Who controls your data
The data controller is Access Transit Express, Bangkok, Thailand . Data-protection enquiries go to privacy@accesstransitexpress.com.
What we collect
When you make a booking
- Name of the lead traveller, and the names of other travellers where a supplier or a national park requires a manifest.
- Email address and mobile or WhatsApp number.
- Country of residence.
- Hotel or pick-up address, room number, drop-off address.
- Flight number and airline, where the booking involves an airport.
- The experience, date, option and party size booked, and the amount paid.
- Anything you volunteer in the special-requests field — which may include health or dietary information.
When you contact us
- Your name, email address, phone number if you give one, and the content of your message.
Automatically, when you use this site
- IP address, browser and device type, and the pages you visited, held in server logs.
- Approximate country, derived from the IP address by our hosting provider.
- A cookieless page-view count via Cloudflare Web Analytics — no identifier, nothing stored on your device. See the cookie policy.
- Cart, wishlist and currency preference — stored in your own browser, not sent to us.
What we never collect
Card numbers, expiry dates and security codes. Payment is processed on our payment provider's own hosted page. That data never enters, transits or rests on our systems. We receive only a payment reference, the amount, the result, and the last four digits for reconciliation.
Why we process it, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Taking and fulfilling your booking | Contact details, travel details, payment reference | Performance of a contract (PDPA s.24(3); GDPR Art. 6(1)(b)) |
| Passing details to the operating supplier | Names, party size, pick-up address, flight number | Performance of a contract |
| Meeting safety and dietary needs you tell us about | Health and dietary information you volunteer | Explicit consent (PDPA s.26; GDPR Art. 9(2)(a)) — you may withdraw it, though we may then be unable to run the trip safely |
| Answering enquiries and complaints | Contact details and message content | Legitimate interests — running a business that answers its customers |
| Fraud prevention and payment-dispute defence | IP address, device, order details, correspondence | Legitimate interests, and legal obligation where a scheme requires evidence |
| Accounting, tax and statutory record-keeping | Invoice and transaction records | Legal obligation (Thai Revenue Code) |
| Analytics, if you accept analytics cookies | Pages visited, device type | Consent — withdrawable at any time |
We do not sell personal data, and we do not send marketing email unless you have specifically asked for it.
Who we share it with
- Operating suppliers — the boat operator, transfer company, guide or airport handler performing your booking. They receive only what they need to deliver it: names, party size, meeting point, flight number, and any safety-relevant requirement you told us about.
- Airport authorities and national park offices, where a manifest or a named pass is a condition of entry.
- Our payment service provider, which processes the payment and holds the card data we never see.
- Our hosting and email providers, acting as processors under contract.
- Professional advisers, auditors and authorities, where we are legally required to disclose.
Every processor is bound by contract to use the data only on our instructions and to keep it secure.
International transfers
We are based in Thailand. Our website is served from a global content-delivery network, and some processors operate outside Thailand and outside the EEA. Where personal data leaves Thailand or the EEA we rely on the safeguards permitted under PDPA s.28–29 and, for EEA and UK data, on Standard Contractual Clauses or an adequacy decision.
How long we keep it
| Record | Retention |
|---|---|
| Booking and transaction records | 10 years, as required by the Thai Revenue Code |
| Special-requests text, including health information | Deleted 90 days after the travel date |
| Enquiries and correspondence | 24 months from the last message |
| Server access logs | 30 days |
| Analytics data, where consented | 14 months |
| Cart, wishlist, currency and consent choice | In your browser only, until you clear it |
Your rights
Under the PDPA and, where it applies, the GDPR, you may:
- ask what we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased, where we have no overriding legal obligation to keep it;
- ask us to restrict processing while a dispute is resolved;
- object to processing based on legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting anything done before you withdrew it.
Write to privacy@accesstransitexpress.com. We respond within 30 days, free of charge. We will ask you to verify your identity before we release anything — usually by replying from the email address on the booking.
How we protect it
- TLS 1.3 encryption on every page and every form on this site.
- Booking records encrypted at rest, in access-controlled storage.
- Access limited to the operations staff who need it, on named accounts with multi-factor authentication.
- No card data on our systems at any point — see the payment security statement.
- Supplier contracts requiring confidentiality and deletion after the travel date.
If a breach occurs that is likely to affect your rights, we will notify the Thai Personal Data Protection Committee within 72 hours and tell you directly without undue delay.
Cookies
We use strictly necessary storage to keep your cart and booking working, and analytics cookies only if you accept them. The detail, and how to change your mind, is in the cookie policy.
Children
This site is not directed at children and we do not knowingly collect data from anyone under 18 other than the names and ages of children travelling on a booking made by an adult. If you believe a child has given us data directly, tell us and we will delete it.
Changes to this notice
We review this notice at least annually. The date at the top of this page shows the last review. Material changes are notified by email to anyone with an active booking.
Contacting us, or complaining
Email privacy@accesstransitexpress.com, or write to us at our registered office in Bangkok.
If you are unhappy with our response you may complain to the Office of the Personal Data Protection Committee in Thailand. Residents of the EEA or the UK may also complain to their own national supervisory authority.