Privacy Policy | Phi Phi Tours

1.Information we collect

When you book a tour

Lead contact: first and last name, email address, phone number and nationality.
Passengers: the name of each traveller and their age or, for some tours, date of birth. This includes children travelling with you; please only give us details of people you are booking for.
Pickup: your type of accommodation and its name, and a room number if you give one.
Your trip: the tour, date, number of guests, options you choose (such as a lunch preference) and any note you add for us.
Payment: the method you choose, the amount, and a payment reference and status from the payment provider. We don't see or store your full card number (see section 3).

Checkout details are saved as you type, before you press pay, so they aren't lost if the page reloads or a payment fails. If you leave without booking, we use what was entered only to understand where people have trouble with our checkout and to help you if you contact us about it.

When you create an account

Your name, email address and password, and optionally your phone number. Passwords are stored by our authentication provider in hashed form, never in readable text, and it keeps sign-in records (including IP address) for security. We show bookings made with your account's email address in My Account.

When you contact us or sign up

Enquiries and tour requests: your name and email, plus whatever you tell us about your trip, such as group size, dates, places, activities and budget.
Newsletter and offers: your email address and the month you plan to travel.
Customer requests: when you ask to cancel or change a booking from My Account, your request and any reason you give.
Messages: anything you send us by email or WhatsApp, along with your email address or phone number.

When you apply for a job

Your name, email address, phone number, age and nationality, the role you're applying for, your CV, and your cover letter (typed, uploaded or as a link).

Collected automatically

When you add a tour to your cart: your device type, browser language, and your approximate city and country, which our hosting provider works out from your IP address. We don't store the IP address itself.
Website analytics: page views and visit statistics through Vercel Web Analytics. It doesn't use cookies, and the statistics are aggregated, so they don't identify you.
Advertising measurement: the Google Ads tag, which uses cookies to tell us when a visit from one of our Google ads leads to a booking (see section 5).

Sensitive information

We don't ask for health or other sensitive information. Some choices, such as a vegetarian or halal lunch, may hint at it. If you tell us about a medical condition, allergy or accessibility need in a note or message, we use it only to arrange your tour safely and share it only with the operator running your trip.

2.How we use your information

We use your personal data for these purposes, each with a lawful basis under the PDPA:

To arrange and run your booking, including pickups, confirmations, tickets, changes, cancellations and refunds, and to contact you about your trip (for example, weather changes). Basis: performing our contract with you.
To answer enquiries and support you before, during and after your trip. Basis: steps you ask us to take before a contract, and our contract with you.
To keep records for accounting, tax, and our tourism licence. Basis: legal obligation.
To prevent fraud and handle payment disputes, such as card chargebacks. Basis: legitimate interests and legal obligation.
To improve our website and checkout, including understanding where people stop when booking. Basis: legitimate interests.
To measure our advertising through the Google Ads tag. Basis: legitimate interests.
To send offers and news (see section 6). Basis: your consent when you sign up, or, for past customers, our legitimate interest in telling you about similar tours, which you can opt out of at any time.
To consider job applications. Basis: steps you ask us to take before an employment contract.

3.Who we share it with

We never sell your personal data. We share it only where needed for the purposes above:

The tour operator running your trip. We send the operator your booking: lead name, nationality and phone number, passenger names and ages, pickup details, and any note. We send it by message (including LINE), by email, or directly into the operator's booking system. Operators use it to run your tour, check you in, and arrange the insurance that comes with your tour, which is why you're asked to show ID at check-in.
Five Star Thailand Tours, our sister brand, which operates some of the private tours we sell. It receives the booking details of those tours only.
Payment providers. Card payments are handled by Omise (Opn Payments). Your card details go from your browser straight to Omise and never reach our servers. PayPal payments are handled by PayPal. Each processes your payment under its own privacy policy.
Services that run our business, which process data only on our instructions:
- Supabase: database, file storage and account sign-in
- Vercel: website hosting and Web Analytics
- Resend: sending our emails
- Google: our internal bookings calendar, and the Google Ads tag
- LINE: messages to our team and tour operators
- respond.io and WhatsApp: managing customer chats
Authorities and banks, when the law requires it, or to deal with a payment dispute or claim.
A buyer or successor, if all or part of our business is ever sold or reorganised. They would remain bound by this policy.

4.International transfers

Several of the services above (Supabase, Vercel, Resend, Google, PayPal, LINE and respond.io) store or process data outside Thailand, in countries including the United States and Japan. When your data is transferred, we rely on these providers' data protection commitments and security measures, or on the transfer being necessary to provide the service you asked for, as the PDPA allows.

5.Cookies and similar technologies

Sign-in cookies keep you logged in to your account. They are essential for the account to work.
Cart cookie (ppt_cart_visitor_id): when you add a tour to your cart, we store a random code that lets us see when several carts come from the same browser. It holds nothing about you and expires after one year.
Preferences: your light or dark mode choice is saved in your browser.
Google Ads cookies are set by Google to measure whether our ads lead to bookings. When you book, the tag reports the booking value and a booking reference to Google, but not your name or contact details. Google handles this data under its own policies. You can manage ad personalisation at adssettings.google.com.

You can block or delete cookies in your browser's settings. If you block sign-in cookies, you won't be able to use My Account, but you can still book.

6.Offers and newsletters

If you sign up on our website, we'll email you offers and travel ideas. If you have booked with us, we may also occasionally email you about similar tours. You can opt out at any time by emailing info@phiphitours.com or replying to any of our emails, and we'll stop. Opting out doesn't affect emails about a booking you've made.

7.Security and retention

Security. Our website uses HTTPS encryption. Access to booking data is limited to staff who need it, and passwords are stored only in hashed form.
Retention. We keep personal data only as long as we need it for the purposes in this policy, for example while your booking is active and for any later questions, refunds or disputes. We keep booking and payment records for as long as Thai accounting and tax law requires. You can ask us to delete your data sooner where the law allows (see section 8).

8.Your rights

Under the PDPA you have the right to:

access your personal data and get a copy of it;
receive your data in a commonly used format, or have it sent to another organisation where possible;
have inaccurate or incomplete data corrected;
ask us to delete or anonymise your data;
ask us to restrict how we use it;
object to how we use it, including at any time for marketing;
withdraw consent you have given, without affecting what we did before; and
complain to the Office of the Personal Data Protection Committee (PDPC) if you think we have handled your data unlawfully.

You can update your name and phone number yourself in My Account. For anything else, email info@phiphitours.com. We may need to confirm your identity first, and we'll reply within 30 days. Some requests are limited by law: for example, we must keep booking and payment records for accounting purposes.

9.Children

Bookings must be made by an adult. We collect children's names and ages or dates of birth only from the adult booking for them, and only to arrange the tour.

10.Changes to this policy

We update this policy when our practices change. The latest version is always on this page, with the date it was last updated at the top.

11.Contact us

For questions about this policy or your data, email info@phiphitours.com or write to Five Star Group (Thailand) Co., Ltd., 125/39 Moo 7, Phi Phi Island, Tambol Ao-Nang, Krabi 81210, Thailand.