Privacy Policy (Sanpatong.com)

Last updated: 30 January 2026

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit sanpatong.com or use related services we provide through the website, including our Trade Portal (together, the “Services”).

If you do not agree with this Privacy Policy, do not use the Services.

Who we are

Data controller: Sanpatong Holding Co., Ltd (the “Company”) is the data controller for personal data collected through the Services.

Registered office:
Sanpatong Holding Co., Ltd
169/93 Moo 4, San Phak Wan, Hang Dong, 50230 Chiang Mai, Thailand

Privacy contact: privacy@sanpatong.com

We may share personal data within the Sanpatong group and with relevant partners to provide the Services and respond to requests. Some group companies or partners may act as separate data controllers for their own use of your data, for example to meet legal, accounting, regulatory, or operational requirements.

Scope

This Privacy Policy applies to personal data collected through:

Browsing and using sanpatong.com
Contact and enquiry forms
Trade Portal account creation and log in
Orders and payments through the Trade Portal (when enabled)
Experience bookings and payments through the Trade Portal
Communications with us by email or other channels linked from the Services

This policy does not apply to third-party websites or platforms that we link to. Those third parties have their own privacy policies.

Personal data we collect

We may collect the following categories of personal data.

Data you provide to us

Identity and contact details, such as name, email address, phone number, and address
Business details for trade use, such as company name, job title, business address, and delivery and billing details
Account details for the Trade Portal, such as login details and account preferences
Enquiry content, such as messages you send and attachments you choose to provide
Booking details, such as the experience selected, date and time, number of guests, and notes you provide
Order details, such as items ordered, delivery instructions, invoices, and order history
Verification and compliance information for trade customers where required, which may include documents or information used to confirm identity, authority to purchase, and business legitimacy (often described as KYC)

Data we collect automatically

When you use the Services, we may collect:

Device and technical data, such as IP address, browser type, operating system, language settings, and device identifiers
Usage data, such as pages viewed, clicks, time spent, and referring pages
Approximate location derived from IP address (city or region level)

Cookies and similar technologies

We use cookies and similar technologies to:

Make the Services work properly and securely
Support Trade Portal sessions and authentication
Remember preferences
Measure performance and improve the Services
Measure marketing effectiveness and support advertising

We use analytics and advertising tools that may set cookies or collect identifiers, including:

Google Analytics
Google Ads
Meta Pixel
TikTok Pixel

You can control cookies through your browser settings and through any cookie controls we provide on the Services. If you disable some cookies, parts of the Services may not work as intended, especially account and portal features.

How we use personal data

We use personal data for the following purposes:

To operate, maintain, and secure the Services
To respond to enquiries, requests, and customer support messages
To create and manage Trade Portal accounts and provide portal functions
To process orders, provide fulfilment, and manage payments (when enabled)
To manage bookings and deliver experiences
To manage trade relationships and business communications
To send service messages, such as confirmations, updates, and important notices
To send marketing communications, where permitted and where required, with your consent
To measure and improve marketing, including attribution and campaign measurement
To comply with legal and regulatory obligations and to protect our rights and safety

Legal bases

Where required by applicable law, we rely on one or more of the following legal bases:

Consent, for example certain marketing activities and certain cookies
Performance of a contract, for example where you create an account, place an order, or make a booking
Legal obligation, for example tax, accounting, and regulatory compliance
Legitimate interests, for example to secure the Services, prevent misuse, and improve performance, balanced against your rights

Where we rely on consent, you can withdraw it at any time.

Sharing and disclosure

We do not sell personal data for money.

We may share personal data with the categories of recipients below, when needed for the purposes in this policy, when you ask us to do so, or where permitted by law.

Sanpatong group companies

We may share personal data within the Sanpatong group to respond to enquiries, deliver services, operate the Trade Portal, provide bookings and orders, manage customer support, and maintain security and compliance.

Partners and associated companies

We may share personal data with partners and associated companies where this is relevant to your interaction with us and needed to provide services, fulfil orders, support experiences, manage events, handle trade distribution workflows, or operate joint activities. Where a partner wants to use your data for its own marketing purposes, we will do so only where permitted and where required, with your consent.

Service providers

We use third parties to provide services such as hosting, email delivery, customer support tools, identity verification, analytics, advertising measurement, booking systems, ecommerce systems, payment processing, and logistics. They must protect personal data and may use it only to provide services to us.

Advertising and analytics platforms

We may share identifiers and usage information with platforms such as Google, Meta, and TikTok for analytics, attribution, and advertising, subject to your cookie choices and applicable law.

Professional advisers and authorities

We may disclose personal data to lawyers, accountants, auditors, regulators, and law enforcement where required by law or where needed to protect rights, safety, and security.

Business changes

If we are involved in a corporate transaction, such as a restructuring, financing, merger, acquisition, or sale of assets, personal data may be disclosed as part of that process, subject to appropriate safeguards.

Payments

When payments are enabled, payment processing is handled by a payment provider. We do not intend to store full payment card details on our systems. The payment provider will process your payment data under its own privacy terms.

International transfers

We are based in Thailand. Some service providers, partners, or platforms may process or store personal data outside Thailand. Where international transfers occur, we take steps intended to ensure appropriate safeguards are in place as required by applicable law.

Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, including legal, accounting, tax, dispute handling, and security needs.

In general:

Enquiries are kept for follow up and relationship management
Trade Portal account data is kept while your account is active, and for a period after closure where needed for compliance and dispute handling
Order and booking records are kept as needed for accounting and legal obligations
Verification data is kept only for as long as needed for verification, compliance, and fraud prevention, then deleted or securely archived where required

Security

We use reasonable technical and organisational measures designed to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure.

No online system can be guaranteed fully secure. Avoid sending sensitive data through open text fields unless it is specifically required.

Your rights and choices

Subject to applicable law, you may have rights that include:

Access to your personal data
Correction of inaccurate or incomplete data
Deletion in certain circumstances
Restriction of processing in certain circumstances
Objection to certain processing
Data portability where applicable
Withdrawal of consent where we rely on consent

To exercise your rights, contact privacy@sanpatong.com. We may need to verify your identity.

Targeted advertising and opt out options

We use advertising and measurement tools that may involve sharing identifiers and usage data for marketing and attribution.

You can limit this by:

Using cookie controls on the Services (where available)
Adjusting your browser settings to block or delete cookies
Contacting privacy@sanpatong.com to request opt out of targeted advertising where applicable

If you are in certain US states, you may have a legal right to opt out of targeted advertising and certain forms of sharing. We will honour valid opt out requests we receive and, where required, recognised browser-based opt out signals.

Marketing communications

If you receive marketing from us, you can opt out at any time using the unsubscribe option (where provided) or by contacting privacy@sanpatong.com.

Opting out of marketing does not affect service communications, such as order updates or booking confirmations.

Children and legal drinking age

The Services are intended only for people who are of legal drinking age in their location. In Thailand, you must be 20 years old or older.

We do not knowingly collect personal data from individuals who are not of legal drinking age. If you believe a minor has provided personal data to us, contact privacy@sanpatong.com so we can take appropriate steps.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the “Last updated” date.