Legal · Loft Thai Spa
Privacy Policy
How we collect, protect and respect your personal data across our three Bangkok spa locations — in line with the Thai Personal Data Protection Act.
01 · Identity
Who We Are
This Privacy Policy explains how Loft Thai Spa & Wellness (“Loft Thai Spa”, “we”, “us” or “our”) collects, uses, stores, discloses and protects personal data. For the purposes of the Thai Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”), Loft Thai Spa acts as the data controller in respect of the personal data described below.
We operate three spa locations in Bangkok, Thailand:
- Loft Thai Spa Sukhumvit 24 — Phrom Phong, Bangkok
- Loft Thai Spa Sukhumvit 38 — Thong Lo, Bangkok
- Loft Thai Spa Sukhumvit 71 — Phra Khanong, Bangkok
This policy applies to our websites, online booking systems, messaging channels (including WhatsApp and LINE), telephone enquiries and all services provided at our premises.
02 · Scope
Scope & Acceptance
By accessing our website, submitting a booking or enquiry, communicating with us through any channel, or attending any of our premises, you acknowledge that you have read and understood this Privacy Policy.
Where we require your consent under the PDPA, that consent will be requested separately and explicitly, and may be withdrawn at any time as described in Your PDPA Rights.
If you do not agree with this Privacy Policy, please do not use our website or services. Continued use following any update constitutes acknowledgement of the revised policy.
03 · Collection
Information We Collect
We collect only the personal data reasonably necessary for the purposes set out in this policy. Depending on how you interact with us, this may include:
- Identity & contact data — name, email address, telephone number, and preferred language or location
- Booking data — treatments selected, appointment date, time, duration, branch, therapist preference and booking history
- Payment data — processed exclusively by our third-party payment providers. We do not store full card numbers, CVV codes or complete banking credentials on our systems
- Health & wellness data — as described in Health & Treatment Data below
- Communication records — messages, enquiries and correspondence exchanged via WhatsApp, LINE, email, telephone, online forms or social media
- Technical & usage data — IP address, browser type, device identifiers, operating system, referring pages, pages viewed and interaction data collected through cookies and analytics tools
- Marketing preferences — your consent status and opt-in or opt-out choices
- CCTV footage — as described in CCTV & Premises below
- Feedback & reviews — comments, ratings and testimonials you voluntarily provide
You are responsible for ensuring that any personal data you provide is accurate, current and lawfully supplied. If you provide personal data relating to another person (for example when booking a couples treatment or a gift voucher), you confirm that you have obtained that person’s consent to share their data with us for that purpose.
04 · Sensitive Data
Health & Treatment Data
Certain treatments require us to ask about your physical condition so that our therapists can deliver your treatment safely. This may include information about allergies, injuries, skin sensitivities, recent surgery, pregnancy, cardiovascular conditions, or other medical circumstances relevant to massage and spa therapy.
Under the PDPA, health information is sensitive personal data. We therefore:
- Collect it only with your explicit consent, given at the time of your consultation or booking
- Use it solely to assess treatment suitability, adapt techniques, pressure or products, and protect your safety and that of our therapists
- Restrict access to the therapist and supervisory staff directly involved in your treatment
- Never use health data for marketing, profiling or any commercial purpose
Important — your responsibility. Our services are wellness and relaxation treatments. They are not medical treatment, diagnosis or therapy and are not a substitute for professional medical advice. You are responsible for disclosing, accurately and in full, any condition that could affect your suitability for a treatment. Loft Thai Spa relies on the information you provide and accepts no liability for any consequence arising from information that is withheld, incomplete or inaccurate. If you have any medical concern, please consult a qualified physician before booking.
You may decline to provide health information; however, we reserve the right to refuse or modify a treatment where we consider, at our sole discretion, that it cannot be performed safely.
05 · Lawfulness
Legal Basis for Processing
We process personal data only where a lawful basis under the PDPA applies:
- Contractual necessity — to confirm, manage and deliver the booking or service you have requested
- Consent — for health data, marketing communications and non-essential cookies. Consent may be withdrawn at any time
- Legal obligation — to comply with Thai tax, accounting, public health and other statutory requirements
- Legitimate interest — to secure our premises, prevent fraud or abuse, improve our services, and establish, exercise or defend legal claims, provided such interest is not overridden by your fundamental rights
- Vital interest — where processing is necessary to prevent or suppress a danger to a person’s life, body or health
06 · Usage
How We Use Your Information
Your personal data is used for the following purposes only:
- Confirming, amending, rescheduling and managing your spa reservations
- Sending appointment confirmations, reminders and service-related notifications
- Delivering treatments safely and to the standard you expect
- Processing payments, issuing receipts, invoices and gift vouchers
- Responding to enquiries, feedback, requests and complaints
- Operating loyalty, promotional or gift voucher programmes you have joined
- Improving our website, service quality and guest experience through aggregated analytics
- Maintaining the security of our premises, staff and guests
- Complying with legal, regulatory, tax and accounting obligations under Thai law
- Establishing, exercising or defending legal claims
We do not sell, rent, trade or otherwise commercially exploit your personal data. We do not share your data with third parties for their own independent marketing purposes.
09 · Transfers
International Transfers
Some of our service providers — including cloud hosting, analytics and messaging platforms — may store or process data on servers located outside Thailand. Where personal data is transferred abroad, we take reasonable steps to ensure it benefits from an adequate standard of protection, or that an exception permitted under the PDPA applies (such as your explicit consent or the necessity of performing a contract with you).
10 · Retention
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax or reporting obligations, and to resolve disputes or enforce agreements.
- Booking and guest records — retained for the duration of the relationship and for a reasonable period thereafter to support returning guests and legal requirements
- Financial and transaction records — retained for the period required by Thai tax and accounting law
- Health and treatment notes — retained only while relevant to your ongoing care, then deleted or anonymised
- CCTV footage — retained for a short period as described in CCTV & Premises, unless required for an incident or investigation
- Marketing data — retained until you withdraw consent or opt out
When data is no longer required, it is securely deleted, destroyed or irreversibly anonymised.
11 · Security
Data Security
Loft Thai Spa applies reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss or disclosure:
- Website and booking traffic transmitted over HTTPS encrypted connections
- Access to personal data restricted to authorised personnel on a need-to-know basis
- Confidentiality obligations imposed on staff and service providers
- Payment processing delegated to established third-party providers
- Periodic review of our data handling and retention practices
No absolute guarantee. While we take data protection seriously, no method of transmission over the internet or electronic storage is completely secure. We cannot and do not warrant absolute security, and — to the maximum extent permitted by law — we accept no liability for unauthorised access, interception or disclosure occurring despite the implementation of reasonable safeguards, or resulting from factors outside our reasonable control. You are responsible for keeping any account or booking credentials confidential.
In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify the Office of the Personal Data Protection Committee and affected individuals as required by the PDPA.
12 · Premises
CCTV & Premises Monitoring
For the safety and security of our guests, staff and property, CCTV cameras operate in public and common areas only — such as entrances, reception and corridors.
- Cameras are never installed in treatment rooms, changing areas, showers or toilets
- Footage is used solely for security, incident investigation, and the protection of legal rights
- Access is restricted to authorised management personnel
- Footage is retained for a limited period and then automatically overwritten, unless it is required for an ongoing incident, insurance claim or legal proceeding
13 · Communications
Messaging & Marketing
When you contact us through WhatsApp, LINE, email or social media, the content of your messages is processed to answer your enquiry and manage your booking. Please note that these platforms are operated by third parties and are subject to their own privacy policies and security standards, which we do not control.
We may send you promotional messages about treatments, packages and seasonal offers only where you have consented. You may withdraw that consent at any time by replying “STOP”, using the unsubscribe link, or contacting us directly. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and we will continue to send essential service messages such as booking confirmations.
Please do not send sensitive personal, medical or payment information through public messaging channels or social media.
14 · Your Rights
Your Rights Under PDPA
Under the Thai Personal Data Protection Act, and subject to the conditions and exemptions it provides, you have the right to:
Access
Request a copy of the personal data we hold about you.
Correct
Ask us to fix inaccurate, incomplete or outdated data.
Delete
Request erasure or anonymisation when data is no longer needed.
Withdraw
Revoke your consent at any time, free of charge.
Object
Object to certain processing, including direct marketing.
Restrict
Ask us to suspend the use of your data in specific cases.
Portability
Receive certain data in a commonly used electronic format.
Complain
Lodge a complaint with the Thai data protection authority.
To exercise any of these rights, email us at [email protected]. To protect your privacy, we may ask you to verify your identity before acting on a request. We aim to respond within the period prescribed by the PDPA.
Certain requests may be refused or limited where permitted by law — for example where retention is required by statute, or where the data is necessary for the establishment, exercise or defence of legal claims. Where we refuse a request, we will record and explain the reason.
15 · Minors
Minors
Our website and services are directed at adults. We do not knowingly collect personal data from minors without the consent of a parent or legal guardian where such consent is required by law.
Treatments for guests under the age of 18 require the consent and, where appropriate, the presence of a parent or legal guardian. If you believe a minor has provided us with personal data without proper consent, please contact us and we will take reasonable steps to delete it.
16 · External Services
Third-Party Links & Services
Our website and messages may contain links to third-party websites, booking platforms, review sites, maps and social media. These are provided for convenience only.
We do not control and are not responsible for the content, privacy practices, security or availability of any third-party site or service. Accessing them is at your own risk and subject to their own terms and privacy policies. We recommend that you review those policies before submitting any personal data.
17 · Liability
Limitation of Liability
To the maximum extent permitted by applicable Thai law:
- Our website and its content are provided on an “as is” and “as available” basis, without warranty of any kind, whether express or implied
- We do not warrant that the website will be uninterrupted, error-free, or free of viruses or other harmful components
- We accept no liability for indirect, incidental, special, consequential or punitive damages, or for any loss of profit, revenue, data or goodwill, arising from your use of our website or services
- We accept no liability for loss or damage arising from inaccurate, incomplete or withheld information supplied by you, including health information
- We accept no liability for failures or delays caused by events beyond our reasonable control, including network failures, third-party platform outages, acts of government, or force majeure
Nothing in this policy excludes or limits any liability that cannot lawfully be excluded or limited under Thai law.
18 · Updates
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal and regulatory requirements. The revised version takes effect when published on this page, and the “Last updated” date shown alongside this policy will be amended accordingly.
We encourage you to review this page periodically. Where a change is material, we will take reasonable steps to notify you.
19 · Jurisdiction
Governing Law & Jurisdiction
This Privacy Policy, and any dispute or claim arising out of or in connection with it or its subject matter, is governed by and construed in accordance with the laws of the Kingdom of Thailand, without regard to conflict-of-law principles.
You agree that the courts of Thailand shall have exclusive jurisdiction to settle any such dispute or claim. If any provision of this policy is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
In case of any discrepancy between this English version and any translation, the English version shall prevail unless Thai law requires otherwise.
20 · Contact
Contact Us
For any question, request or complaint regarding this Privacy Policy or the way we handle your personal data, please contact us:
- Email — [email protected]
- Telephone — +66 63 487 2308
- Locations — Sukhumvit 24, Sukhumvit 38 and Sukhumvit 71, Bangkok, Thailand
Questions about your data?
Talk to us directly
Our team is here to answer any questions about how we handle your personal information. Reach out — we respond quickly.