The Coco Club Chiang Mai
Privacy Policy
This policy explains what personal data The Coco Club collects when you visit our website, book a pass, sign in, buy at our counter or message us, why we use it, who helps us process it, and the rights you have under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
1. Who we are
The data controller is The Coco Club Chiang Mai Co., Ltd. (บริษัท เดอะโคโค่คลับเชียงใหม่ จำกัด), company registration no. 0505569015171, 29/88 Moo 2, Soi 4, Chet Yot Yu Yen Road, Chang Phueak, Mueang Chiang Mai, Chiang Mai 50300, Thailand ("The Coco Club", "we", "us").
This policy covers thecococlubcnx.com, our booking and member pages, our counter (point of sale), our check-in desk, and our accounts on LINE, Facebook, Instagram and WhatsApp.
2. What we collect
When you book
- Your name, email address and phone number.
- Your visit date, the passes you choose, the names printed on each ticket, and any private sauna time slot.
- Your booking number, ticket codes, payment status and payment method. Card and PromptPay payments online are handled by our payment provider; we never see or store your full card number.
- Whether you agreed to receive club news and offers.
When you sign in as a member
- You can sign in with Google, LINE or an email code, through our sign-in provider. We receive your name, your email address, your profile picture if that service shares it, and the account ID that service gives us (for example your LINE user ID).
- We create a member ID for you from your email address, and keep your bookings, tickets and news choices on your member record.
When you visit
- Check-in records: which ticket was used, when, and by which staff member. If staff let you in as an exception, the reason they note.
- Purchases at our counter: what you bought, how you paid, card slip or transfer references, and your receipt.
When you message us
- If you contact us on LINE, Facebook Messenger, Instagram or WhatsApp, we receive the name and profile picture that app shows us, your account ID on that app, your phone number (WhatsApp), and the messages you send.
- Bookings or requests we note from the conversation, and any notes our team adds to help you.
When you use our website
- Technical data our hosting provider records to deliver the site and keep it secure, such as IP address, browser type and the time of the request.
- We do not use advertising or analytics cookies, and we do not build advertising profiles.
3. How and why we use it
| Purpose | Legal basis (PDPA) |
|---|---|
| Taking your booking, issuing tickets, sending booking and ticket emails, checking you in | Performing our contract with you |
| Running your member account and member ID | Performing our contract with you |
| Answering your messages and noting your requests | Taking steps at your request before or under a contract; our legitimate interest in helping our guests |
| Taking payments, issuing receipts and keeping accounting and tax records | Contract; legal obligation |
| Sending club news and offers by email | Your consent, which you can withdraw at any time |
| Keeping our club, staff, systems and payments safe; preventing fraud and misuse of tickets | Our legitimate interests |
| Understanding which passes and services guests use, to improve them | Our legitimate interests |
| Meeting legal duties and requests from authorities | Legal obligation |
If you do not give the data we need to make a booking (name, email, phone), we cannot complete that booking.
4. Our AI chat assistant
To reply quickly, some messages you send us on LINE, Facebook Messenger, Instagram or WhatsApp may be answered by an AI assistant, with our team able to see the conversation and step in at any time. To write a reply, the assistant uses your message, the recent conversation, your display name and information from our own club guide. This text is processed by our AI provider on our behalf under its commercial terms.
- The assistant can note a booking request or pass the conversation to a person. It cannot take payments or change paid bookings.
- A booking is only confirmed when you receive your booking number or tickets from us.
- You can ask to speak to a person at any time, and you can object to AI replies (see Your rights).
5. Who we share it with
We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract, to run our services:
| Provider | What they do for us | Where |
|---|---|---|
| Cloudflare | Website hosting, database, security and the search behind our chat assistant | Global network |
| Clerk | Member and staff sign-in | USA |
| Beam | Online card and PromptPay payments | Thailand |
| Resend | Sending booking emails, tickets and club news | USA |
| Anthropic | The AI model that drafts chat replies | USA |
When you sign in with Google or LINE, or message us on LINE (LY Corporation), Facebook Messenger, Instagram or WhatsApp (Meta), those companies process your data under their own privacy policies.
We may also disclose data when Thai law requires it, to protect someone's life, health or safety, or to establish or defend legal claims. If our business is reorganised or sold, data may pass to the new owner under the same protections.
6. Transfers outside Thailand
Some of our providers store or process data outside Thailand, including in the United States. We use providers that offer appropriate safeguards for personal data, such as contractual data-protection commitments, as the PDPA requires. Some transfers are also needed to perform our contract with you, for example sending your ticket email.
7. How long we keep it
- Bookings, payments, receipts and counter sales: at least 5 years, as Thai accounting and tax law requires.
- Tickets and check-in records: for as long as we keep the booking they belong to.
- Member account: while your account is open. If you ask us to close it, we delete or anonymise your data, except records the law requires us to keep.
- Chat conversations: for as long as we need them to help you. We delete them sooner on request.
- Club news: until you unsubscribe or withdraw consent. We keep a note of your choice so we respect it.
- Security logs: for the limited time our hosting provider keeps them.
8. Cookies and browser storage
We only use what the site needs to work:
- Sign-in cookies from our sign-in provider, to keep you signed in to your member account.
- Browser storage to remember your cart while you book, and settings on our counter devices.
These are strictly necessary, so they do not need consent. We do not use advertising or analytics cookies. Links in our emails may include tags (for example utm_source=news) that tell us a visit came from an email; they do not identify you.
9. Your rights
Under the PDPA you have the right to:
- access your personal data and get a copy, and ask how we obtained data you did not give us;
- receive your data in a commonly used electronic format, or have it sent to another organisation where technically possible;
- object to our use of your data, including for direct marketing and AI replies;
- ask us to delete, destroy or anonymise your data;
- ask us to restrict the use of your data;
- ask us to correct data that is wrong, out of date or incomplete;
- withdraw your consent at any time (for club news: the unsubscribe link in every email, or the switch on your member page). Withdrawal does not affect what we did before.
To use a right, contact us (see below). We may ask you to confirm your identity. We reply within 30 days. Some requests may be limited by law, for example accounting records we must keep.
If you believe we have not handled your data lawfully, you can complain to the Office of the Personal Data Protection Committee (PDPC), www.pdpc.or.th.
10. How we protect it
Our website and systems use encrypted connections (HTTPS). Staff access is limited by role, so only the people who need data to do their job can see it. Sign-in is handled by a dedicated provider, saved service keys are encrypted, and we keep our systems up to date. No system is perfectly secure; if a breach affects your rights and freedoms, we will notify the PDPC and, where required, you.
11. Children
Our booking and member services are for adults. Kid passes are booked by a parent or guardian, who gives the child's name for the ticket. If you believe a child has given us personal data without a parent's or guardian's consent, contact us and we will delete it.
12. Changes to this policy
We may update this policy when our services or the law change. We will change the date at the top and, for important changes, tell members by email or on our website.
13. Contact us
For questions about this policy or your personal data:
- The Coco Club Chiang Mai Co., Ltd., 29/88 Moo 2, Soi 4, Chet Yot Yu Yen Road, Chang Phueak, Mueang Chiang Mai, Chiang Mai 50300
- Phone: 084 558 2173
- LINE: @thecococlub.cnx
- Or ask at the front desk, open every day 9 AM – 9 PM.