Privacy Policy

Privacy Policy, AsiaTrip.pl

Publication date: 9 November 2025 This Privacy Policy sets out the rules for processing the personal data of users of the AsiaTrip.pl website (hereinafter the “Website”), operated by AsiaTrip.pl, based in Thailand. This document has been prepared in accordance with the requirements of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council) and Thailand’s PDPA (Personal Data Protection Act of 2019), and also takes into account Poland’s Personal Data Protection Act of 2018 (Journal of Laws 2018, item 1000)[1]. This Policy takes the site’s bilingual nature into account. The Website is available in Polish and English. In the event of discrepancies between language versions, the Polish version shall prevail. Here you will learn what personal data we collect, the purposes for which we use it, the legal basis for doing so, and the rights you have. Please read the provisions below carefully.

Definitions

Controller, the controller of personal data is AsiaTrip.pl, a company based in the Kingdom of Thailand: 38/1-3 39 หมู่ที่ 6 Bang Na-Trat Frontage Rd, Bang Kaeo, Bang Phli District, Samut Prakan 10540, Thailand. AsiaTrip.pl provides services organising trips in Thailand for tourists from Poland. In this document, it is also referred to as “AsiaTrip”, “we” or the “Controller”. The Controller is responsible for processing your personal data lawfully. Website, the website available at AsiaTrip.pl, through which users can view the trip offer, contact the organiser and book travel services. The Website is bilingual (Polish/English); all privacy information applies regardless of the language version. User, any person visiting the Website or using AsiaTrip’s services whose personal data may be processed. In particular, this includes customers (tourists) who intend to take part in or are taking part in organised trips, as well as people contacting us about the offer. Personal data, any information relating to an identified or identifiable natural person (data subject). An identifiable person is someone who can be identified directly or indirectly, for example by reference to a name, identification number, location data, an online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity. Note: We do not collect data about deceased persons (under the PDPA, data about deceased persons are not treated as personal data). In this Privacy Policy, the terms “personal data” and “personal information” are used interchangeably. Processing, an operation or set of operations performed on personal data (by automated or non-automated means), such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data. In other words, any action performed on your data, from obtaining it, through using it for a specific purpose, to deleting it, constitutes processing. GDPR, the General Data Protection Regulation, namely Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC. This Regulation has applied in all European Union countries since 25 May 2018 and sets out uniform rules for personal data protection. In Poland, it is commonly referred to by the abbreviation “RODO”. In this Policy, references to articles (Art.) refer to articles of the GDPR unless stated otherwise. Personal Data Protection Act, Poland’s Personal Data Protection Act of 10 May 2018 (Journal of Laws 2018, item 1000). This Act serves to apply the GDPR in the Polish legal system and sets out, among other things, the supervisory authority (the President of the Personal Data Protection Office) and procedural matters. With regard to the rights and obligations concerning natural persons, this Act supplements the GDPR (for example, in matters involving specific national regulations), but the user’s fundamental rights arise directly from the GDPR. PDPA, the Personal Data Protection Act, B.E. 2562 (2019), Thailand’s personal data protection law of 2019 (in force since 1 June 2022), which regulates the processing of personal data by entities operating in Thailand or directing offers to people in Thailand. The PDPA contains data protection principles similar to those in the GDPR, including requirements for a legal basis for processing, data subjects’ rights, controllers’ and processors’ obligations, security requirements and rules on international data transfers. In this Privacy Policy, references to the “PDPA” mean this Act. Note: As an entity based in Thailand, AsiaTrip.pl is subject to the PDPA. We therefore comply with both the GDPR (because we serve customers from the EU) and the PDPA (because of the company’s location). Partners, third parties to whom we transfer Users’ personal data in connection with providing travel services. Partners are exclusively entities involved in delivering a trip or related services, including: hotels and accommodation providers in Thailand, tour guides, local tour operators and agents cooperating in organising sightseeing, carriers (for example, transport companies providing transfers, and, where applicable, airlines operating domestic flights in Thailand), as well as insurers (if we provide travel insurance as part of the offer). In some cases, Partners also include payment service providers (when a User makes an online payment, for example a payment card operator or payment system) and IT service providers (for example, the company hosting our website server, a booking system provider or email service provider). All Partners receive data only to the extent necessary and are required to use it solely to provide their services to the User. Data recipients, persons or institutions to whom personal data are disclosed (other than the User or our staff). In connection with our services, recipients are primarily the Partners listed above and, where applicable, public authorities legally entitled to obtain the data (for example, customs or immigration authorities, border services or other authorities, if applicable regulations require tourists’ data to be made available to them; for example, hotels in Thailand submit guest data to registration systems as required by local law). Cookies, small text files saved on a User’s device (computer, smartphone, etc.) while using the Website. Cookies usually contain the Website’s domain name, a unique identifier and information about how long they are stored. They are used, among other things, to recognise a User’s device on return visits, maintain a session (for example, after logging in) and for statistical and marketing purposes. Detailed information about the cookies and similar technologies we use can be found in the Cookies and analytics tools section of this Policy. Google Analytics, an online analytics tool provided by Google (Google Ireland Ltd. for users in Europe or Google LLC in the USA), which uses cookies to collect anonymous information about website traffic (for example, visitor numbers, traffic sources and user behaviour on the Website). Data collected by Google Analytics may include, among other things, the User’s device IP address, cookie identifiers, browser information and activity on the website. We use Google Analytics to analyse how the Website is used and improve the quality of our services. To protect privacy, we use IP anonymisation mechanisms (shortening the IP address); in the latest version, GA4, Google Analytics does not store users’ full IP addresses by default. Google Analytics data may be processed outside the EEA (for example, on servers in the USA), but are protected by standard contractual clauses and other mechanisms required by the GDPR. More information is provided below in the International transfers section. Meta Pixel (Facebook Pixel), an analytics and marketing tool provided by Meta Platforms Ireland Ltd. (owner of Facebook, formerly Facebook Inc.), which also uses cookies or similar technologies on our Website. Meta Pixel allows us to track Users’ activity on the website (for example, visiting specific subpages or submitting a form) to analyse the effectiveness of our Facebook/Instagram ads and create so-called audience groups (allowing personalised ads to be targeted to people who have visited our Website). Information collected by Meta Pixel may be combined with data held by Meta (for example, if a User is logged in to Facebook, the Pixel may link the visit to the Website to their profile to better tailor ad content). Data collected by Meta Pixel may be transferred to Meta servers outside the EEA (for example, in the USA), but Meta states that these transfers comply with the law (for example, on the basis of standard contractual clauses). More information about cookies and how to opt out of these tools is provided in the Cookies section. Supervisory authority, in the context of the GDPR, an independent public authority established to oversee the application of data protection laws. In Poland, this function is performed by the President of the Personal Data Protection Office (PUODO), whose office is at ul. Stawki 2, 00-193 Warsaw. In Thailand, data protection is overseen by the Personal Data Protection Committee (PDPC), supported by the Office of the Personal Data Protection Committee (Office of PDPC), operating under the Ministry of Digital Economy and Society. Users have the right to lodge complaints with supervisory authorities; details are provided in the User rights section. Other terms used in the Policy but not expressly defined (for example, “processor”, “recipient”, “consent”, “personal data breach”, etc.) should be understood in accordance with the definitions in the GDPR or, where applicable, the PDPA. English terms (such as cookie, browser, plugin, and the proper names of Google/Meta tools) are used for the User’s convenience and have equivalent meanings in Polish.

Purposes of processing personal data

We process your personal data only for specific, legally permitted purposes and do not use it in a manner incompatible with those purposes. Below, we set out the purposes for which we collect and use Website Users’ data:

Entering into and performing a contract to organise a trip (providing travel services), This is our main purpose for processing data. We need your personal data to prepare a trip offer, enter into a contract with you for the provision of travel services, and actually organise your trip. This includes, in particular, accepting bookings, communicating about the itinerary, adapting the offer to your needs (for example, dates and number of participants), and then making all necessary bookings and arrangements on your behalf (for example, booking hotel accommodation, arranging a local tour guide or transport). For example, under the applicable regulations, a contract for the provision of travel services must contain certain information about you (such as a participant’s first and last name). Providing this information is a legal requirement and a condition of taking part in the trip. In addition, without contact details (for example, a phone number or email address), we would not be able to maintain the communication with you needed to organise the trip (sending confirmations and information about meeting times, changes to the itinerary, etc.). For this purpose, we process the participants’ usual identification and contact details (first name, last name, email address and phone number), as well as data required to book particular travel services. This may include, for example, participants’ dates of birth or passport numbers (some hotels or carriers may require this information to complete bookings or meet formal requirements). We emphasise that we collect only data that are absolutely necessary to organise the package travel, minimising the scope of data in accordance with the principle of data minimisation. Without providing the required data, we will not be able to enter into a contract or duly perform the service, which means that unfortunately we will not be able to organise the trip.
Compliance with legal obligations incumbent on the Controller, We also process data when necessary to fulfil obligations arising under generally applicable law. This applies in particular to accounting and tax obligations. As a business, we are legally required to keep accounting records and retain documentation concerning contracts and financial transactions (for example, invoices and proof of payment) for a specified period. Such documents may contain customers’ personal data (for example, a first and last name on an invoice, a residential address or an email address on an electronic invoice). Tax and accounting regulations may require us to process and retain this data for a period set by law (for example, in Poland, generally five tax years from the end of the year in which the transaction took place, and analogously under Thai tax regulations). There may also be other legal obligations, such as obligations concerning tourists’ health and safety. In exceptional circumstances, we may be required to provide information about tourists to the relevant authorities (for example, where required by local law in an emergency or in connection with border or customs controls). Another example of a legal obligation may be the need to respond to public authorities (for example, at the request of a court or police). Within the limits of the law, we will then process and disclose the required information. In all these cases, we process data only to the extent necessary to fulfil the specific obligation.
Establishing, pursuing or defending claims, Claims may arise on your part or ours in connection with the contract entered into and the delivery of the tour (e.g. disputes over the quality of the service, the need to refund funds, compensation, etc.). In such cases, we have the right to process your personal data to establish the facts and circumstances (based on the data we hold, such as email correspondence and documents relating to the tour), and to pursue any claims we may have or defend ourselves against claims from you. For example, we may keep a copy of our correspondence with you or information about the course of the trip for as long as necessary until the applicable limitation periods have expired, so that we can demonstrate that we performed the contract properly or meet any warranty obligations. This purpose also includes internal archival (evidentiary) purposes, such as retaining certain data in case we need to establish particular facts in the future.
Communications and handling enquiries, If you contact us via the contact form on our website, by email or by phone to ask for information about our offer, a tour quote or other assistance, we use your data to respond. This involves processing data such as your email address, phone number, name (if you provide it) and the content of your enquiry. We use this data only to contact you and provide the information you need, prepare an offer or take steps at your request before entering into a contract (e.g. prepare a preliminary itinerary). Enquiries about offers may contain data about other prospective participants (e.g. if you ask about a tour for a group or family). We assume that you provide us with these individuals’ data with their consent or with authority to act on their behalf (e.g. as the group organiser). We retain correspondence for as long as needed to handle your enquiry and for a period afterwards, in case you decide to take up the offer after all or a dispute arises about what was agreed.
Website operation and security, When you visit our website, we also process certain technical data needed to ensure that the website functions properly and remains IT-secure. This is information that your web browser automatically sends to our server (so-called server logs), such as the IP address of the device you use, the date and time of your visit, the operating system and browser you use, the pages and links you view, and any errors that occur. This data is recorded in system logs and used for administrative purposes, for example to monitor website performance, detect technical problems, prevent unauthorised activity (hacking attacks) and secure our IT systems. This processing takes place continuously and automatically and is necessary to provide the electronic service. Log information is not used to identify you as a specific individual, and we do not combine it with other data we have collected from you in a different context. It is used solely for technical and analytical purposes related to maintaining the website. If we detect attempts to breach security, log data may be used to defend against such activity and cooperate with the relevant authorities (this is also part of the Controller’s legitimate interest; see the legal bases below).
Website traffic analysis and statistics, For internal purposes related to improving our services and adapting the website to users’ needs, we use analytics tools (Google Analytics). These tools allow us to collect general statistics about website use, such as how many users visit our website during a given period, which pages attract the most interest, which countries or regions visitors come from, and how long they spend on the website. This information helps us understand which content is valuable to you and which needs improvement. Analysis is based on anonymised or pseudonymised data; we focus on aggregated results rather than specific individuals’ data. Google Analytics uses cookies, which may be stored on your device after you give your consent (see the later section on cookies for details). This tool may collect your IP address; however, as noted in the definitions, we use IP anonymisation (in GA4, IP addresses are not stored at all, while in the older Universal Analytics, the last octet of an IPv4 address is zeroed out). As a result, we do not store your full address, only approximate information about your region. Analytical results (statistical reports) do not contain data that would allow you to be identified.
Marketing our own services, NOTE: We do not currently conduct aggressive marketing, and your data is not used to market products or services of third parties. We may, however, wish to inform you about our new tour offers or promotions, especially if you are our customer or have asked us to do so. This direct marketing of our own services to our customers (e.g. by email newsletter or a phone call about an attractive new offer) takes place within the limits permitted by law. Email communications generally require your prior consent (e.g. signing up for a newsletter and confirming your subscription). If you give this consent, we will also process your contact details (email address) to send you occasional marketing information. If you are not our customer, we will send you marketing materials only if we have obtained your explicit consent. You may always opt out of receiving such information; you can withdraw your consent or object to marketing at any time (see the User rights section for details). We also use the aforementioned Meta Pixel on our website, which helps us reach people who have visited the website with our ads. For example, with the Pixel we may show you an advert on Facebook promoting a new tour offer if you previously viewed a similar offer on our website. This type of marketing communication on external services (Facebook/Instagram) is also based on our legitimate interest, but always depends on your consent to marketing cookies on our website and the privacy settings of the social media services you use. We emphasise: We do not give your contact or personal data to external companies for their own independent marketing. No data is “sold” or shared with marketing partners outside our service network. If we conduct marketing, it is exclusively for our own services and within the limits permitted by law.

In summary, we process data only for purposes related to organising tours and serving customers, and for the obligations associated with those activities. We do not use data for new, incompatible purposes without informing you and establishing a legal basis. If we ever intend to process your data for a purpose other than those listed above, we will inform you before processing begins (e.g. by updating this Policy or contacting you directly) and, where required, obtain your consent.

Legal bases for processing

Under Article 6 of the GDPR, processing personal data is lawful only if it is based on one of the specified legal bases. Thailand’s PDPA also requires an appropriate legal basis (consent or an exception to the consent requirement) for each instance of processing. Below, we explain the legal bases on which we rely for each processing purpose:

Necessity for the performance of a contract or to take steps before entering into a contract, This basis is Article 6(1)(b) of the GDPR, which states that processing is lawful when it is “necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”. In practice, this means we may process your data to enter into and perform a contract to organise a tour. Without this data, we could not book a hotel or ticket for you or provide the agreed services. This legal basis covers both the offer preparation and pre-contract communications stage (at your request) and the entire period during which the contract is performed. For example, when you complete a booking form or provide us with the tour participants’ details, you do so so that we can take the steps needed to enter into or perform the contract. Processing these data is lawful under Article 6(1)(b) of the GDPR. The PDPA provides for a similar legal basis. Under Section 24, paragraph 1, item (3) of Thailand’s PDPA, processing (collection, use or disclosure) is permitted without the data subject’s consent if it is “necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract”. We therefore lawfully process your data to organise a tour under both the GDPR and the PDPA.
Compliance with a legal obligation, When we must process data because of specific legal provisions, the legal basis is Article 6(1)(c) of the GDPR, meaning that “processing is necessary for compliance with a legal obligation to which the controller is subject”. This basis applies to the situations described above in which the law requires us to take specific actions, such as retaining accounting records containing your data, issuing an invoice in your name or providing data to public authorities as required by law. In such cases, we process data because we are legally obliged to do so, and refusal could result in a breach of the law. We always apply this basis in connection with a specific legal provision that imposes the obligation (e.g. tax or accounting laws, Thai immigration regulations, etc.). The PDPA also provides for an exception to the consent requirement in a similar situation. Under Section 24, paragraph 1, item (6) of the PDPA, processing is permitted when it is “necessary to comply with a law to which the data controller is subject”. Accordingly, under both the GDPR and PDPA, our actions to meet legal requirements (e.g. retaining documents for a specified period) are lawful and do not require separate consent from the data subject.
The Controller’s legitimate interests, In some cases, we rely on Article 6(1)(f) of the GDPR, which permits processing when “it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”, unless those interests are overridden by the interests or fundamental rights and freedoms of the data subject. This legal basis applies, among other things, to:

safeguarding against potential claims (our legitimate interest is to be able to defend ourselves against claims or pursue our rights in the event of a dispute),
ensuring network and information security (our legitimate interest is to protect the website and data against attacks and prevent fraud),
day-to-day customer service and communication beyond the strict scope of performing the contract (e.g. answering general enquiries; our interest is to provide good customer service and build positive relationships),
direct marketing of our own services (our legitimate interest is to inform customers about our offers; however, we respect anyone who does not want marketing and may object, as explained below).

In each of these cases, we have carried out a so-called balancing of interests assessment to make sure our legitimate interest does not infringe users’ rights and freedoms. For example, we retain data after a tour ends for a period corresponding to the limitation period for claims. This is in our interest, but should not unduly interfere with your privacy: the data is no longer used for marketing and is only kept in our archive (and will be deleted once the limitation period expires). Similarly, the GDPR generally recognises that direct marketing to our customers may be based on the controller’s interests (Recital 47 of the GDPR states that it is a legitimate interest). You always have the right to object to processing based on point (f) (e.g. request that marketing activities stop), and we will respect your decision. The PDPA also permits processing without consent in a situation corresponding to the legitimate interest clause: Section 24, paragraph 1, item (5) of the PDPA permits data processing when it is “necessary for the legitimate interests of the data controller or another person”, unless those interests are overridden by the data subject’s fundamental rights. This PDPA provision closely corresponds to Article 6(1)(f) of the GDPR, which means that our activities based on legitimate interests are also lawful under Thai law.

Consent of the data subject, As a rule, we try to base processing on the legal bases described above (contract, legal obligation, legitimate interest), but in certain situations we ask you for your voluntary consent and rely on it for further processing. This is particularly the case with cookies and analytics and marketing tools that are not necessary for the website to function. On your first visit to the website, we display a notice (cookie banner) asking for your consent to the use of analytics and marketing cookies. If you give your consent (Article 6(1)(a) of the GDPR), we may place Google Analytics and Meta Pixel cookies on your device and read the information they contain. This results in data about your activity on the website being collected for statistical and marketing purposes. These cookies will not be active without your consent; we respect your decision. Giving consent is entirely voluntary, and not giving it does not affect your ability to use the website. You can still read the information freely, but we will not have analytics data about your visit and you will not see our personalised adverts. You may withdraw your consent at any time; see the section on rights for more information. It is also worth noting that the PDPA gives consent priority: as a rule, a controller may not collect, use or disclose personal data without the data subject’s consent, unless an exception provided for by law applies. However, the exceptions discussed above (e.g. the need to perform a contract, a legal obligation or legitimate interest) may make consent unnecessary. If no exception applies, we ask for consent and process the data only after receiving it. For example, this may happen if you want us to keep your contact details in our database for future offers (marketing), even though no contract was entered into. In that case, your explicit consent is the basis for processing. Similarly, if we ever need to process special categories of data (e.g. information about your health or religion to adapt the tour programme), we will ask for your explicit consent unless another legal basis applies (e.g. protecting vital interests where life or health is at risk). As a side note: We do not normally collect sensitive data (special categories of data), and do not require you to provide information about your health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, etc. Please do not provide us with such information unless absolutely necessary (e.g. food allergies that require special arrangements during a trip; you can decide whether to tell us). If you provide this type of information on your own initiative, we assume that you do so with your explicit consent, which you may withdraw at any time. Under Article 9 of the GDPR, processing special categories of data requires additional conditions. Such situations practically never arise in our business, but if one did, we would ensure full compliance with the law (e.g. by obtaining written consent or acting in the vital public health interest). Similarly, Section 26 of the PDPA prohibits processing sensitive data (including health, opinions and origin) without consent, subject to exceptions. We therefore inform you that we do not process special categories of data within the meaning of these provisions, and that all personal data relates solely to ordinary identification and contact information needed to organise travel.

Do you have to provide us with your data? Providing personal data is voluntary, but in many cases it is necessary to use our services. If you do not provide the information required to book a tour (e.g. your first name, surname, contact details and, at a later stage, details needed for specific bookings), we will not be able to enter into a contract with you or deliver the service. Similarly, failing to provide data required by law (e.g. to issue an invoice) may prevent us from meeting our obligations. We always try to indicate which data is necessary (e.g. by marking mandatory fields in forms). Data collected optionally (e.g. additional information about your travel preferences) helps us improve the service but is not a condition for providing it. As mentioned, you can refuse consent to cookies and still use the website in basic mode. However, some features may not work fully (e.g. Google Maps, if used, may require consent to third-party cookies; the same may apply to video players). We will inform you of any such dependencies as you use the relevant features.

User rights (data subject rights)

Both the GDPR (for users in the EU) and the PDPA (for all individuals whose data is processed by a controller in Thailand) grant a range of rights related to personal data protection. We respect these rights and provide ways for you to exercise them. Below are the rights you have and how to exercise them:

Right of access, You have the right to obtain confirmation from us as to whether we process your personal data and, if so, to access it and receive information including the purposes of processing, categories of data, recipients, retention period, sources of data (if they were not obtained from you) and your rights. You may also request a copy of your personal data undergoing processing (the first copy is free of charge; we may charge an administrative fee for additional copies). The right of access is set out in Article 15 of the GDPR. The Thai PDPA also guarantees this right: under Section 30, you may request access to and a copy of your personal data for which we are responsible. If we refuse (which may happen only in exceptional circumstances, e.g. if disclosing the data would adversely affect the rights and freedoms of others or another provision prohibits disclosure), we will inform you of the reason and your right to lodge a complaint.
Right to rectification, You have the right to request that we promptly rectify inaccurate personal data concerning you and complete incomplete data, taking the purposes of processing into account. In other words, if you notice that we have misspelled your name, your contact address has changed or you gave us incomplete information, you may ask us to correct it. This right is provided for in Article 16 of the GDPR. Under the PDPA (Section 35), we are required to ensure that data is accurate, up to date, complete and not misleading. If it is out of date or incorrect, we must correct it at your request.
Right to erasure (“right to be forgotten”), In certain circumstances, you have the right to ask us to erase your personal data. These include: (a) the data is no longer necessary for the purposes for which it was collected and there is no other legal basis for retaining it; (b) you have withdrawn the consent on which processing was based and we have no other legal basis; (c) you have objected (where we processed the data on the basis of our legitimate interest or for marketing purposes) and there are no overriding legitimate grounds for continuing the processing; (d) the data was processed unlawfully; or (e) the data must be erased to comply with a legal obligation. The right to request erasure is set out in Article 17 of the GDPR. However, please remember that this right is not absolute. The GDPR provides for exceptions under which we may refuse erasure, e.g. where processing is necessary to exercise the right to freedom of expression and information, comply with a legal obligation, or establish, pursue or defend claims (see Article 17(3) of the GDPR). Similarly, under Section 33, the PDPA gives the data subject the right to request erasure or destruction of data (or its anonymisation so that the individual can no longer be identified), including when the data “is no longer necessary in relation to the purposes for which it was collected” or was processed unlawfully. If we have no legal basis or obligation to continue retaining your data, we will erase it at your request. If we exceptionally refuse (e.g. because of the aforementioned legal obligation to retain invoices for a specified period or the need to keep data to defend against a claim), we will explain the reason.
Right to restriction of processing, In certain circumstances, you have the right to ask us to temporarily restrict the processing of your data to storage only. You may exercise this right when: (a) you contest the accuracy of the data, for the period needed to verify it; (b) processing is unlawful, but you object to erasure and instead request restriction (that is, blocking) of its use; (c) we no longer need the data for our purposes, but you need it to establish, pursue or defend claims; or (d) you have objected, pending verification of whether our legitimate grounds override your objection. When processing is restricted, we may generally only store the data; any other operations require your consent, except in certain specific circumstances such as establishing claims, protecting another person’s rights or an important public interest. This right is provided for in Article 18 of the GDPR. Section 34 of the PDPA also gives you the right to request a restriction on the use of data when its accuracy or completeness is being checked, when its processing is unlawful but you do not want it erased, or while your objection or erasure request is being considered. In practice, you might use this right if you notice that we hold data which you believe should be erased but which, for some reason, we cannot yet erase. You can then ask us to “freeze” its use until the situation is clarified. We flag restricted processing in our systems so it is clear that the data must not be used in the usual way.
Right to data portability, You have the right to receive from us, in a structured, commonly used, machine-readable format, the personal data you have provided to us. You also have the right to ask us to transmit that data directly to another controller, where technically feasible. This right applies only to data we process on the basis of your consent (Article 6(1)(a)) or on the basis of a contract (Article 6(1)(b)), and by automated means. In other words, it may cover, for example, data entered in a tour registration form and processed in our IT systems, which we can export and provide to you or the entity you name in a CSV/Excel file or another agreed format. It does not cover, for example, our handwritten notes or data processed only on paper. The right to portability is set out in Article 20 of the GDPR. The PDPA provides a very similar right under Section 31: you may receive a copy of the data you provided in a structured, commonly used format, and ask us to transmit it directly to another data controller (if technically feasible). Note that the right to portability does not mean we are required to transfer all your data wholesale to any entity you name. It covers only data you provided to us yourself (e.g. through forms or contracts), not data we generated through analysis or processing (e.g. our internal notes or assessments). If you would like to obtain your data for transfer, contact us and we will agree on a convenient way to exercise this right.
Right to object, You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on our legitimate interest (Article 6(1)(f) of the GDPR). This applies especially when we process data for direct marketing. In that case, your objection is unconditional and means that we will stop processing your data for marketing purposes. If your objection concerns another legitimate interest of ours (e.g. retaining archived data), we will honour it unless we can demonstrate compelling legitimate grounds for continuing the processing that override your interests, rights and freedoms, or grounds for establishing, pursuing or defending claims (as provided for in Article 21(1) of the GDPR). We will assess this fairly and transparently. We already try to ensure our activities do not unduly intrude on your privacy, so if you object, we will most often accept it and stop the processing in question. The right to object is set out in Article 21 of the GDPR. The Thai PDPA also provides a right to object: Section 32 states that a data subject may object at any time to the further collection, use or disclosure of their personal data in certain situations, including where we process it under Section 24(4) or (5) of the PDPA (corresponding to public interest and the controller’s legitimate interest). If you object, we must stop that processing without delay unless we can demonstrate overriding lawful grounds, as under the GDPR. For direct marketing, the PDPA also requires objections to be honoured without exception: an objection to marketing must result in the further use of data for that purpose stopping. You can therefore be sure that, for example, unsubscribing from the newsletter or asking us not to call you with offers will be fully respected.
Right to withdraw consent, If any processing of your data is based on consent you have given (Article 6(1)(a) of the GDPR or, for sensitive data, Article 9(2)(a) of the GDPR), you have the right to withdraw that consent at any time. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before you withdrew consent (that is, processing remains lawful up to the time of withdrawal). If you withdraw consent, we will no longer rely on it for further processing. For example, if you agreed to receive our newsletter, you can unsubscribe at any time (by clicking the relevant link in the email footer or contacting us), and we will stop sending it. Similarly, if you consented to marketing cookies, you can change your settings and withdraw your consent (using our cookie consent management tool or your browser settings), after which tools such as Google Analytics or the Pixel will no longer operate going forward. We emphasise that withdrawing consent is as easy as giving it, and we make every effort to provide a simple method (e.g. a dedicated link, account settings or a clear email). This principle follows from both the GDPR (Recital 32 and Article 7(3)) and the PDPA, which expressly requires withdrawal of consent to be as easy as giving it. In addition, Section 19 of the PDPA states that a data subject may withdraw consent at any time and that withdrawal must not have adverse consequences for them (they must not be discriminated against for exercising their right to withdraw consent). If you withdraw consent, we will inform you if another legal basis nevertheless allows us to continue processing your data (e.g. a legal obligation to retain certain data). If not, we will stop processing and, depending on the circumstances, erase the data unless, with your consent, we retain it for another permitted purpose.
Right not to be subject to automated decision-making, You have the right to request that no decision based solely on automated processing (including profiling) be made about you if it would produce legal effects concerning you or similarly significantly affect you. Put simply, this concerns situations where, for example, a computer algorithm assesses your data and independently makes a decision that significantly affects you, without human involvement. In our business, we do not make such decisions in a fully automated way. We do not use systems to assess customers (for example, we do not automatically assess financial capacity or use profiling that results in a service being refused). All decisions, such as accepting a booking, quoting an offer, granting any discounts or tailoring a tour, are made by a person who takes the individual circumstances into account. This right is therefore not at risk of being infringed in practice. Nevertheless, it is provided for in Article 22 of the GDPR, and we respect it. If we ever intend to introduce a fully automated decision-making system, we will inform you and tell you about your right to object to that process. The PDPA also requires particular care with profiling. Although it has no directly equivalent article and the term “profiling” does not appear in its definitions, its fundamental principles and data subject rights would require us to consider any objection you might make if you felt that a decision based on automated analysis harmed you.
Right to information, Although this right is not usually listed alongside the rights above, it is worth emphasising that you have the right to be informed about the processing of your data. This right is implemented, among other things, through this Privacy Policy and the so-called information obligation when data is collected (Article 13 of the GDPR). This means that when collecting data from you, we should provide you with certain information, as we do in this document. If we obtained your data from another source, we should also inform you (Article 14 of the GDPR). We must also inform you if a data breach occurs that could pose a high risk to your rights (Article 34 of the GDPR requires notification of a serious data leak). The PDPA also imposes information duties on us. For example, we would have to notify you of a data breach as required by the GDPR. Section 37(4) of the PDPA requires notification of a breach to the authority within 72 hours and notification to the data subject if the breach may result in a risk. We aim to be fully transparent: this Policy is one way we uphold your right to information.
Right to lodge a complaint with a supervisory authority, If you believe we are processing your data unlawfully or not respecting your rights, you have the right to lodge a complaint with the competent supervisory authority. In Poland, this role is performed by the President of the Personal Data Protection Office (UODO), address: ul. Stawki 2, 00-193 Warsaw, tel. (+48) 22 531 03 00. You may contact the UODO if you are a Polish citizen or consider it the appropriate authority because of your place of residence or the infringement. If you prefer, you may lodge a complaint with the supervisory authority in another EU country where you reside (the GDPR gives you this choice). Since our company is based in Thailand, the Thai PDPC also supervises us. You may therefore report an infringement to the Office of Personal Data Protection Committee (PDPC) in Thailand. In practice, it may be easier for users in Poland to contact the UODO, which can then coordinate with foreign authorities. Regardless of which authority you choose, you will not face adverse consequences for lodging a complaint. You have the full right to ask the authority to check compliance with the law. We encourage you to try to resolve the matter with us first. You can always contact our Controller with a question or concern, and we will try to resolve it amicably. If that does not help, you of course retain the inalienable right to seek help from an authority.

How can you exercise your rights? To exercise your rights, you may contact us in any convenient way. We recommend writing or emailing so that we have a record of your request. The easiest way is to email us (our contact details are in the Contact section below), stating which right you wish to exercise and what data it concerns. For example, you could write, “Please provide a copy of my data and tell me whether it is being processed” (right of access), or “I request the erasure of all data concerning me because I withdraw my consent and no longer use your services” (right to erasure). You do not need to cite a legal basis or provision; a plain, understandable request is sufficient. If we have doubts about your identity (e.g. a request comes from an email address different from the one registered with us and concerns sensitive data), we may ask you for additional verification to protect your data from unauthorised access. We will respond to your request without undue delay, within a maximum of one month of receiving it (the standard period set out in Article 12(3) of the GDPR). If the request is complex or we receive many requests, this period may be extended by 2 or 3 months. We will inform you of the extension and explain the reasons for the delay. Most requests are handled free of charge. However, if your requests are manifestly unfounded or excessive (e.g. you submit them very frequently without a genuine need), we may refuse to act or charge a reasonable fee (under Article 12(5) of the GDPR). We will always explain the situation first and try to find a satisfactory solution. Additional guidance: If you have questions about your rights or need help wording a request, please contact us. We will be happy to help. Remember also that these rights apply to some extent when our Partners (e.g. airlines and hotels) process your travel data. In such cases, you may exercise your rights directly with them as separate controllers (e.g. ask a hotel to erase your data after your stay). We will forward your requests where necessary. For example, if you ask us to correct data that we previously sent to a hotel, we will inform the hotel of the required correction (Article 19 of the GDPR requires recipients to be notified of rectification, erasure or restriction). Your privacy matters to us, so we actively work to uphold your rights.

Sharing data with other entities

Your personal data may be transferred (disclosed) to third parties only to the extent necessary to achieve the purposes described in this Policy. We do not sell your data to third parties or share it for use in purposes unrelated to the services provided. The main recipients of your data are our trusted Partners in Thailand, who are involved in organising tours, as well as the service providers needed to support our business. Below are the categories of entities to which we may transfer data, and the reasons for doing so:

Accommodation providers (hotels, resorts, guesthouses), To book your stay, we provide the accommodation provider with the necessary information about guests. This will typically include the guest’s or guests’ first and last names, stay dates, and sometimes nationality, passport or identity document number (if required for check-in), and special requests relating to the stay (e.g. room type). Hotels need this data to guarantee the booking and meet their reporting obligations under local regulations. We provide only the data required by the hotel, usually first and last name plus stay dates. If you make some bookings yourself (e.g. we provide only a discount code and you book independently), we do not provide any of your data to the hotel.
Local guides and tour operators, If we provide the services of a local guide or tour leader as part of a tour, or use a local travel agency in Thailand, we may provide that partner with a participant list and basic identification details (first name, last name, country of origin) to deliver the sightseeing programme. The guide needs to know who is in their care and often, for example, how many travellers booking private tours will be in the group. We also share the details needed to contact you locally (e.g. the group leader’s contact phone number) to help with logistics. All our guides and tourism contractors are required to maintain confidentiality and use this data only for the relevant tour.
Transport companies, If the tour itinerary includes travel or transfers, your data may be shared with the transport company (e.g. a coach hire company with a driver or a boat operator). Usually, this is only the number of passengers and the contact person’s surname. For air travel (domestic flights in Thailand or, if we arrange ticket purchases, a flight to or from Poland), we provide airlines with the details required to book a ticket: first name, last name, gender, date of birth, passport details and nationality, as required by regulations and reservation systems. The carrier uses this data only to issue the ticket and process check-in, and to meet security requirements (e.g. passenger lists are provided to aviation authorities and airport staff).
Insurance agent / insurer, If we offer or arrange travel insurance as part of our service (personal accident, medical expenses, etc.), we must provide the insurer or agent with the details of the insured persons. This typically includes first name, last name, date of birth, trip dates and sometimes an identity document number, for the purpose of issuing an insurance policy. The insurer then becomes a separate controller of this data, using it to issue the policy and handle any claims. We always inform you of the required data before the policy is taken out.
Local partner agencies, In some cases, we work with local travel agencies in Thailand that specialise in particular attractions or regions. Such an agency may, for example, organise optional day trips in a given location. If we use its services, we provide it with a participant list and the agreed details (dates, programme). The data typically includes first and last names and nationality (sometimes passport details, if required, for example, for foreign visitors entering national parks). The agency will use this data only to provide the services ordered (e.g. book discounted admission tickets for children in the group).
Data processors acting on our behalf, In our business, we use certain providers to process personal data on our behalf and on our instructions (in accordance with Article 28 of the GDPR). These may include:

accounting firm, if we use an external accountant, documents containing customer data (invoices) may be processed by the accountants. They are contractually required to maintain confidentiality and act only on our instructions,
hosting provider / IT service provider, our website and email may be hosted on the servers of an external IT company. This provider (e.g. a hosting company with servers in the EU) may have technical access to data we store on the server (e.g. email contents or the website database), but does not use the data independently and only provides the infrastructure. We have a data processing agreement with each IT service provider that ensures an appropriate level of protection and confidentiality,
communications service providers, e.g. a company that provides the mailing system we use to send newsletters (if we run a newsletter) or the operator of the online booking system we use. They also act under a data processing agreement and may not use your data for their own purposes.

other advisory and support entities, e.g. a law firm (if we need legal assistance in a matter related to your contract, we may need to share your data with a lawyer to the extent necessary to obtain advice or representation), audit firms (checking that our processes are correct, e.g. a GDPR audit), document archiving providers, etc. If we engage such entities, we also ensure that appropriate confidentiality and data processing clauses are in place.
Public authorities, In certain circumstances, we may be required to provide your data to public authorities such as the police, prosecution service, courts, tax, customs or border authorities, the Personal Data Protection Office, etc. This happens only as required by law. For example, law enforcement authorities may ask us to disclose data (under an appropriate warrant or statutory authority), e.g. during proceedings if it becomes necessary to confirm that a person took part in a trip. Another example may be a tax audit, in which we must produce accounting documents containing customer data. We always verify the legality of such requests and disclose data only when legally required to do so. Where possible, we also inform the individuals concerned about such requests, unless disclosure of the fact that data has been provided to the authorities is prohibited by law (e.g. under an order issued during an investigation).
Other recipients with your consent, If in future we need to provide your data to other entities not listed above, we will do so only after obtaining your explicit consent or at your express request. For example, if you ask us to recommend another company or service and want us to provide that entity with your contact details, we will do so only at your request (which effectively constitutes consent or action at your request).

We provide all recipients with only the minimum data necessary. Our Partners receive only the information needed to perform their part of the service. Each partner is also required by law (the GDPR, PDPA or local regulations) to protect your data. We have ensured that data processors acting on our behalf have entered into appropriate data processing agreements, which guarantee that they meet security standards and will not use the data for other purposes. Where Partners act as separate controllers (e.g. airlines and hotels), we provide data to deliver the service to you and expect them to respect data protection principles under the laws that apply to them. Many of our key partners (e.g. international hotel chains and global airlines) have their own privacy policies aligned with the GDPR or international standards. You can read them on their websites, although this is not necessary to use the service. No external profiling, We do not share your data with advertising companies to profile you or have third parties target you with ads. The only exception is the Meta Pixel’s activity within our own advertising, as described above. Even here, data is sent to the Meta platform in encrypted form and is used only to manage our campaigns; it is not passed to other advertisers. You can manage your advertising preferences directly on Facebook/Instagram, which lets you limit the use of your activity across different websites (including ours) for advertising purposes. Transfers of data to partners outside the EU, Given the nature of our business (organising services in Thailand), most of the partners listed are outside the European Economic Area (EEA), mainly in Thailand. This means that providing your data to them constitutes a transfer of data to a third country within the meaning of the GDPR (a country not covered by the GDPR). Detailed information about how we ensure these transfers are lawful is provided in the next section.

International data transfers

Where do we process your data? Your personal data may be processed in Poland/the EU and in Thailand, and potentially in other countries if this results from our partners’ activities (e.g. the servers of our IT service providers may be physically located in the EU or the USA). The key point is that we transfer data outside the European Union, specifically to Thailand, where our registered office is located and where the tour service is delivered. Articles 44-49 of the GDPR set strict rules for transferring data to third countries to ensure a consistently high level of data protection outside the EU. Below, we explain how we meet these requirements. No adequacy decision for Thailand, The European Commission has not yet adopted a decision recognising Thailand as providing an adequate level of data protection. This means Thailand is not formally on the “white list” of countries to which data may be freely transferred as within the EU. Therefore, to lawfully send data to Thailand, we must rely on another mechanism permitted under Chapter V of the GDPR. Standard contractual clauses and data transfers, One of the most common solutions for transfers is the use of Standard Contractual Clauses (SCCs) approved by the European Commission. If we stored data on servers in the EU and transferred it to our head office in Thailand or to Thai partners, we could enter into such agreements with them to ensure GDPR-level data protection. However, given the nature of our business, data is collected directly by our entity in Thailand (because AsiaTrip in Thailand is the Controller operating the website), which means it goes outside the EU immediately. From a legal perspective, a transfer from the EU to a third country occurs when a Polish tourist enters their data in a booking form on a server belonging to a company in Thailand. To make this transfer lawful, we rely on the derogations provided for in Article 49 of the GDPR, specifically the same basis as for processing: necessity for the performance of a contract with the data subject. Transfer necessary for the performance of a contract with the user (Article 49(1)(b) of the GDPR), The GDPR permits one-off or limited transfers of data to a third country when they are necessary to perform a contract with the data subject. This is the case for us: to perform a tour contract in Thailand, we must transfer your data to Thailand (to hotels, guides, etc.). The basis in Article 49(1)(b) makes such a transfer lawful without additional safeguards, provided it is one-off or necessary in the context of the particular contract. Our business consists almost entirely of organising trips to countries outside the EEA, including Thailand, so transferring data outside the EEA is inherent in the nature of the service. In each case, however, we ensure that we transfer data only to the extent necessary and for a purpose connected with your contract. Transfer necessary for the performance of a contract in the data subject’s interest (Article 49(1)(c) of the GDPR), In addition, the GDPR provides that a transfer may be lawful if necessary to enter into or perform a contract concluded in the data subject’s interest between the controller and another entity (e.g. between us and a hotel). This ground is sometimes cited when, for example, a travel agency transfers data to a foreign contractor so that it can provide a travel service to the customer, which is precisely our situation. We therefore also rely on this basis where applicable (e.g. a hotel booking is a contract concluded in your interest between us and the hotel). In this way, we act in accordance with Article 49 of the GDPR. Additional safeguards in place, Although transfers within the scope described are permitted under the stated exceptions, we make every effort to ensure that your data is protected in Thailand at least as well as in the EU. To this end:: We operate in Thailand, a country with its own comprehensive personal data protection law, the PDPA, closely modelled on the GDPR. This means our employees and local partners have legally binding data protection obligations similar to those in Europe. Among other things, Thailand’s PDPA requires us to ensure that a recipient provides adequate protection standards before transferring data abroad, unless an exception applies, such as consent or the necessity of a contract. In our case, data recipients (e.g. hotels) are in the same country, Thailand, so there is no further international transfer from Thailand. Nevertheless, Thailand requires controllers to protect data within the country as well. You can therefore expect data shared with a Thai partner to be subject to the PDPA and national laws protecting against misuse.: Each partner receives only the information it needs, which reduces the risk of improper use. If a partner does not need, for example, your passport number, it will not receive it.: We have entered into agreements governing data confidentiality and security with our more important contractors. Although these are not formally “EU Standard Contractual Clauses” (which apply, for example, between an EU company and a non-EU company), our agreements with partners include provisions requiring them to protect data to high standards, use it only for a specified purpose and not pass it on without consent. This provides an additional layer of protection.: Transmission security: when sending data to partners, we use secure communication channels. Most transfers take place over encrypted internet connections (e.g. we enter guest details directly into a hotel’s secure booking system or email them using TLS encryption). We also protect our devices and networks to prevent unauthorised parties from intercepting data.: Awareness and training: our employees in Thailand have received training in GDPR and PDPA requirements and know how to handle data about tourists from the EU. They understand that European standards are very high and work to meet them every day, for example by not discussing customer data in public places, not leaving documents containing data where others can see them and not sending sensitive data in plain text.: Privacy policy and consent: We clearly inform you that your data will go to Thailand and remain under our control. When you provide us with your data, you do so knowingly, aware that it will be used to provide a service in another country. In a sense, this is your implied consent to the transfer; Article 49(1)(a) of the GDPR permits a transfer to a third country based on the data subject’s explicit consent after they have been informed of the risks. We consider it preferable to rely on the necessity of the contract (points (b) and (c)), but your informed decision to use a service abroad also constitutes acceptance of this fact. Transfers to other countries, In addition to Thailand, your data may occasionally be sent to other countries:: USA, If we use Google Analytics or Meta Pixel, certain technical data (IP address, cookie identifiers) may be transferred to and processed in the United States by Google or Meta. The so-called EU-US Data Privacy Framework is currently in force between the EU and the USA. It is a new agreement that recognises US data protection standards as adequate for certified companies. Google and Meta have joined this programme, which means that data transfers to these companies may be based on Article 45 of the GDPR (an adequacy decision). In addition, both companies have included Standard Contractual Clauses in their terms in case the agreement proves insufficient. Finally, we can disable the transfer of some data to the USA (e.g. Google Analytics lets us set the data centre location). Nevertheless, we inform you of these transfers for clarity. For example, visiting our website and accepting marketing cookies may result in information being sent to Google’s servers in the USA. You can choose not to consent to these tools, in which case the data will not leave the EU.: Other countries, Our partners are mainly in Thailand. However, if a tour programme includes other destinations (e.g. a day trip to a neighbouring country such as Malaysia or Laos), your data may similarly be sent to contractors in those countries (e.g. a local carrier organising the trip abroad). Such cases will be occasional and will also be covered by Article 49 of the GDPR (necessity for performing a travel contract that includes that country). All these countries (ASEAN) are introducing or have introduced their own data protection laws modelled on the GDPR, so the level of protection is gradually increasing. In any case, before transferring data to a new country, we will always consider the security and lawfulness of the transfer. In summary, your data will be transferred abroad only when necessary to provide the service you have chosen or when you consent to it. When booking a tour in Thailand, you should expect your data to be in Thailand. We will, however, ensure it is properly protected there too. Thailand’s PDPA requires us to do the same. We may transfer data abroad only if the destination provides an adequate level of protection or certain circumstances apply, such as performing a contract or obtaining consent. In our case, we transfer data within Thailand (because our partners are in the same country as us). The only “external” transfer is from the EU to us in Thailand, which, as described, is based on the necessity of performing our contract with you. If you have further questions about the transfer of your data abroad or would like a copy of the safeguards applied to a transfer (e.g. relevant contractual provisions), please contact us. We will try to provide all the information you need to feel secure when entrusting us with your data.

Personal data security

We attach great importance to the security of your personal data. We take appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or destruction. In particular, we have implemented the following measures:

Organisational measures and internal policies: We have internal personal data protection procedures that meet GDPR and PDPA requirements. Our employees have been trained in information security best practices and are required to maintain confidentiality. Only authorised individuals (e.g. customer service staff and tour organisers) have access to data, and only to the extent necessary to perform their duties. We regularly remind staff of data protection rules and conduct internal audits to ensure that standards are maintained.
Access control: Electronic data is stored in secure IT systems. Access to databases, email inboxes and the website administration panel requires authentication (strong passwords that are changed frequently, with access restricted to specific IPs where possible). We follow the principle of minimum privileges, meaning that each employee or partner has access only to the data they need. Our IT systems have different access levels, and attempts at unauthorised access are logged and monitored.
Encryption: All connections between your browser and our Service are secured using HTTPS (SSL/TLS), which means that data submitted through forms is encrypted in transit. Our internal systems (for example, email communications) also use TLS encryption whenever possible. Sensitive data files (for example, archives containing customer data) are additionally encrypted or password-protected when we need to store or transfer them. When we share data with partners (for example, a guest list with a hotel), we use secure communication channels and avoid public, unsecured Wi-Fi networks and open transmission channels.
Physical security: Our premises are secured against access by unauthorised persons. Paper documents containing personal data (for example, contracts and printed participant lists) are kept in locked cabinets or rooms accessible only to staff. Once documents are no longer needed, we destroy them using a shredder (sensitive data is sent for professional destruction). Electronic devices used to process data (computers and laptops) are protected with passwords and antivirus software; we do not leave them unattended in public places.
Backups: We regularly back up important data (for example, customer databases and booking records) and store the backups in a secure, isolated environment. Backups are encrypted and protected against unauthorised access. This helps protect against data loss caused by equipment failure, ransomware attacks or other incidents. We test our backup procedures periodically to ensure that data can be restored when needed.
Monitoring and testing: We monitor our systems for potential threats. Firewalls, intrusion detection systems and other safeguards are in place to protect our IT infrastructure. From time to time, we conduct security tests, either ourselves or with the help of external specialists, to identify and promptly fix any vulnerabilities. We also keep up to date with information about new threats (for example, known software vulnerabilities) and promptly apply security updates and patches.
Data minimisation: As mentioned above, we collect only the data we genuinely need. The less data we store, the lower the risk of a breach or misuse. We also apply the principle of storage limitation: we keep data no longer than necessary (details of retention periods are provided below). Once these periods have expired, data is securely deleted or anonymised.
Incident management: We have a procedure for suspected personal data breaches. If an incident occurs (for example, theft of a device containing data, a system break-in or an email sent to the wrong recipient), we will promptly take steps to limit its effects and remedy the situation. We also assess the risk to the individuals concerned. If an incident is found to have potentially resulted in a high risk to your rights or freedoms, we will notify you without undue delay, in accordance with Article 34 of the GDPR and Section 37 of the PDPA. We will also report the incident to the competent supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR and Section 37 of the PDPA. We nevertheless believe that our robust safeguards will help us avoid serious incidents.
Data Protection Officer (DPO): Under the GDPR and Poland’s 2018 Act, some organisations must appoint a Data Protection Officer. Having analysed the nature of our activities, we have concluded that we are not required to appoint a DPO (we are not a public authority, we do not process special categories of data or data relating to convictions on a large scale, and our core activities do not involve large-scale systematic monitoring of individuals). Nevertheless, we have internally appointed a person responsible for overseeing information security and compliance with data protection laws. You can contact us about your data as you would a DPO, even though we are not formally required to have one; we provide a similar point of contact (see the Contact section). Thailand’s PDPA also requires the appointment of a so-called Data Protection Officer in certain cases, when processing is on a large scale. Our operations are sufficiently moderate in scale that this requirement does not apply to us. Responsibility for data protection is nevertheless clearly assigned within our organisation.
Compliance with norms and standards: We aim to follow not only the letter of the law but also good practice. As appropriate to our capabilities, we take account of recommendations from the European Data Protection Board, guidance from the President of the Polish Personal Data Protection Office (UODO), and international standards on information security management (ISO/IEC 27001).

Despite all our efforts, no security system can guarantee 100% security. There is always some risk associated with data processing, whether due to human error or unforeseen circumstances. Nevertheless, we can assure you that we continually improve our safeguards and respond to emerging threats. If you have any concerns about the security of your data or notice anything suspicious (for example, a suspicious message claiming to be from us), please let us know. Users’ cooperation helps us maintain a high level of protection.

Cookies and analytics tools

Like most websites, our Service uses cookies and related technologies (for example, local storage and web beacons) to ensure it works properly and to improve your experience. Below, we explain the types of cookies we use, their purposes and the options you have for controlling these technologies. What are cookies? Cookies are small text files stored on your device (computer or phone) by the website you visit. They contain certain information (for example, a unique identifier or the website name) and are sent back on subsequent visits to the same website, allowing it to recognise a returning user. Cookies can serve various purposes: from maintaining a login session and remembering preferences (for example, the site language) to collecting anonymous statistics or personalising ads. What cookies do we use? Our Service uses both first-party cookies (set by the AsiaTrip.pl domain) and third-party cookies (set by external services whose features we use, such as Google and Meta). By duration, cookies are divided into session cookies (temporary cookies that expire when you close your browser) and persistent cookies (which remain on your device for a set period or until deleted). The categories of cookies used on our website are listed below:

Essential technical cookies, These files are necessary for the Service and its available features to work properly. They include cookies that maintain a user session (for example, after logging in to a possible customer area, if one exists), preference cookies (for example, to remember your selected service language, if this option is available), and cookies used to secure the website (for example, anti-CSRF tokens that protect forms against misuse). Without these cookies, using the Service could be difficult or impossible, so we set them automatically without requiring consent. We do so on the basis of Article 173(3) of Poland’s Telecommunications Law and our legitimate interest under the GDPR in providing services requested by the user and keeping the Service secure.
Analytics cookies, These files collect information about how users use our Service, which pages they visit, how much time they spend on them and what actions they take. We primarily use Google Analytics for this purpose. GA cookies (for example, _ga, _gid and _gat) assign your device a randomly generated identifier, allowing Google Analytics to recognise a repeat visit without containing personal data such as your name or email address. We use this information to produce aggregated statistics and reports. We analyse Google Analytics data anonymously and are interested in trends (for example, which pages are most popular), not in tracking specific individuals. Even so, we treat analytics cookies as non-essential, which means they are stored only with your consent. On your first visit, we ask whether you accept analytics cookies; if you refuse, Google Analytics will not run. You can also use Google’s additional opt-out options, such as installing the browser add-on that blocks Google Analytics (available for most popular browsers).
Marketing (advertising) cookies, Our Service uses marketing tools such as the Meta Pixel (Facebook Pixel). These files (for example, a cookie named _fbp) allow us and Meta to understand that you have visited our website, which may result in our ads being shown to you on Facebook or Instagram. The Pixel collects information about your activity on the website (for example, whether you proceeded to the contact form), helping us measure ad performance and reach the right audiences. The data collected by the Pixel is somewhat more personal than purely analytical data because it may be linked to your Facebook account, if you have one and are logged in. Marketing cookies therefore also require your consent. They will not be active unless you select consent to marketing in the cookie banner. If you consent, the Pixel will operate during your visit. You can withdraw your consent at any time, for example through the privacy settings in our banner or by changing the ad settings in your Facebook account. In your Facebook account settings, you can also manage Off-Facebook Activity, where you can see a list of websites, including ours, that have shared information with Meta and, if you wish, disconnect that information from your account.
Functional and other cookies, Our Service currently does not use many additional social media or multimedia plugins that could set their own cookies (such as YouTube, Twitter or Google Maps). If such elements are added, we will also inform you about them and, if they require consent (for example, an embedded YouTube video with tracking cookies), enable them only with your consent. Standard buttons linking to our social media profiles, if present on the website, do not collect data unless you click them.

Managing cookies: how to give or withdraw consent On your first visit, we display a cookie banner that lets you accept individual categories of cookies. You can:: accept all non-essential cookies (analytics and marketing), for example by clicking “Accept”;: refuse them and accept only essential cookies, for example by clicking “Reject” (in that case, only necessary technical cookies will operate);: customise your choice by selecting the categories you consent to, then saving your settings. If you want to change your choice later, for example, to withdraw consent or enable cookies you previously declined, you can do so at any time. To do this:: Open the cookie settings available on our website (for example, the “Cookie settings” link in the footer or the shield/cookie icon, if displayed). A consent management panel will open, where you can adjust and save your preferences.: Alternatively, you can clear cookies in your browser. This will cause our banner to appear again on your next visit because we will not “remember” your previous choice. However, clearing cookies removes them globally for all websites, so you may also lose saved logins and preferences on other websites.: You can also use your browser settings. Most browsers let you block third-party or all cookies, and enable notifications when a cookie is about to be stored. You can also delete individual cookies or all cookies at once in your browser settings. The steps vary by browser (for example, in Chrome: Settings > Privacy and security > Cookies and other site data; in Safari: Preferences > Privacy; in Firefox: Options > Privacy). Please bear in mind that blocking all cookies may cause some websites, including our Service, to work improperly. We therefore recommend managing consent through our mechanism so that you disable only the categories you do not want. Analytics and marketing tools: details about data protection:: Google Analytics: Data collected by Google Analytics (using _ga and similar cookies) is processed by Google in accordance with Google’s Privacy Policy. Google may act as our processor for this data, but in some cases may also be a separate controller (for example, when using data to improve its services, unless those options have been disabled). We have configured GA so that it does not collect data that allows you to be identified (for example, we do not send your name or email address to GA). We have also enabled additional safeguards where possible: IP anonymisation and restricted Google data sharing (Data Sharing Settings are limited). As a result, the data is used solely by us for statistics. Google Analytics 4, which we use, does not store users’ IP addresses, and we have set event data retention to 14 months (after which the data is automatically removed from our GA statistics).: Meta Pixel: Using the Pixel connects information about your activity on our website with Meta’s advertising system. As an advertiser on Facebook, we have access only to anonymised reports (for example, how many users performed a particular action) and possibly tools for creating audience groups (for example, a so-called custom audience list; however, we do not provide Meta with any of your contact details to create such lists without your consent. The Pixel operates using browser and Facebook account identifiers). Meta states that the Pixel data it collects is processed in accordance with its own Privacy Policy and is not shared with unauthorised parties. Nevertheless, as part of Meta’s ad profiling, information about your interests may be used to show you ads, including ads from other advertisers. You can use Your Ad Preferences on Facebook to view and control what data Meta has about your activity and how it is used for advertising. If you do not want Meta to collect data about your activity outside Facebook, you can disable the “Off-Facebook Activity” feature there or use available opt-out options, for example on the YourOnlineChoices website or through your device settings to limit tracking across apps. Server logs: Although they are not cookies, it is worth mentioning logs. The server hosting our Service automatically records certain information about visits in log files (as mentioned earlier: IP address, date and time, etc.). This data is used mainly for technical and security purposes, not to track users. Logs are kept for a limited time, usually a few weeks, and are accessible only to server administrators. We do not link logs to specific individuals, and IP addresses in logs may only potentially be considered personal data. In the event of a security incident, logs may be used to investigate it. Consent to cookies under applicable regulations: In Poland, the use of cookies and similar technologies is governed by Article 173 of the Telecommunications Law, which requires user consent unless a cookie is necessary to provide a service requested by the user. We comply with these regulations through the consent mechanism described above. The legal basis for processing data through cookies using analytics and marketing tools is therefore your consent (Article 6(1)(a) of the GDPR); if you do not consent, such data is not collected. Polish and EU e-privacy regulations are also evolving, and we aim to stay up to date and adapt our practices to current guidance from UODO and other authorities. Third-party cookies from outside the EEA: As mentioned, Google and Meta are based outside the European Economic Area. Enabling their tools involves transferring certain data (in encrypted or raw form) to the USA. We do this only with your consent, relying on Article 49(1)(a) of the GDPR (explicit consent to the proposed transfer after being informed of the risks). The risk is that data in the USA may potentially be accessible to local authorities under laws such as the Cloud Act. However, we consider this risk minimal for anonymised Google Analytics data and for Meta Pixel, which mainly transfers a cookie identifier. Nevertheless, we inform you of this directly here and in our cookie banner. The final decision is yours. Summary: We use cookies in a transparent way that you control. We encourage you to accept analytics cookies because they help us improve the Service, but we respect your choice if you disable them. In any case, the Service is designed to remain useful to people who do not consent to additional cookies. If you have questions about our cookie policy, you can contact us.

Data retention periods

We process your personal data only for as long as necessary to achieve the purposes for which it was collected. Retention periods depend on the type of data, the purpose of processing and legal requirements. The main categories of data and their retention periods are set out below:

Data related to organising a tour (contract), Data provided when booking and taking part in a tour (for example, participants’ personal data, correspondence about the trip and booking details) will be kept for the duration of the contract and then for as long as necessary to address any potential claims or complaints. Under civil law, claims under a contract for the provision of tourist services may become time-barred after 3 years, or later if the limitation period has been interrupted or suspended. Consumer claims may also have a longer limitation period (for example, 5 years). In practice, therefore, we keep tour-related data until the limitation period for mutual claims arising from the contract has expired. Our current standard retention period is 5 years from the end of the year in which the tour took place, which should cover most potential claims. After that time, the data will be deleted or anonymised unless one of the exceptions below applies (for example, data in financial records).
Data in financial and accounting records, Accounting documents containing personal data (invoices, sales records and paper contracts) are kept for the period required by tax and accounting regulations. In Poland and, similarly, in Thailand, this period is at least 5 full tax years from the end of the year in which the transaction took place (for example, invoices from 2025 must be kept until the end of 2030). Some regulations may require a longer period, and we comply with the longest applicable period. Once these legal retention requirements have expired, the documents are securely destroyed. Please note that these documents usually contain only a limited range of data (for example, the customer’s name and address on an invoice). This data is not used for other purposes, but we must retain it for legal reasons.
Marketing data (newsletter and marketing consents), If we process your email address to send newsletters or promotions on the basis of your consent, we will do so until: (a) you unsubscribe or withdraw your consent, or (b) we stop sending the newsletter. When you unsubscribe, your email data will be promptly removed from the mailing list, no later than within a few business days. We may, however, retain a record that you withdrew your consent so that we do not send you unwanted communications in the future (a so-called “opt-out” list, containing only the minimum identifying data, such as your email address). Similarly, if you have given other marketing consents (for example, to be contacted by phone), we retain the data until you withdraw your consent or the purpose ends. For marketing based on legitimate interests (for example, contacting a former customer with a new offer), we will process your data until you object, but for no longer than a reasonable period after our cooperation ends. We currently consider this to be a maximum of 2 years after the tour, if you have not shown interest in another offer during that time, because our marketing interest then diminishes. Of course, specific emails or calls may be sent once or twice a year, rather than continuously.
Enquiries that do not result in a contract, If you contacted us to ask about an offer but did not ultimately make a booking, we may retain your contact details and enquiry history for a period of time for analytical and service purposes. Our standard retention period is 1 year from the last contact, in case you get in touch again. This helps us refer to our previous arrangements. After that period, the data may be deleted or anonymised unless there is another basis for retaining it (for example, consent to further marketing, in which case the periods above apply).
System logs and technical data, Server logs are typically kept for 3 months. Analytics cookies have a set lifespan (for example, the Google Analytics _ga cookie is valid for 2 years unless you delete it sooner; the _gid cookie for 24 hours; and the Pixel cookie for 90 days). In our systems, GA4 event data is retained in our statistics for 14 months, as mentioned above, and is then automatically removed from our view (Google may retain aggregated data for longer, but it does not relate to specific users). Pixel data is available in Meta’s dashboard as historical aggregates (Meta does not explicitly specify a retention period for Pixel events, but the maximum lookback period for creating retargeting audiences is 180 days). We do not archive Pixel data outside the Meta platform.
Data in email correspondence, Emails exchanged with you may contain your personal data. Our email account is used for business, and we archive messages for different periods depending on their content. If an email relates to fulfilling a contract, it may be kept for the period applicable to contract records (until claims become time-barred). If it is an enquiry about an offer, it is kept for up to a year, as mentioned above. Nevertheless, we try not to retain large quantities of old emails. We regularly review and delete messages we no longer need. You have the right to request deletion of specific emails from us if there is no basis for retaining them longer.

Once the periods specified above have expired, data is deleted or anonymised (that is, elements that could identify an individual are irreversibly removed). Under the GDPR, anonymisation is equivalent to deletion because, after this process, the data is no longer personal data and cannot be linked to any individual. For example, we may retain certain statistical information about customers (how many people took tours in a given year, or which cities customers came from, if we recorded this) for many years, but only in aggregated form without personal identifiers. In exceptional circumstances, we may retain certain data longer than stated above if necessary to establish, pursue or defend claims (for example, if court proceedings are under way in connection with a trip, we will keep the data until the case has been finally concluded and any judgment has been enforced). We may also be required to retain data somewhat longer if public authorities (for example, a tax office) are conducting proceedings. We always apply the principle of storage limitation and periodically review the records we hold so that we do not keep data longer than genuinely necessary. If you want to know whether we still hold specific data about you, you can exercise your right of access. We will tell you whether we have already deleted it or still retain it, and why.

Changes to the Privacy Policy

This Privacy Policy may be updated or amended periodically, in particular if:: laws applicable to our activities change (for example, new guidance from supervisory authorities, amendments to the GDPR, PDPA or national laws);: new Service features or services are introduced that involve new processing of personal data (for example, launching an online shop, a loyalty programme or integrations with new partners);: our internal processes or company structure change (for example, appointing a data protection officer or changing our contact details or registered office address). Any changes to the Policy will be published on the Service at the same address, in the Privacy Policy section. The last updated date at the beginning of the document will be changed accordingly so that you can easily see that the Policy has been amended. We recommend checking this page periodically to stay informed about any changes. If the changes are significant (for example, if the main purposes or legal bases for processing data change in a way that may require your consent), we will also inform you through other channels, such as a pop-up notification on the Service during your next visit and, in some cases where required, by email. If a change requires us by law to obtain your consent again (for example, if we wish to process your data for a new marketing purpose), we will ask you for consent again. Please remember that using the Service after changes have been introduced means accepting the new version of the Privacy Policy, to the extent permitted by law. We cannot retroactively change your rights or withdraw a promise once made. If you do not agree with any change, you have the right to request that we stop processing your data or delete it, within the limits described in the section on your rights.

Contact

If you have any questions, requests or concerns about this Privacy Policy or the processing of your personal data by AsiaTrip.pl in general, please contact us. Data controller: AsiaTrip.pl (operating as part of AsiaTrip Travel Co., Ltd) Address: 38/1-3 39 หมู่ที่ 6 Bang Na-Trat Frontage Rd, Bang Kaeo, Bang Phli District, Samut Prakan 10540, Thailand. Email: info@asiatrip.plWe prefer to be contacted by email about data protection, as this allows us to direct your enquiry to the right person quickly and provide you with a comprehensive written response. You can write to us in Polish or English. If you prefer traditional correspondence, letters in Polish or English sent to our address in Thailand will also reach our administration. Please bear in mind, however, that a reply by post may take longer because of the distance. For urgent matters, you can also call us. We will try to provide information by phone, although for complex requests (for example, requests for a copy of your data) we will still ask you to confirm them in writing for security reasons. Supervisory authority in Poland: If you have concerns about how we process your data, you have the right to lodge a complaint with the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warsaw, tel. 22 531 03 00, uodo.gov.pl). Supervisory authority in Thailand: You can also contact the Office of the Personal Data Protection Committee (PDPC). In Thailand, the competent authority is the PDPC under the Ministry of Digital Economy and Society. The PDPC currently handles complaints from data subjects in accordance with PDPA procedures. We hope this information is clear and comprehensive. Thank you for trusting us with your data in connection with your trip to Thailand. We will do our utmost to keep your data safe and respect your privacy. We wish you a pleasant and safe trip with AsiaTrip!

Phuket

Phuket to Bangkok Trip: 1-2 Days, Flights, Prices and Itinerary

Sitting on Phuket, you’ve already ticked off the beach, and one thought keeps coming back: could you pop over to Bangkok for a day or two? Absolutely. A trip from Phuket to Bangkok is one of the most popular excursions planned by visitors to southern Thailand, and it doesn’t require complicated logistics. A flight of […]

Bangkok rooftop bars: the best way to enjoy an evening with a view

Thailand

Bangkok rooftop bars: the best way to spend an evening with a view

Bangkok rooftop bars are among the attractions that best capture the city’s energy after dark. From above, you can see the Chao Phraya River, temples, skyscrapers, traffic

Chatuchak Market Bangkok: Complete Guide

Thailand

Chatuchak Market Bangkok: A Complete Guide

Chatuchak Market in Bangkok is one of Thailand's most intense shopping destinations. The market is famous for its thousands of stalls, huge range of products and

Thailand

A trip to Thailand: a complete guide for travellers

A trip to Thailand is one of the best ideas for an exotic holiday. The country combines tropical beaches, temples, street food and an excellent transport network.

Pattaya Water Parks: A Guide to the Best Parks

Pattaya Water Park: A Guide to the Best Parks

Pattaya water parks are a popular topic when planning a family day in Pattaya. The city is known for its beaches, nightlife and excursions.

Wat Arun Bangkok: a complete guide to the Temple of Dawn

Wat Arun in Bangkok is one of Thailand's best-known temples. It stands on the Chao Phraya River, on the Thonburi side.

Thailand

Safari World Bangkok: A Complete Guide to the Park

Safari World Bangkok is one of the capital's biggest family attractions. The park combines a drive through the safari area with walks around the Marine Park

Jomtien Beach, Pattaya: a quieter side of the seaside

Thailand

Jomtien Beach, Pattaya: a more peaceful side of a seaside break

Jomtien Beach is a long beach south of central Pattaya. It has a more laid-back atmosphere than the city’s main beach.