Privacy Policy

Cabanas Koh Samui beach club (Lub d Co.,Ltd) and its affiliates include persons involved in the processing of personal data on orders or on behalf of the Company (hereinafter referred to as the “Company”) is committed to protecting the privacy of users, partners, and business partners (hereinafter referred to as the “you” or “data subject”) from collecting, using and/or disclosing (hereinafter referred to as the “Data Processing”) in accordance with the Personal Data Protection Act B.E. 2562. As a result, the Company is providing this notice to notify users of their rights and obligations, as well as the terms and conditions for collecting, using, and disclosing personal data:

 Personal data
“Personal data” means an individual data which allows to be identified directly or indirectly but does not include information on a specific deceased person.
“Sensitive data” means Personal data such as race, ethnicity, political viewpoints, cult, religious, or philosophical beliefs, sexual conduct, criminal background, health information, disability, trade union information, genetic information, and biological information such as face, iris, or fingerprint is collected.

Personal data collected by the company

The Company will collect and save personal data using lawful methods and only to the degree necessary for the Company’s operational purposes, such as:

– Personal data: title, name-surname, age, gender, date of birth, identification number, passport number, driver’s license number, signature, copy of ID card, house registration, marital status, position, occupation, history work or other official documents that can be identified, etc.
– Contact data: address, phone number, e-mail, etc.
– Government documents data: Copy of ID card, copy of house registration, copy of passport, alien identification number, arrival-departure ticket (T.M.6) etc.
– Financial data: Copy of bank account page, credit card information, etc.
– Data collected by the Company or its automated systems from various devices of the Company: IP Address, Cookie, Service Behavior, Service History, Voice, Photo, Motion, social media, Chat, Geolocation, etc.

The Company will collect personal data with the prior consent of the personal data subject except in the following cases:

1. To perform the contract in the case of collecting, using or disclosing personal data for the necessity of providing services or contracts between the data subject and the Company.
   2. To prevent or suppress harm to life, body or health.
   3. To obey the law.
   4. To the legitimate interests of the Company if necessary for the legitimate interests of the Company’s operations. The Company will consider the rights of the data subject as important. For example, fraud prevention, network security, protection of the rights, freedoms and interests of all data subjects, etc.
   5. To conduct research or statistics in the case of historical documents or archives for the public benefit or related to research studies or statistics in order to provide appropriate safeguards to protect the rights and freedoms of data subjects.
   6. To perform state missions if necessary for the performance of duties for the public interest or the performance of duties under the state powers assigned by the Company.

Sensitive data
The Company may be required to collect sensitive information such as race, medical information, disability information, religion, biometric information. The Company will always seek your consent for collection, use and/or disclosure, unless:

1. To avoid or eliminate a threat to a person’s life, body, or health.
   2. It is a legitimate activity with appropriate protections of a foundation, association or non-profit organization with political, religious, philosophical, or trade union objectives for members, former members or regular contacts with foundations, associations or non-profit organizations for such purposes without disclosing that personal data.
   3. Information that is made public with the explicit consent of the individual whose personal data is being processed.
   4. It is necessary for the establishment of a statutory claim, the performance or exercise of a statutory claim, or the assertion of a statutory claim.
   5. It is imperative to comply with the law to achieve objectives regarding:
   – Preventive or occupational medicine, employee competency assessment, medical diagnosis, health or social services, medical treatment, health management or social work system.
   – Public health benefits such as health protection from dangerous communicable diseases or epidemics.
   – Labor protection, social security, national health insurance, medical benefits for legal persons, protection of motor vehicle victims or social protection.
   – Scientific, historical or statistical research or other public interest.
   – Important public interest.

Data source
1. Information directly from the data subject that you have provided in the activities. for example, entering a service, answering a questionnaire, subscribing to information, participating in marketing activities through a website, application or other, entering and exiting the Company, organizing training, procurement, e-mail countermeasures or filling in/submission of information to apply for a job or other between the Company and you.
2. Information from relevant third parties such as relatives, family members.
3. Information from automated systems such as CCTV footage, application data, and information from medical devices.
4. Information from other sources such as public information, information from partner agencies, government agencies or affiliates, as well as other personal information provided.

Purpose of processing personal data
The Company may use personal information for the following purposes or for other purposes while collecting information or obtaining your consent after the Company collects the information.

1. To enter into a contract or perform duties under a contract between the Company and the data subject or a contract between the Company and a third party for the benefit of the data subject.
   2. To verify, authenticate and verify customer information when using the Company’s services or exercising legal rights.
   3. To provide information and recommend products, services or public relations for marketing promotions or benefits through contact channels provided by the data subject.
   4. To deliver products and provide services to meet various needs or complaints.
   5. To evaluate and improve the business to improve the quality of products and services.
   6. To carry out accounting and financial activities such as auditing, invoicing and collection, issuing tax invoices and proof of transactions required by law.
   7. To be beneficial according to the Company’s law, such as recording complaints through the Call Center system, recording images through CCTV cameras, recording in-out within the Company.
   8. To abide by the rules and regulations of the Company.
   9. To apply for a job as an employee and/or for any other related purposes.
   10. To investigate and comply with the laws, regulations or legal duties of the Company.
   11. To respond to your requests such as after-sales service, complaint handling.
   12. To facilitate and offer various benefits to service users.
   13. To perform marketing, promotional and customer relationship purposes such as sending promotional information, products and services, promotional items and affiliate businesses.
   14. Customer satisfaction surveys, market research and statistical analysis to improve products and services or innovate new products and services.
   15. Other purposes with your express consent.

Personal data transfer and disclosure
The Company will not disclose and transmit your personal information to external parties unless with your explicit consent or in the following cases:

1. Business partners and business partners.
   2. Agents or partners who provide services to the Company or on behalf of the Company such as transport service providers, document storage and destruction service providers, marketing activities and advertising media contractors, developers and administrators of security and information technology systems, auditors, lawyers, legal or tax advisors, etc.
   3. Business partners.
   4. Banks and payment service providers such as credit or debit card companies, etc.

In this regard, the Company will provide a personal data processing agreement as required by law.

In order to achieve the purposes outlined in this Privacy Policy, the Company may be required to disclose or share information only as necessary to the following partners, service providers or external entities:
– The Company may disclose or share personal information with its affiliates only for the purposes stated in this Privacy Policy.
– The law or legal process requires disclosure or disclosure to an official, government official or competent authority in order to comply with a legal order or request.

 Transferring or sending data to foreign countries
In some cases, the Company may send the recipient’s information to foreign countries such as in the case of the Company communicating with service recipients or external agencies located abroad. If one of the following circumstances is met, the Company will send the recipient’s information abroad in either way:

1. The destination country has been determined by the Personal Data Protection Board that there is adequate personal data protection.
   2. Foreign entities are subject to a personal data protection policy that has been reviewed and certified by the Office of the Personal Data Protection Commission.
   3. The Company and foreign agencies can put in place appropriate personal data protection measures to enforce the rights of the personal data subject. It includes effective legal remedies in accordance with the rules and procedures announced by the Personal Data Protection Commission. For example, standard contract clauses, codes of practice, certified standards, etc.
   4. It is necessary for the exercise of legal rights.
   5. You are aware of inadequate personal protection standards of the destination country or international organization that has received personal data.
   6. It is necessary for the performance of the contract to which you are the party or for your request before entering into that contract.
   7. It is an action under a contract between the Company and another person or juristic person for your benefit.
   8. To prevent or suppress harm to the life, body, or health of you or others when you are unable to give consent at that time.
   9. It is necessary for the mission of the important public interest.

Protection of personal data
The Company has established and/or used a personal data storage system with appropriate mechanisms and techniques, as well as security measures in accordance with the law on personal data protection and related laws. It includes restricting access to your personal information from employees, employees and agents of the

Company to prevent your personal information from being disclosed, destroyed or accessed without permission.

 Collection period
The Company will only collect your personal data for as long as it is necessary for the processing for the purposes of this policy unless it is necessary to keep personal data for any other reason. For example, in order to comply with the law or investigate cases of disputes, the Company may be required to retain information for longer than specified periods.

 Privacy policy changes
The Company may amend this Privacy Policy by posting it on https://www.cabanas.live/ with the date of the last amendment. The company recommends that you review this policy regularly. Your continued use of the products or services on the Company’s website after the Privacy Policy has been changed will constitute your acceptance of the changed policy.

 Rights of personal data subject
You can exercise the rights as required by law and as set forth in this notice as follows:

1. Right to withdraw consent, you have the right to withdraw your consent at any time unless restricted by law or contractually beneficial to you. However, the withdrawal of consent will not affect the processing of personal data that you have previously given consent to the Company.
   2. The right to request access and obtain a copy of personal data, unless the company has the right to refuse your request by law or court order or your request will have consequences that may harm the rights and freedoms of others.
   3. The right to request that personal information be updated, correct, complete and not cause misunderstanding. However, the Company can amend the above even if you do not request it.
   4. The right to request removal or removal or non-identification of an individual in the following cases:
   1. When personal data is no longer necessary keep it for the purposes of collecting, using or disclosing personal data.
   2. When you withdraw your consent to the collection, use or disclosure of personal information and the Company has no legal authority to collect, use or disclose personal information further.
   3. When you object to the collection, use or disclosure of personal data and the Company has no legal authority to refuse it, unless the Company has legitimate grounds to decline your request.
   5. The right to obtain or request the transmission or transfer of your personal data in the event that the Company has made the personal data in a readable or generally usable format by means of automated tools or equipment to use or disclose personal information by automatic means unless the technical condition is impracticable or for the benefit of the public or statutory duty or the exercise of infringement against the rights or freedoms of others.
   6. Right to objection, you have the right to object to the collection, use or disclosure of personal data at any time in the following cases:
   7. The right to request that the use of personal data be restricted in the following circumstances:
   1. When the Company is in the process of reviewing your request to amend your personal data to be accurate, current, complete and not cause misunderstandings.
   2. Personal data that must be deleted or destroyed.
   3. When such personal data is no longer necessary because you are obliged to request the retention of your personal data in order to establish a legal claim, compliance or exercising legal claims or countering legal claims.
   4. When the Company is in the process of proving its right to refuse a request to object to the collection, use or disclosure of personal data.

If the company violates or fails to comply with any regulations, you have the right to notify the expert committee under the Personal Data Protection Act B.E. 2562. If you have any questions or would like to correct, delete the data, exercise your rights or make any other contact regarding your data, please inform us through the contact channels below.

Cabanas Koh Samui beach club (Lub d Co., Ltd.)
No. 224, Room 6, Floor 1 and Floor 2, Silom Road Suriyawong Sub-district, Bang Rak District, Bangkok 10500
Tel: 02-635-7373
Fax: 02-635-7373
E-mail: dpo@marasca.live

*Please provide the following additional information for the exercise of the rights of the data subject.*

– Name-surname, ID card number/passport number
– Inquiries about personal data or legal rights
– Phone number, address, and e-mail address that can be contacted back.

This privacy notice will come into effect on the 1st of July, 2024.