Privacy Policy

1. Who handles your information

Aquatic Boat Co., Ltd. is the data controller for AquaTour enquiries and bookings. We operate under TAT licence No. 34/03805.

For privacy questions or requests, email sales@aquatour.travel or call +66 81 150 0009. Our office is at 43/5 Moo 8, Chalong, Mueang Phuket, Phuket 83130, Thailand.

2. Information we collect

• Enquiries: your preferred date, the number of adults and children, and any boat, destination or comments you choose to add. When you contact us, we also receive your name, contact details and message.
• Bookings: passenger details, pickup location, itinerary, payment references, and records of changes, cancellations and refunds.
• Insurance: the passport details required by the insurance agent or insurer to register passengers. We explain which details are needed before asking for them. A full passport copy is requested only if needed for that purpose.
• Website security: hosting services may record your IP address, requested page, time, browser details and referring page in technical logs.

Please keep passport numbers, payment-card details and medical information out of the website planner. If information is needed for insurance or a safety arrangement, we will explain how to provide it separately.

3. The planner, WhatsApp and email

The planner prepares a message in your browser and opens WhatsApp. Opening the link can pass the prepared text to WhatsApp; AquaTour receives the message when you send it. You can edit it before sending.

An email link opens your email application. WhatsApp and your email provider handle information under their own privacy terms. An enquiry does not confirm a booking, and the website does not collect payment-card details.

4. Why we use information

• To answer your request, prepare a quote, take payment and arrange the trip: steps you request before a contract and performance of the booking contract.
• To organise the other passengers' transport, boarding and trip arrangements: our legitimate interest in delivering the booked service, balanced against their privacy rights. We obtain individual consent where the law requires it.
• To register passengers for the included insurance: our legitimate interest in providing that cover, balanced against their privacy rights. We share only the passport details the agent or insurer requires. A legal obligation is relied on only where it actually applies.
• To keep required accounting records: legal obligations. To secure the website, prevent fraud and handle disputes: legitimate interests, subject to your rights.
• For optional marketing or advertising use of guest photographs: separate consent. Necessary health information requires explicit consent unless a legal exception, such as an emergency, applies.

We do not sell passenger information or use passport details for advertising. Declining optional marketing or photo permission does not affect your booking.

5. Details needed for the trip

A date, group size and a way to contact you are needed to answer a booking request. Boat preferences, destinations and planner comments are optional.

Before departure, we explain the passenger and insurance details needed and when to provide them. Missing required details can prevent us from arranging the trip or insurance. We distinguish a legal requirement from information needed to deliver the service.

6. Who receives information

Information is shared only as needed for the enquiry, booking or the purposes above. Recipients may include:

• Crew, transfer providers and other suppliers delivering your confirmed trip.
• The insurance agent and insurer registering passengers or handling a claim.
• A booking partner involved in your reservation.
• Service providers used for hosting, messages, booking records and payments, including GoDaddy, WhatsApp, Google Sheets, email providers and banks.
• Accountants, professional advisers, emergency services and public authorities where their involvement is necessary or disclosure is required by law.

Crew and transfer providers receive the details needed for their work. Insurance documents are not shared with them unless necessary. A supplier's own use of information, such as an insurer's claim records, is also covered by that supplier's privacy notice. You can ask us which provider is involved in your trip.

7. Processing outside Thailand

Some messaging, email, hosting and recordkeeping providers process information outside Thailand. A booking or insurance provider may also use overseas systems.

Overseas processing must use a transfer basis permitted by Thai data protection law. Contact us for information about the providers and transfer arrangements relevant to your booking.

8. How long we keep information

Retention depends on the record and its purpose. Where a single period cannot be set in advance, we use the following criteria:

• Enquiries that do not become bookings: while the request remains active and any related follow-up is needed.
• Booking and payment records: until the trip, payment, refund and any open complaint are complete, then only for applicable accounting requirements or a specific legal claim.
• Passport details: until passenger registration and the trip are complete, then only if needed for an open insurance claim or a specific legal requirement. They are removed from routine booking records when that need ends. The agent and insurer apply their own retention rules.
• Security logs: while needed to investigate incidents or protect the service.
• Optional marketing and photo records: while used with valid permission. If you withdraw permission, we stop that use and keep only any necessary record of your request or other lawful obligation.

Records kept for an accounting duty or an unresolved claim are restricted to that purpose. Backup copies are removed through their replacement cycle; they are not used to resume a deleted marketing contact. You can ask about the retention criteria for a particular record.

9. Keeping information safe

Access to personal information is limited to people who need it for their work. We use organisational and technical safeguards appropriate to the information, including controls on access and sharing. No internet service can guarantee complete security.

If a data breach occurs, we assess its impact, take steps to contain it and make the notifications required by Thai data protection law.

10. Children and health information

A parent, guardian or authorised adult should provide a child's booking details. Where consent is required, it must come from the person entitled to give it under Thai law.

For health or accessibility needs, please share only what is necessary for a safe arrangement. We do not routinely request medical histories. Required explicit consent is obtained separately; emergency processing follows the applicable legal exception.

11. Cookies, analytics and advertising

The website currently has no Google Analytics, Google Ads conversion tracking or Meta advertising pixel. Links to WhatsApp, Instagram and Google Maps open services with their own privacy and cookie practices.

If we introduce analytics or advertising tracking, we will describe the actual tools and uses and obtain consent where required before those tools operate. We will keep passport details, medical information and personal messages out of advertising tags and tracking URLs.

12. Your rights

Under Thai data protection law, and subject to its conditions, you can request access or a copy, correction, deletion, restriction, portability, or object to certain uses of your information. You can withdraw consent for a use that depends on it. Withdrawal does not undo earlier lawful processing or prevent retention required on another legal ground.

Send a request to sales@aquatour.travel. We may ask for enough information to verify your identity; a passport copy is not automatically required. We explain any lawful limits on the request and respond within the applicable legal deadline.

You can also complain to Thailand's Personal Data Protection Committee. You do not have to complain to AquaTour first.

13. Other passengers and policy changes

If you provide another passenger's information, share this policy with them and make sure you are authorised to provide their booking details. Required individual consent, including consent for health information or optional marketing, must come from that passenger or their authorised representative.

Changes to our handling of information will be reflected in this policy. If a new use requires notice or consent, we provide it before that use begins.