นโยบายความเป็นส่วนตัว

Privacy Policy — English

Last updated: February 2026  |  Version 1.1

1. Who We Are (Data Controller)

Smile Memory Tour Co., Ltd. ("we", "us", "our") is a licensed travel agency based in Thailand that resells group tour packages from licensed wholesalers.

• Company: Smile Memory Tour Co., Ltd. (บริษัท สไมล์ เมมโมรี่ ทัวร์ จำกัด)
• Registration No.: 0105558082878
• Registered Address: 109/91 ซอยพหลโยธิน 48 แขวงอนุสาวรีย์ เขตบางเขน กรุงเทพมหานคร 10220
• Website: smilememorytravel.com
• Data Protection Contact: baifern@smilememorytravel.com

2. What Data We Collect

We collect the following personal data only when you voluntarily provide it:

• Inquiry form: full name, email address, phone number, nationality, number of travelers, tour of interest, travel dates, and any notes you include.
• Newsletter sign-up: email address and preferred language.
• Contact form: name, email, and message content.

We do not collect payment card details on this website — payment is handled separately after booking confirmation.

3. Why We Collect It (Legal Basis)

4. How Long We Keep Your Data

• Inquiry data: 3 years from the date of inquiry (or last interaction), for accounting and dispute resolution.
• Booking records: 7 years (Thai Revenue Department requirement).
• Newsletter subscribers: Until you unsubscribe. We will also purge subscribers inactive for 3 years.
• Contact messages: 12 months after resolution.

5. Who We Share Data With

We share your data only when necessary:

• Tour wholesalers (Zego Travel, GS25 Travel, Go365 Travel, Real Journey) — to confirm booking availability.
• Email service provider (Brevo / Sendinblue) — to deliver transactional and marketing emails.
• Hosting provider (Railway.app) — data stored on their infrastructure.
• Legal authorities — when required by Thai law or court order.

We do not sell your personal data to any third party.

International data transfers: Some of the providers above process data outside Thailand. Brevo (Sendinblue SAS, France) operates under EU GDPR, which provides an adequate level of data protection. Railway.app (US) processes only server infrastructure data. We rely on contractual safeguards (Data Processing Agreements / Standard Contractual Clauses) with these providers as required by PDPA Section 28.

6. Cookies

We use essential cookies for the website to function (e.g., CSRF protection, language preference). With your consent — given via the cookie banner when you first visit — we also use analytics cookies (Google Analytics 4) to understand how visitors use our site. You may withdraw analytics consent at any time by clearing your browser cookies and declining on your next visit. We do not use advertising or profiling cookies.

7. Your Rights

Under Thailand's Personal Data Protection Act (PDPA) and applicable law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Withdraw consent for marketing emails at any time
• Object to processing based on legitimate interest
• Lodge a complaint with Thailand's Personal Data Protection Committee (PDPC) at www.pdpc.or.th or call 02-142-1033

To exercise any right, email us at baifern@smilememorytravel.com. We will respond within 30 days.

8. Data Security

We use HTTPS encryption on all pages. Our database is hosted on Railway's secure infrastructure with restricted access. We apply the principle of least privilege — only authorized staff can view customer data. Despite these measures, no system is 100% secure; we encourage you to contact us immediately if you suspect unauthorized use of your data.

9. Changes to This Policy

We may update this policy when our practices change or when required by law. The "last updated" date at the top will reflect the latest revision. For material changes, we will notify active customers by email.