Privacy Policy

Who we are

Baanpong Lodge, 97 Moo 8, T. Ontai, San Kamphaeng District, Chiang Mai 50130, Thailand. Telephone +66 83 9696 555.

We are responsible for the personal information described here. In Thai law we are the data controller under the Personal Data Protection Act B.E. 2562 (2019), and where European or UK visitors are concerned, the controller under the GDPR.

What this policy covers, and what it does not

This policy is about this website: what it collects, where an enquiry goes and what we then do with it. It is not a full account of everything the lodge does with personal information, because staying here involves records the website never sees.

The main one is check-in. As our terms and conditions set out, we may ask you to confirm your identity with a passport, identity card or driving licence, and where a booking was paid by card we may ask to see that card. Those records are kept for at least twelve months and may have to be shown to the police or produced where Thai law requires it — hotels in Thailand are obliged to register their guests. Bookings, invoices and payments are likewise kept for as long as Thai accounting law requires.

All of that is handled at the lodge, on paper and in our own systems, and none of it passes through this website. If you want to know what we hold about you from a stay rather than from the website, ask and we will tell you — the rights set out below apply to both.

What the website collects on its own

Nothing. This is unusual enough to be worth spelling out:

• No cookies are set, by us or by anyone else
• Nothing is stored in your browser — no local storage, no session storage
• No analytics, no tag manager, no advertising or social media pixels
• No third-party scripts, and no fonts loaded from another company — the typefaces are served from this site
• No consent banner, because there is nothing to consent to

Two features run entirely on your own device. The site search reads a set of index files from this website and matches your words in your browser: what you search for is never sent anywhere. The menu page reads a file of dishes and prices from this website; it sends nothing back.

Like every web server, our hosting provider handles the technical information needed to send you a page — your IP address and which file you asked for. We have not turned on access logging, and we neither keep nor analyse visitor logs.

What we collect when you write to us

The enquiry forms on this site ask for:

• your name and email address, which we need in order to reply
• your telephone number and your dates, both optional
• your message

Each form also contains one hidden field that must be left empty. It is there to catch automated spam, and it collects nothing about you.

We do not ask for anything else, and we would rather you did not send us more than this. In particular, please do not put passport numbers, identity document numbers, card details or health information in an enquiry form. If you need to give us any of that, we will arrange it another way.

Why we hold it, and on what basis

To answer your enquiry and, if you go on to book, to arrange your stay. Under the GDPR that is our legitimate interest in responding to someone who has contacted us, and the performance of a contract once there is a booking. Under the Thai PDPA it is the necessity of responding to your request and performing that contract.

We do not use your details for marketing. We do not send newsletters, and we do not sell, rent or share your information with anyone for their own purposes.

Where it goes, and who handles it

When you submit an enquiry, your browser sends it over an encrypted connection to a small service of ours running on Amazon Web Services in Ireland, which turns it into an email and sends it to the lodge. Nothing is stored in a database on the way; the email is the record.

That means the following companies process your information on our behalf, and only on our instructions:

• Amazon Web Services — hosts this website in Singapore, and runs the form-to-email service in Ireland
• Google — provides the mailbox the enquiry arrives in, through Google Workspace
• the developer who maintains this website — who can see enquiries in the course of keeping the form working

Because those services sit in Singapore, Ireland and wherever Google holds our mail, your information is transferred outside Thailand. Where that involves people in Europe or the United Kingdom, the transfer relies on the standard contractual clauses those providers offer.

How long we keep it

We keep enquiry emails for up to 24 months, so that we can find the thread if you come back to us, and then we delete them. Where an enquiry becomes a booking, the booking records are kept for as long as Thai accounting and hotel registration law requires.

Your rights

You can ask us to:

• tell you what we hold about you, and give you a copy
• correct anything that is wrong
• delete it
• stop using it, or restrict how we use it
• send it to you or to someone else in a portable form
• stop relying on legitimate interests, by objecting

Ask through the contact form, by telephone on +66 83 9696 555, or by post at the address above. We will answer within 30 days. There is no charge, and we will not ask for anything beyond what we need to be sure it is you asking.

If you are not satisfied with how we have handled it, you can complain to the Office of the Personal Data Protection Committee in Thailand. Visitors in Europe or the United Kingdom may also complain to their own national data protection authority.

Payments

This website takes no payment. There is no booking engine and no card form here — we quote by email or telephone and take payment separately. No card details ever pass through this site.

Children

Families are welcome at the lodge, but this website is meant for adults making an enquiry. Please do not send us a child’s personal details through a form. If a parent or guardian tells us we hold a child’s information, we will delete it.

Security, honestly stated

Enquiries travel to us over an encrypted connection, and the services above are run by providers with their own security programmes. No website can promise more than that, and we will not pretend otherwise. What we can say is that we hold as little as possible: there is no account to log into here, no password of yours to lose, and no database of visitors to breach.

Changes to this policy

If we change how any of this works, we will change this page and the date at the top of it. Anything significant will be said plainly rather than buried.

See also our terms and conditions.