Privacy policy

Who is responsible for your information

Asiaround Co., Ltd. (company registration number 0845564007533) operates Naiwok Hills and is the data controller for the accommodation, guest services and website activities described in this policy. The property is owned by Bandres Co., Ltd. (company registration number 0845564003082). Their registered offices are situated at Naiwok Hills, 151/10 Moo 1, Koh Phangan, Surat Thani 84280, Thailand.

References to “we”, “us” and “our” mean Asiaround Co., Ltd. Privacy enquiries and requests may be sent to [email protected], made by telephone on +66 (0)2 5440060, or addressed to the registered office above.

Information covered by this policy

This policy explains how personal information is handled when you enquire about accommodation, make a reservation, stay at Naiwok Hills, request guest services or use our website. The information required depends on the activity and includes:

• Identity and contact details: names, contact information and identification particulars required for guest registration and immigration reporting. Photographs or scans of identity documents are used for those purposes and discarded after submission to the authorities.
• Reservation and stay details: dates, accommodation category, occupancy, accompanying guests, booking references and correspondence about the stay.
• Payments and transactions: amounts paid, payment status, transaction references, billing information and records needed to administer payments and refunds.
• Guest requests: the room, villa or unit number and the service request or issue submitted through our guest-service forms. These forms do not request a guest's name or contact details. We use the accommodation number to associate the request with the relevant stay.
• Correspondence: information exchanged about enquiries, reservations and stays through email, WhatsApp and the communication platforms used to manage those messages.
• Security footage: CCTV images from common areas, as described below.
• Website and consent information: IP address, browser and device information, pages requested, referral information, timestamps and cookie preferences. Optional measurement information is collected in accordance with your consent choices.

Information is received directly from you, from online travel agencies and other booking channels through which you reserve accommodation, and through the operation of our services. Please provide only information relevant to your request and do not send full payment-card details by email or message.

Why we use personal information

We use personal information for the following purposes and on the corresponding legal grounds, as applicable under Thai data-protection law:

• Reservations and services: to respond to enquiries, administer bookings and payments, provide accommodation and fulfil guest requests. This processing is necessary to take steps at your request before a contract or to perform the accommodation or service contract.
• Legal obligations: to complete guest registration and immigration reporting, maintain required accounting and tax records, and respond to lawful requests from competent authorities.
• Administration and security: to handle correspondence and complaints, maintain reliable systems, protect people and property through common-area CCTV, prevent misuse and establish or defend legal claims. We rely on legitimate interests where those interests are not overridden by your rights.
• Optional website measurement: to understand website use and assess advertising campaign performance, on the basis of the consent choices described in our cookie notice.

Our email and WhatsApp communications concern enquiries, bookings and stays. We do not send promotional messages or newsletters to former guests. We do not keep guest Wi-Fi activity logs.

Where information is required by law or is necessary to arrange or provide a service, failure to provide it may prevent us from confirming a reservation, completing check-in or fulfilling the relevant request. Optional cookie consent is not a condition of booking or staying with us.

Guest requests and children

Guest-service forms use the room, villa or unit number to identify the stay. The number and request content are processed through Jotform, which hosts the forms. This limits the identifying information requested in the form; it does not make the request anonymous to Naiwok Hills, which can link it to the reservation.

The forms do not request health information or other sensitive personal details. Please avoid including unnecessary personal information in free-text requests or attachments. Jotform may separately process technical information about access to its service, as described in its privacy policy.

Information about children is handled where necessary to administer a family reservation, establish occupancy or comply with guest-registration requirements. Parents or guardians should provide information on their behalf where appropriate.

Service providers and disclosure

Guest-service requests are handled by our own team. We use the following providers to support bookings, payments, communications and the website:

• Beds24 and booking channels: Beds24 supplies the reservation service at book.naiwokhills.com. Online travel agencies supply reservation information when a booking is made through their platform and also process information under their own privacy notices.
• Jotform: hosts the guest-service forms and processes submitted accommodation numbers and requests on our behalf.
• Omise, Wise and SCB: Omise provides our payment gateway; Wise and Siam Commercial Bank (SCB) are used for other banking transactions. These providers process the information needed for the relevant transaction and their own legal obligations.
• Hostinger: provides our server hosting and email services. Operational records are also handled on computers at the property.
• UChat and WhatsApp: UChat is used to manage guest communications, including messages delivered through WhatsApp. The information processed depends on the channel and includes the contact identifier, message content and related delivery information.
• Cloudflare Zaraz and Google: support cookie-preference management and consent-based analytics and campaign measurement, as explained in the cookie notice.

The contact launcher is supplied through asiaround.com and links to messaging, maps, email, telephone and social-media services. External services linked from the website, including food delivery, may process information for their own purposes under their privacy notices. They are separate from the guest requests fulfilled by our team.

Information may also be disclosed to competent authorities where required by law and to professional advisers where necessary for accounting, compliance or legal claims. Providers acting on our behalf are required to process information for the authorised purpose with appropriate safeguards. Banks, payment providers and booking platforms may also have independent legal responsibilities for their own processing.

Security cameras in common areas

CCTV operates in common areas for the protection of people and property and the investigation of security incidents. There are no cameras inside the villas. The system records video only; it does not record sound or use facial recognition.

Footage is retained for 30 days, stored locally and accessible only at the property. It is not stored in the cloud. Access is restricted to authorised persons for security purposes. Relevant footage may be preserved beyond the routine retention period where necessary for a specific incident, legal claim or lawful request from an authority.

International processing

Some service providers operate systems outside Thailand, so information may be processed in other countries. Where an international transfer is subject to legal requirements, we will use an applicable permitted basis and appropriate safeguards. You may contact us for information about the arrangements relevant to your data.

How long information is retained

We apply the following retention periods, subject to any longer period required by law or necessary for a specific dispute, incident or legal claim:

• Reservation records: retained for one year following the stay. Required guest-registration records are retained for at least the applicable statutory period. This is separate from retaining an image of an identity document.
• Identity-document photographs and scans: used only for registration and immigration purposes and discarded once submitted to the authorities. Necessary registration particulars and submission records may remain in the required records.
• Accounting and tax records: retained for at least five years from the relevant accounting close, tax filing or report date, as applicable, and longer where required by law or a competent authority. The one-year reservation period does not override these obligations.
• CCTV recordings: retained for 30 days, except for relevant footage preserved for a specific incident, claim or lawful request.
• Guest requests and correspondence: retained as needed to fulfil the request, provide follow-up and deal with any related complaint or claim. They are not retained for promotional messaging to former guests.
• Technical, consent and analytics records, and backups: retention depends on the relevant service and its configured settings. Our platforms currently use their default settings; those settings do not establish a single retention period across all services.

Records no longer needed for their purpose or a legal requirement are to be deleted or anonymised. This includes copies held on our server and property computers and, where we control them, records held by service providers. Backup copies expire under the relevant backup cycle; deleting an active record does not necessarily remove every backup immediately. Providers and authorities may retain information under their own applicable obligations.

Keeping information secure

We use appropriate organisational and technical measures to protect personal information against unauthorised access, loss, alteration or disclosure. Access is limited according to the needs of the relevant activity. No system or method of transmission can provide an absolute guarantee of security.

Your rights and choices

Subject to the conditions and exceptions in applicable law, you may request access to and a copy of your personal information, correction of inaccurate information, deletion, restriction of processing or transfer of information, and may object to certain processing.

Where processing is based on consent, you may withdraw that consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, or processing supported by another lawful basis. Website cookie choices can be changed through Cookie settings.

To exercise a right, contact us using the details above. We may request information reasonably necessary to verify your identity and locate the relevant records. We will respond within the period required by applicable law and explain any lawful reason for declining or limiting a request. You may also lodge a complaint with the competent authority under Thailand's Personal Data Protection Act; information is available from the Personal Data Protection Committee.

Updates to this policy

Effective date: 7 October 2026. Changes will be published on this page. Where a change requires additional notice or renewed consent, we will provide it as required by applicable law.