Privacy Policy

Karni Digital Solutions Co., Ltd., the operator of BookMyThai.com (company registration no. 0205566041017), is the data controller for personal data processed through the website, our apps and our support channels. Our contact details are shown above. For any privacy request, write to us from the email used for your booking or account and include your booking code if you have one.

Account and booking data: name, email, phone, nationality, and — where a supplier requires it — passport number and date of birth of each traveller. Trip data: dates, pickup hotel, flight number, special requests. Payment data: amount, currency, payment rail and the token or reference returned by the payment provider. We never store full card numbers. Technical data: IP address, device and browser type, language, pages viewed, and cookies needed to keep you signed in and remember currency, city and an invite code.

To perform the booking contract: issue vouchers, pass traveller names to the hotel, operator or driver, send confirmations and reminders, handle changes, cancellations and refunds. To meet legal duties: tax receipts, accounting, anti-fraud, and lawful requests from Thai authorities. Legitimate interests: securing the platform, preventing abuse, improving the service, and sending service messages about a trip you booked. Consent: marketing emails, optional review requests and non-essential cookies — you can withdraw at any time.

The supplier of the product you book (hotel, tour operator, transfer company, yacht operator) receives the traveller details needed to deliver it. Payment processors (Omise, Stripe, Razorpay — depending on the rail you choose) process your payment under their own privacy terms. Service providers acting for us: email delivery, photo/CDN hosting, database and server hosting. Authorities where the law requires. We do not sell personal data.

Some providers (payment, email, hosting) may process data outside Thailand. Where that happens we rely on the provider’s contractual safeguards and, where required by the PDPA, your consent at the point of collection. Traveller names go only to the supplier of your booking, who is in Thailand.

Booking, payment and tax-receipt records: up to 10 years, as Thai accounting and tax law requires. Account data: for as long as your account is active, then deleted or anonymised within 90 days of a deletion request unless a legal hold applies. Saved travellers, wishlist and notifications: until you remove them or close the account. Technical logs: up to 12 months.

You may ask to access, receive a copy of, correct, delete or restrict your personal data; object to processing; withdraw consent; and receive data you gave us in a portable format. Sign in and use Profile & security, Saved travellers and Notifications to manage most data yourself. For anything else, email us with your booking code or account email. We answer within 30 days. You may also complain to the Personal Data Protection Committee (PDPC) of Thailand.

Essential cookies keep you signed in, protect forms, and remember your language, currency and city. An invite-link cookie remembers who invited you for 30 days so your friend can be credited after your first trip. We do not run third-party advertising trackers. Payment providers may set their own cookies inside their checkout frames.

Traffic is encrypted (HTTPS). Passwords are hashed, staff access is role-based with two-factor for privileged roles, and every desk action is written to an audit log. Card data goes directly to the payment provider and is not stored by us. No system is perfectly secure; if a breach affects you we will notify you and the PDPC as the law requires.

Bookings must be made by an adult (20+ under Thai law). Child travellers’ names, ages or dates of birth are collected only from the booking adult, only where the supplier needs them for tickets, seats or safety.

If you list a property, act as a trade agent or join as a creator, we hold your company, contact, licence and bank details to run the partnership, pay you and meet tax duties. Partner terms describe this in more detail. Bank details are visible only to finance roles on our desk.

We may update this policy when our services or the law change. The date at the top shows the latest version. Material changes are announced on the website or by email.