How we look after your booking and enquiry details.

When you complete the booking payment form, we collect:

• Your name as shown on your passport.
• The last 4 characters of your passport number. We do not store the full number.
• Booking details (course, date, time, players) as set up by our team.
• The time you accepted the booking terms, with the IP address and browser type used, as a record of that acceptance.

We do not collect or store your full card number. Your card details go straight from your browser to Omise, our payment processor, and do not pass through our servers.

We use this information to help confirm your identity at the golf course or service venue, match the payment to your booking, and keep proper records in case there is any payment question later.

Our retention period for payment acceptance records and related booking evidence is 18 months after the payment date. Deletion at the end of that period is not yet automatic: records stay until an administrator removes them. You can ask us to delete your records sooner using the contact details in section 06.

We also keep technical records of how the payment page behaved for you — which steps you reached, your device and browser type, and any error codes the card network returned. This never includes your card number or passport number. These records are kept for 90 days and are used only to investigate payment problems.

Only authorised staff can access this information. Passport details are encrypted where they are stored, this site is served over HTTPS, and we use the information only when needed for your booking, payment record or service confirmation.

Omise Co., Ltd. handles the secure card payment process for us. This website and its records are hosted by DigitalOcean in Singapore. We do not sell or share your data with marketing third parties.

You may ask for a copy, correction or deletion of your data by emailing admin@phukettravel.co.th. You can also reach us on WhatsApp or LINE. Our data deletion instructions explain what to include in a deletion request.

PHUKET TRAVEL COMPANY LIMITED, known as Phuket Travel Co., Ltd., Thailand, operates PhuketTravel-WA and decides how the integration uses information received from WhatsApp. For questions about this part of the notice, or to exercise your rights, email admin@phukettravel.co.th.

PhuketTravel-WA helps our staff handle the company's own golf and travel enquiries. It is not a public chatbot, and it does not reply to anyone by itself.

Today

The integration is being tested with a dedicated test number provided by Meta and an authorised test participant. Text messages sent to that test number reach a private receiver we control, and a dedicated Grok Bot routine prepares a suggested reply marked for staff approval. Staff read the draft and decide what, if anything, to send.

Planned

Connecting our public business number to the same staff-reviewed workflow. This has not been done. Until it is, messages to our public number are handled by staff in the WhatsApp Business app and WhatsApp Web, as they are now. We will update this notice before that changes.

For each message the test integration accepts, we process:

• Your WhatsApp number.
• The text of your message, including any enquiry details you choose to include, such as dates, courses, hotel or group size.
• The message identifier assigned by WhatsApp.
• The identifier of the business number that received the message.
• The time the message was received.
• The processing status of the message, including whether it was passed to the draft routine and the result of that attempt.
• The reply draft prepared for our staff, which is held by the draft service rather than on our receiver.

We use this information to understand your enquiry, to prepare a response that our staff review before anything is sent, to avoid processing the same message twice, and to diagnose failures in the integration. We do not use it for advertising or profiling.

The current test integration handles text messages only. It does not:

• import your chat history or earlier conversations;
• read or store your address book or contact lists;
• process images, voice notes, documents or other attachments;
• take part in group conversations;
• send replies to you automatically;
• create, change or cancel a booking, or take a payment.

Messages outside this scope are acknowledged to WhatsApp and are not kept by the receiver.

• Authorised staff of Phuket Travel Co., Ltd., who review enquiries and drafts.
• WhatsApp and Meta, which provide the messaging service and deliver messages to our integration.
• DigitalOcean, which hosts our private receiver.
• Grok Bot, the AI draft service we use through the linked Cursor infrastructure, which prepares the reply drafts.

We do not sell this information or share it with marketing third parties.

Our receiver runs in DigitalOcean's Singapore region; we have verified this. WhatsApp, Meta and the draft-service providers may process information outside Thailand, in countries where they or their sub-processors operate, under the terms that apply to their services. We are confirming the full list of processing locations with the draft-service provider and will update this notice when we have it.

Accepted messages are stored in a private database outside the public website directory, with access restricted to authorised administrators. Connections between WhatsApp, our receiver and the draft service use HTTPS, and our receiver checks Meta's signature on every incoming request before accepting it. Our logs record processing status only, not message contents. We cannot promise that any system is completely secure, but these are the measures in place.

Payment records. Retention for booking payment records is described in section 03.

Receiver records. The current test receiver keeps its records until an administrator deletes them. There is no scheduled automatic deletion during the test phase. We will set a retention schedule before the integration handles our public number.

Reply drafts. Drafts and routine results are held by the draft service under the settings that apply to our account. Privacy Mode is enabled on our linked account. We are awaiting written confirmation from the provider about its precise coverage for Grok Bot message inputs, reply drafts and stored context. Enabling Privacy Mode does not automatically delete stored results. A deletion request therefore covers both the receiver and the draft service.

You can ask us to access, correct or delete information held in connection with this integration by emailing admin@phukettravel.co.th. Our data deletion instructions explain what to include and what happens next. We may need to check that a request relates to your own data before acting on it.

WhatsApp and Meta operate under their own terms and privacy policies, which govern your WhatsApp account and the copies of messages held in it. Deleting the records we hold does not delete your WhatsApp account, your own chat history, or any information WhatsApp or Meta keep independently of us.