PRIVACY POLICY

Mango Hill Residence, Rawai, Phuket, Thailand

Operated by VCT Properties Co., Ltd.

[TO CONFIRM — DRAFT, not legally validated — for internal review only until cleared by qualified Thai counsel]

This Privacy Policy supplements our Terms and Conditions of Rental (clause 10) and explains in detail how we collect, use, store, and protect your personal data.

1. Who We Are

1.1 This Privacy Policy is issued by VCT Properties Co., Ltd. (“the Operator”, “we”, “us”, “our”), a company registered under the laws of Thailand [TO CONFIRM — registration number / registered office address to be inserted, consistent with clause 1.2 of the Terms], operating the short-term villa rental business known as Mango Hill Residence, located in Rawai, Phuket, Thailand.

1.2 This Policy applies to personal data we collect from: (a) visitors to our website rawai-villa.com, (b) guests who make a booking (directly or via Airbnb/Booking.com), and (c) guests and their accompanying occupants during their stay at the Property.

1.3 This Policy does not apply to VCT Properties’ employees, whose personal data is covered by a separate internal notice [TO CONFIRM — to be drafted, not yet in existence].

2. Data We Collect

3. Purposes and Legal Bases for Processing (PDPA)

Under the PDPA, we rely on the following legal bases, depending on the purpose:

3.1 Performance of a contract (booking and stay data, payment data, communications) — necessary to process your booking, arrange your stay, and provide the services you requested.

3.2 Compliance with a legal obligation (passport/identity data for TM30 immigration registration under the Thai Immigration Act) — this processing is mandatory, not optional; we cannot confirm your check-in without it (see also clause 9 of the Terms).

3.3 Legitimate interests (fraud prevention, dispute resolution, property security via smart lock logs, utility billing reconciliation) — balanced against your rights; you may object to processing based on this basis where applicable (clause 8).

3.4 Consent (marketing communications, if any, and any optional data you choose to share, e.g. dietary preferences for concierge requests) — you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. [TO CONFIRM — does VCT Properties currently send any marketing communications to past guests? If yes, an opt-in/opt-out mechanism must be confirmed.]

3.5 We do not use your personal data for any purpose incompatible with those listed above without informing you and, where required, obtaining fresh consent.

4. Immigration Registration (TM30) — Special Category Handling

4.1 Thai law requires every foreign guest to be registered with Thai Immigration within 24 hours of arrival. To comply, our on-site manager records your passport details (name, passport number, nationality, and a photocopy/scan of the passport) upon arrival.

4.2 This data is used solely for immigration compliance and, where necessary, for identity verification in case of an on-site incident (e.g., damage, dispute). It is not used for marketing and is not shared with any party other than Thai Immigration authorities as legally required, and — where strictly necessary — our insurer in the event of a claim [TO CONFIRM — does VCT Properties currently hold a policy under which this would apply? See Terms clause 11.4, same open point].

4.3 Retention: as confirmed by the Operator (2026-07-03), no retention period has been fixed at this stage for passport copies collected for TM30 purposes; a defined retention and deletion policy is pending advice from a qualified Thai lawyer, expected before public launch. [TO CONFIRM — until that policy is set, this is a compliance gap: passport copies should not be retained for longer than necessary to demonstrate compliance in case of an Immigration audit, then securely deleted].

5. How We Share Your Data

5.1 We share personal data with the following categories of recipients, only as necessary for the purposes in clause 3:

• Payment processors (Stripe) — for processing direct payments.
• Booking platforms (Airbnb, Booking.com) — where your booking is made through them, they already hold your data as an independent controller; we receive from them only what is necessary to prepare your stay.
• Thai government authorities (Immigration Bureau, and other authorities where legally compelled, e.g. tax or law enforcement requests).
• Our on-site staff and management (on-site manager, cleaning/maintenance staff where relevant, e.g. to address a reported issue) — on a need-to-know basis.
• Insurers (in the event of a claim) [TO CONFIRM — see 4.2].
• The smart-lock platform (TTLock) — to the extent it operates as a cloud service, it may act as a data processor for access-code generation and (if applicable) access logs [TO CONFIRM].
• Umami Cloud (website analytics provider) — receives only anonymous, aggregated browsing/interaction data as described in clause 2. No cookie is set and no individual visitor identifier is retained (see clause 2 for the technical mechanism). [TO CONFIRM — Umami Cloud’s hosting location, for clause 5.3 below].

No data processing agreement (DPA) is currently signed with Airbnb, Booking.com, Stripe, TTLock, or Umami Cloud (confirmed by the Operator, 2026-07-03 for the first three; Umami Cloud added 2026-07-10 following the CP-580/CP-581 legal gate review). This is a known compliance gap, tracked separately as action P3 of the legal tracker, and does not change the data-sharing description above.

5.2 We do not sell personal data to third parties.

5.3 International transfers: Some of the recipients above (notably Stripe, Airbnb/Booking.com, and possibly Umami Cloud) may process or store your data outside Thailand. Stripe and Airbnb/Booking.com are confirmed (2026-07-03) as the complete list of such recipients for booking/payment data — no other providers are currently involved for that data category. Umami Cloud’s exact hosting location is [TO CONFIRM — 2026-07-10, see legal note CP581_gate-umami-cookieless_AVIS.md]; note that because Umami’s analytics data is anonymized (no cookie, hashed IP with daily-rotating salt, no individual identifier), this data category is not treated as personal data transfer in the same sense as booking/payment data, but the hosting location should still be confirmed and documented here for completeness. Where this occurs, we rely on the exception under PDPA Section 28 for data transfers necessary for the performance of a contract to which you are a party, or on the recipient’s own adequate safeguards [TO CONFIRM — specific mechanism per recipient to be confirmed by Thai counsel; this is a general PDPA-compliant statement, not a verified case-by-case legal analysis].

6. Data Retention

6.1 We keep personal data only for as long as necessary for the purposes described in clause 3, taking into account:

• Booking and payment records: [TO CONFIRM — typically retained for the duration required by Thai accounting/tax record-keeping rules, commonly several years; exact period to be confirmed with the accountant/Thai counsel].
• TM30/passport data: see clause 4.3 (shorter, compliance-driven retention).
• Smart lock access data: [TO CONFIRM — retention period].
• Marketing consent records (if applicable): until consent is withdrawn, plus a reasonable period to evidence compliance.

6.2 When personal data is no longer needed, we securely delete or anonymize it, subject to any longer retention required by law (e.g., tax records).

7. Data Security

7.1 We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, appropriate to the nature of the data involved (including passport copies and payment-related data).

7.2 Payment card data is processed by Stripe under its own security standards (PCI-DSS); we do not store full card numbers on our own systems.

7.3 [TO CONFIRM — specific measures in place: who has access to passport scans/TM30 records, how they are stored (paper, device, cloud), whether device/folder access is password-protected — to be documented internally as part of action P2 (data-processing audit) before this clause can be made more specific].

8. Your Rights Under the PDPA

8.1 Subject to the conditions and exceptions under the PDPA, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (subject to our legal retention obligations, e.g. TM30 records during their retention period);
• Restrict or object to certain processing based on legitimate interests;
• Withdraw consent at any time, where processing is based on consent;
• Data portability, where technically applicable;
• Lodge a complaint with Thailand’s Personal Data Protection Committee (PDPC) if you believe your rights have been violated.

8.2 To exercise these rights, contact us using the details in clause 11. We will respond within the timeframe required by the PDPA [TO CONFIRM — exact statutory response timeframe to be confirmed by Thai counsel].

8.3 We may need to verify your identity before acting on a request, to protect against fraudulent requests.

9. Children’s Data

9.1 We collect limited data about minors accompanying a booking (name, age) solely for occupancy-limit compliance (Terms clause 7) and, where applicable, TM30 registration if the minor holds their own passport. We do not knowingly collect data from minors for any other purpose, and do not process children’s data for marketing.

10. Changes to This Policy

10.1 We may update this Privacy Policy from time to time, in particular to reflect changes in our data practices or in Thai law. The version applicable to your stay is the version published on our website at the time of your booking. Material changes will be reflected by updating the effective date below.

11. Contact / Data Protection Queries

No named Data Protection Officer or contact point is designated at this stage — this is an explicit placeholder decided by the Operator (2026-07-03); a named contact will be designated before this site exits noindex / before public launch [TO CONFIRM — see method note §3].

Operator: VCT Properties Co., Ltd. — Mango Hill Residence, Rawai, Phuket, Thailand Contact: WhatsApp wa.me/66946862921 · Email: [TO CONFIRM — official contact email address to be inserted, consistent with the Terms draft footer]

11.1 If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Committee (PDPC), Thailand [TO CONFIRM — current PDPC complaint contact details/URL to be inserted by Thai counsel before publication].

Effective date: [TO CONFIRM — publication date]