Privacy Policy

1. About This Policy

Kham Massage and Spa Company Limited (Kham) respects your privacy and collects, uses and discloses personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019). This policy explains what we collect, why we collect it, how long we keep it, who we share it with, and the rights you have.

It covers our website khammassage.com, our online booking system, and the services we provide at every Kham branch.

2. Who Is Responsible for Your Data

Kham Massage and Spa Company Limited is the data controller. You can reach us at info@khamspa.com or at the address at the end of this policy. If your message is about personal data, please write PDPA Request in the subject line so that we can handle it promptly.

3. Personal Data We Collect

We collect only the data we need in order to serve you.

• Identity and contact data: name, phone number and email address
• Booking data: branch, service, date and time, therapist you choose, booking history and any note you give us
• Payment data: amount, payment channel, reference number and receipt. Card and bank account details stay with the payment provider and are not stored by us
• Account data: your login records for the customer page, including social login such as LINE if you choose to use it
• Health data: conditions, injuries, pregnancy or allergies that you choose to tell us so that treatment is safe for you
• Technical data: IP address, device and browser, and the pages you visit, collected through cookies and analytics tools

4. Why We Use It and Our Legal Basis

• To take and manage your booking and provide the service you paid for, on the basis of our contract with you
• To contact you about your booking, a change or a problem, on the basis of our contract with you
• To issue receipts and keep accounting and tax records, on the basis of our legal obligations
• To keep the service safe, prevent fraud and misuse and improve what we offer, on the basis of our legitimate interest
• To send news, promotions and special offers, on the basis of your consent, which you can withdraw at any time
• To use health data so that treatment is safe for you, on the basis of your explicit consent

5. Sensitive Data

Health data is sensitive personal data under the law. We ask for it only where it matters for your safety during treatment, we use it only for that purpose, and we ask for your explicit consent first. You may refuse to give it or withdraw your consent later, although some treatments may then be unavailable.

6. Cookie Policy

Cookies are small files kept on your device. We use two groups of them.

• Necessary cookies keep you logged in, remember the language you chose and the booking you are making, and keep the website secure. The website cannot work properly without them, so they do not require consent
• Analytics cookies from Google Analytics and Google Tag Manager tell us how many people visit, which pages they read and which booking steps they complete. We use them only after you accept them on the consent banner

You can accept or reject non-essential cookies on the banner shown on your first visit, and you can change your mind later by clearing cookies in your browser and opening the website again. You may also block cookies in your browser settings, although parts of the website may then stop working.

7. Who We Share Your Data With

• Our therapists and branch staff, limited to the data they need to serve you
• Payment providers, to process your payment and confirm the result back to us
• Google, for website analytics
• Our hosting and email providers, who keep the system running
• Government agencies, courts or auditors, where the law requires it

We do not sell your personal data and we do not pass it on for other companies to advertise to you.

8. Sending Data Abroad

Some of the providers above keep data on servers outside Thailand. Where that happens, we check that the provider protects data to a standard comparable with Thai law, or we rely on another basis that the law allows.

9. How Long We Keep Your Data

• Booking and service records: while you are our customer and for 5 years after your last visit
• Receipts and accounting records: 5 years, as required by tax law
• Health data: while you are our customer, and deleted within 1 year after your last visit or as soon as you withdraw consent
• Website analytics data: up to 14 months

After these periods we delete the data or make it anonymous.

10. How We Protect Your Data

Access to customer data is limited by role, so branch staff see only what they need. Phone numbers on past bookings are hidden from branch accounts. Traffic to the website is encrypted, and payments are handled on the payment provider system.

11. Your Rights

Under the Personal Data Protection Act you may ask us to do the following.

• Give you access to your data and a copy of it
• Correct data that is wrong or out of date
• Delete your data or make it anonymous
• Suspend the use of your data
• Send your data to you or to another provider in a machine readable form
• Stop using your data for a particular purpose, such as marketing
• Withdraw a consent you gave us earlier

Write to info@khamspa.com and we will answer within 30 days. Using these rights is free, and if we have to refuse a request we will always tell you why. If you are not satisfied with the result, you may complain to the Office of the Personal Data Protection Committee.

12. Customers Under 20

A guest under 20 years old may use our service with the consent of a parent or legal guardian, and we ask for that consent before collecting the data of a minor.

13. Changes to This Policy

We may update this policy when our services or the law change. The date below shows the current version, and we will announce any material change on the website.

14. Contact Us

For any question about this policy or about your personal data, contact us at info@khamspa.com or by post to:

Last updated: 19 September 2026