Legal
Privacy & data security
Wai Wellness Journeys (“we”, “us”) plans and arranges wellness journeys on Koh Yao Noi, Thailand. This policy explains what personal data we collect when you visit waijourneys.com or contact us, why we use it, who we share it with and what rights you have. We keep it short and we only collect what we need to answer you and to arrange your trip.
1. Who is responsible for your data
Wai Wellness Journeys is the controller of the personal data described in this policy. For any privacy question or request, write to us at info@waijourneys.com.
2. What we collect
When you send a booking request or enquiry
- Your name and email address.
- Your trip details: preferred dates and flexibility, focus, journey length, group size, interests, chosen extras and the estimated total.
- Anything you choose to write in your message.
When you contact us by email or WhatsApp
- Your name, email address or phone number, and the content of your messages.
When you book a journey with us
- The details needed to arrange your stay, such as arrival and departure dates and, if you ask us to arrange a transfer, your flight or ferry times.
- An emergency contact (name and phone number), and a short health form or participation waiver if we or our partner ask you to fill one in before your first session.
- Information you choose to share so we can adjust activities for you, such as an injury, a medical condition or dietary needs. Please only share what is relevant.
- Payment details: you pay the deposit on a secure page run by our card payment provider, through a link we email you. Your card details go to that provider, not to us; we receive a payment confirmation (amount, date, your name and email). The rest of the price is paid on arrival, in cash or by card.
When you simply browse the site
We do not use cookies, analytics, advertising pixels or tracking tools, and we do not build visitor profiles. Our fonts and images are served from our own website. Like every website, our hosting provider automatically processes technical data (such as your IP address, browser type and the pages requested) to deliver the site and keep it secure.
3. Why we use your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your enquiry and preparing a proposal | Steps you ask us to take before a contract |
| Arranging and running your journey (accommodation, classes, extras, transfers, on-island support) | Performance of a contract |
| Adjusting activities to an injury, health condition or dietary need you share with us | Your explicit consent, which you can withdraw at any time |
| Keeping booking and payment records | Legal obligations (for example accounting and tax rules) |
| Keeping the website secure and working | Our legitimate interest in a safe, functioning website |
We do not sell your data, we do not use it for automated decision-making, and we do not send you marketing messages unless you ask us to.
4. Who we share it with
We only share what each party needs, and only to deliver your request or your journey:
- Local partners who deliver your journey: your accommodation, Muay Thai gym, yoga teachers and any provider of an extra you book (for example a transfer or scooter rental). They receive your name, dates and the details relevant to their part.
- Service providers who help us run the business: our website host, a form-delivery service that forwards booking requests from this site to our inbox, our email provider, our card payment provider for deposits, and WhatsApp (Meta) if you message us there. They process data on our behalf or under their own terms.
- Authorities, where the law requires it.
5. International transfers
We are based in Thailand, and some of our service providers operate in other countries. This means your data may be processed outside the European Economic Area, the UK or your own country. Where this happens, we rely on the safeguards available under applicable law, such as the provider's standard contractual clauses, or on the transfer being necessary to answer your request or arrange the journey you asked for.
6. How long we keep it
- Enquiries that don't lead to a booking: up to 12 months after our last exchange, then deleted.
- Booking records: for as long as tax and accounting law requires.
- Health or dietary information: only until your journey ends, unless you ask us to keep it for a future trip.
7. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or Thailand's Personal Data Protection Act), you can:
- ask for a copy of the personal data we hold about you;
- ask us to correct or complete it;
- ask us to delete it, or to restrict how we use it;
- object to how we use it, and receive it in a portable format;
- withdraw your consent at any time, without affecting what we did before;
- complain to a data protection authority, for example the one in the country where you live.
To use any of these rights, email info@waijourneys.com. We will reply within one month.
8. How we keep your data secure
We take the protection of your data seriously and use technical and organisational measures that fit a small travel business:
- Encrypted connections. Our website is served over HTTPS, so what you type into the booking form is encrypted on its way to us.
- No card data on our side. Deposits are paid on our card payment provider's secure page. We never see, receive or store your full card number or security code. If you pay the balance by card on arrival, the payment goes through the provider's terminal or link in the same way.
- Limited access. Only the people who handle your booking can see your details. Our email, messaging and payment accounts are protected with strong, unique passwords and two-step verification where the service offers it.
- Minimum sharing. Partners and providers receive only what they need for their part of your journey, and we ask them to keep it confidential and use it only for that purpose.
- Data minimisation. We don't ask for passport copies, ID numbers or full medical records. Health information is only what you choose to tell us so we can adjust activities, and we delete it after your journey (see section 6).
- Secure deletion. When the retention periods in section 6 end, we delete your data or make it anonymous.
- If something goes wrong. If a security incident is likely to put your rights at risk, we will tell you and, where the law requires it, the relevant data protection authority without undue delay.
No method of sending or storing data online is completely secure, so please don't send sensitive documents (such as passport scans or card details) through the website form, email or WhatsApp. If we ever need a document, we will tell you how to share it safely.
9. Children
Our journeys are booked by adults. If you are under 18, please ask a parent or guardian to contact us for you.
10. Changes to this policy
We will update this page if the way we handle personal data changes, for example if we add a newsletter or website analytics. The date at the top shows the latest version.