Privacy Policy
How Malloo Holiday collects, uses and protects your personal data.
1. Who we are and what this covers
ChiangMai-Tours.com is operated by Malloo Holiday, the trading name of EVERLASTX CO., LTD. (registered company no. 0505568008596), based in Chiang Mai, Thailand. EVERLASTX CO., LTD. is the data controller for the personal data described in this policy.
This policy covers everything we offer: tours and activities, tickets, spa and wellness appointments, golf tee times, and our luggage storage service at our Chiang Mai offices - whether you book online or in person at our counter.
We handle personal data in line with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). Because most of our customers are visitors from abroad, where the EU General Data Protection Regulation ("GDPR") applies to you we also honour the rights it gives you, as set out in section 8.
2. Information we collect
When you book with us or create an account, we collect:
- Full name
- Email address
- Phone number
- Payment confirmation details - card numbers are entered directly into Stripe's secure form and never reach our systems (see section 6)
- What you booked, the date and time, and the number of participants
- Special requests you tell us about (dietary, medical, accessibility needs)
- Emergency contact details, where an activity requires them
- Passport or identification details, where a specific activity or operator requires them
- Your messages to us, and our replies
2.2 Luggage storage: bag photos and CCTV
When you store luggage with us we additionally collect:
- Photographs of your bags, taken at check-in. These exist so your belongings can be identified and matched back to you at collection, and so a dispute about condition or contents can be resolved.
- Your name, email and phone number, the storage period, and the office you used.
- CCTV footage. Our offices are monitored by CCTV 24/7 to protect stored belongings. You may be recorded when visiting our counter. Footage is kept for a maximum of 60 days - see section 7.
Bag photographs are deleted automatically three days after your expected checkout time. This is an automated daily process, not a manual one. Photographs uploaded during a booking you never completed are removed as well.
3. How we use your information, and our legal basis
Under the PDPA and the GDPR we must have a lawful reason for each use of your data. Ours are:
| What we do | Why we are allowed to |
|---|---|
| Take and fulfil your booking, send confirmations and reminders, process payments and refunds | Necessary to perform our contract with you |
| Identify your bags at collection, and operate CCTV at our offices | Our legitimate interest in safeguarding stored property and preventing loss or theft |
| Answer your questions and provide customer support | Necessary to perform our contract, and our legitimate interest in running the service well |
| Keep accounting and tax records | Compliance with a legal obligation under Thai law |
| Understand how the website is used, and improve it | Our legitimate interest in improving our services |
| Send you promotional offers or newsletters | Your consent, which you can withdraw at any time |
We do not use your personal data to make automated decisions that produce legal or similarly significant effects about you.
6. Data security
We apply technical and organisational measures appropriate to the data we hold:
- Encryption in transit: all traffic between your browser and our servers uses SSL/TLS
- Payment security: we never store your card details, not even in part. Card numbers are entered directly into a secure form hosted by Stripe, our PCI-DSS compliant payment provider, and are never transmitted to, processed by, or stored on our servers. We receive only confirmation that a payment succeeded, and a reference number.
- Access controls: customer records are restricted to staff who need them for their role, and access is enforced by the system rather than by convention
- Private file storage: bag photographs and uploaded documents are held in private storage that requires an authorised, time-limited link - they are not publicly reachable by URL
- Automatic deletion: data with a defined lifetime is removed on a schedule rather than by hand
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your rights, we will notify you and the relevant authority as required by law.
7. How long we keep your data
| Data | Kept for |
|---|---|
| Luggage bag photographs | 3 days after your expected checkout, then deleted automatically |
| Booking and payment records | 7 years, as required for accounting and tax purposes |
| Account details | Until you ask us to delete your account |
| Marketing preferences | Until you unsubscribe or object |
| CCTV footage | Up to 60 days, then overwritten automatically. Recordings are held on a fixed-size system that overwrites the oldest footage first, so in practice most is overwritten sooner - 60 days is the maximum, never a target. |
| Technical logs | Typically 90 days |
Where we must keep a booking record for tax purposes, we keep only what that obligation requires, even if you have asked us to delete your account.
8. Your rights
You can ask us to:
- Access - give you a copy of the personal data we hold about you
- Correct - fix data that is inaccurate or incomplete
- Delete - erase your data, where we are not legally required to keep it
- Restrict or object - stop or limit a particular use, including analytics and marketing
- Port - provide your data in a portable format, or send it to another provider
- Withdraw consent - for anything you consented to, at any time, without affecting what we did beforehand
Contact us using the details in section 12. We respond within 30 days. There is no charge, and we may ask you to confirm your identity first so we do not hand your data to someone else.
If you are unhappy with how we handled your request, you may complain to Thailand's Personal Data Protection Committee, or - where the GDPR applies to you - to the data protection authority where you live.
9. International data transfers
We are based in Thailand, and several of our providers (including Supabase, Stripe, Vercel and Google) operate infrastructure outside Thailand. Your data may therefore be transferred to and processed in other countries.
Where that happens we rely on providers who commit to recognised safeguards for international transfers, such as the European Commission's Standard Contractual Clauses, so that your data keeps an equivalent level of protection.
10. Children's privacy
Our website and booking service are intended for adults. We do not knowingly collect personal data directly from children.
Children frequently take part in our tours as part of a family booking. In that case the booking is made by a parent or guardian, who provides the child's details (such as name and age, where an activity has age or safety requirements) and is responsible for that consent. If you believe a child has provided us data directly, please contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. We will post the new version on this page and update the date below. Where a change materially affects your rights, we will take reasonable steps to tell you directly.
12. Contact us
For any question about this policy, or to exercise any of the rights in section 8:
Malloo Holiday (ChiangMai-Tours.com)
EVERLASTX CO., LTD., registered company no. 0505568008596
Office: The Astra Condo & Astra Sky River, Chiang Mai, Thailand
Email: Available on our contact page
Phone: Available on our contact page
See also our Terms & Conditions and Imprint.
Last updated: August 2026. This revision names the registered company acting as data controller in section 1.
By using our services, you acknowledge that you have read and understood this Privacy Policy.