information needed to send you a page — your IP address and which file you asked for. We have not turned on access logging, and we neither keep nor analyse visitor logs.

Visit statistics

We count visits to this website with first-party analytics run for us by Vibe Crafted. Nothing is recorded unless you press Accept on the banner. If you do, a random identifier is kept in your browser so that return visits can be counted, together with a second one that marks a single visit and lapses after 30 minutes of inactivity. Neither is a cookie, and neither holds your name or anything else about you.

We record the pages you view, how you reached them (a search engine, a link from another site, a campaign, or directly), how long you stayed and how far down a page you read, your device and browser type, which of our buttons and links you used — the call button, telephone and LINE links, links to other sites, sending the enquiry form — and how quickly the page loaded. We never record your IP address, we do not record which country or town you are in, and nothing is shared with advertisers. Records are kept for 14 months.

The basis, under the Thai PDPA and the GDPR alike, is your consent, and you can change your mind at any time: the button below forgets your choice and both identifiers and brings the banner back. Clearing this site’s data in your browser does the same.

What we collect when you write to us

The enquiry forms on this site ask for:

• your name and email address, which we need in order to reply
• your telephone number and your dates, both optional
• your message
• a tick box asking whether you would also like to join our mailing list, which is left unticked unless you tick it

Each form also contains two hidden fields that must be left empty. They are there to catch automated spam, and they collect nothing about you.

We do not ask for anything else, and we would rather you did not send us more than this. In particular, please do not put passport numbers, identity document numbers, card details or health information in an enquiry form. If you need to give us any of that, we will arrange it another way.

Why we hold it, and on what basis

To answer your enquiry and, if you go on to book, to arrange your stay. Under the GDPR that is our legitimate interest in responding to someone who has contacted us, and the performance of a contract once there is a booking. Under the Thai PDPA it is the necessity of responding to your request and performing that contract.

We do not use what you send in an enquiry for marketing, and we never add you to our mailing list unless you sign up to it yourself. Ticking the box on an enquiry form counts as signing up; sending the enquiry does not. We do not sell, rent or share your information with anyone for their own purposes.

Chat

On the pages that carry a call button there is a Chat button beside it, for typing to the lodge instead of ringing. It reaches the same people, through the same service run for us by Vibe Crafted Software. Opening the chat box sends nothing and keeps nothing. From your first message the conversation is saved — the box says so before you send it — together with the page you sent it from, so that we can read it and follow it up. No IP address and no browser details are kept with a chat.

If nobody is free to answer, the box asks for your email address, and we use it only to reply to that message. So that the conversation can carry on from page to page, and so that a reply written while you were away reaches you on your next visit, your browser keeps one small key for it for 14 days. It is not a cookie, we hold only a scrambled form of it, and clearing this site’s data in your browser removes it.

Our mailing list

You can join our mailing list in three ways: the sign-up box at the bottom of every page; a small sign-up box that may appear in the corner of the screen once you have spent a little while on the site, and which does not come back for a fortnight once you close it; or the tick box on our enquiry forms. However you join, we hold your email address, and — as our record that you asked to join — the date you signed up, the page and the box you used and your IP address at the time.

You are on the list as soon as you sign up; we do not send a confirmation email first. Before adding you we check that the address can receive mail, using Amazon’s email validation service, so that we are not writing to addresses that do not exist. If you did not sign up yourself, or change your mind, the unsubscribe link in our first email takes you off at once.

We use your address to send you news from the lodge — events, new dishes, seasonal offers — and never more than four emails a month. The basis, under the Thai PDPA and the GDPR alike, is your consent. You can withdraw it at any time with the unsubscribe link in every email, and it takes effect at once.

Our newsletters record whether each one was delivered and opened, and which links in it were clicked, using a tiny image and links that pass through a tracking address on their way to our site. We use that only to see whether the emails are worth sending. If you would rather not be counted, turn off images in your email app, or unsubscribe.

If an email to you bounces or is reported as spam, your address comes off the list for good. When you unsubscribe we keep the address only as a note that it must not be mailed again.

Where it goes, and who handles it

When you submit an enquiry, your browser sends it over an encrypted connection to a small service of ours running on Amazon Web Services in Ireland, which turns it into an email and sends it to the lodge.

A copy is also kept in our client portal, run by Vibe Crafted Software, so that an enquiry cannot get lost in an inbox. The copy is only what you typed into the form, and which page of the site you sent it from. It is never added to our mailing list. Ask us and we will delete it.

That means the following companies process your information on our behalf, and only on our instructions:

• Amazon Web Services — hosts this website in Singapore, runs the form-to-email service in Ireland, and sends our newsletters from Singapore
• Google — provides the mailbox the enquiry arrives in, through Google Workspace
• the developer who maintains this website (Vibe Crafted Software, Chiang Mai) — who can see enquiries in the course of keeping the form working, and who keeps the mailing list, the portal copy of each enquiry, any chat you send us and, if you accept them, the visit statistics for us on its own server in Thailand

Because those services sit in Singapore, Ireland and wherever Google holds our mail, your information is transferred outside Thailand. Where that involves people in Europe or the United Kingdom, the transfer relies on the standard contractual clauses those providers offer.

How long we keep it

Visit statistics are kept for 14 months and then deleted.

Your mailing-list address stays for as long as you are subscribed; once you unsubscribe, only the note not to mail it remains.

We keep enquiry emails, and the portal copy of each enquiry, for up to 24 months, so that we can find the thread if you come back to us, and then we delete them. Where an enquiry becomes a booking, the booking records are kept for as long as Thai accounting and hotel registration law requires.

Your rights

You can ask us to:

• tell you what we hold about you, and give you a copy
• correct anything that is wrong
• delete it
• stop using it, or restrict how we use it
• send it to you or to someone else in a portable form
• stop relying on legitimate interests, by objecting
• take back your consent to the mailing list — the unsubscribe link in any of our emails does this on its own
• take back your consent to visit statistics — the Change my cookie choice button does this on its own

Ask through the contact form, by telephone on +66 83 9696 555, or by post at the address above. We will answer within 30 days. There is no charge, and we will not ask for anything beyond what we need to be sure it is you asking.

If you are not satisfied with how we have handled it, you can complain to the Office of the Personal Data Protection Committee in Thailand. Visitors in Europe or the United Kingdom may also complain to their own national data protection authority.

Payments

This website takes no payment. There is no booking engine and no card form here — we quote by email or telephone and take payment separately. No card details ever pass through this site.

Children

Families are welcome at the lodge, but this website is meant for adults making an enquiry. Please do not send us a child’s personal details through a form. If a parent or guardian tells us we hold a child’s information, we will delete it.

Security, honestly stated

Enquiries travel to us over an encrypted connection, and the services above are run by providers with their own security programmes. No website can promise more than that, and we will not pretend otherwise. What we can say is that we hold as little as possible: there is no account to log into here, no password of yours to lose, and there are only three databases: the mailing list, which holds email addresses and nothing more, the portal copy of the enquiries you send us, and the visit statistics, which hold no name, address or IP address.

Changes to this policy

If we change how any of this works, we will change this page and the date at the top of it. Anything significant will be said plainly rather than buried.

See also our terms and conditions.