Privacy Policy

This Privacy Policy explains how Xplore ATV Samui ("we", "us", "our") collects, uses, discloses, and safeguards information when you visit xplore-atv.com (the "Site") or book an ATV tour with us. We respect your privacy and aim to handle your personal data lawfully, fairly, and transparently in line with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA, the Thai Personal Data Protection Act (PDPA), the Singapore Personal Data Protection Act, and other applicable laws.

1. Who we are

Xplore ATV Samui is an ATV tour operator located at Moo 1, 6/1, Maenam, Ko Samui, Surat Thani 84330, Thailand. For privacy questions, contact us at xploreatv@gmail.com or +66 83 990 1609.

For the purposes of GDPR, we act as the data controller for personal data collected directly through this Site. When you book through GetYourGuide, GetYourGuide acts as a separate controller for the booking data they collect.

2. What information we collect

We collect only what we need to run our website, respond to enquiries, and operate tours safely. Categories may include:

• Contact details you provide: name, email address, phone number, and any message you write in our contact form. Our contact form forwards your message to WhatsApp; the data leaves your browser only when you press send.
• Booking details: tour selection, number of riders, preferred date, hotel pickup location. Most bookings happen on GetYourGuide rather than directly with us.
• Tour-day information: for safety and insurance reasons we may record names, ages, emergency contacts, photos and videos taken during the tour, and a signed waiver.
• Technical data: IP address, browser type, device type, operating system, language, referring URL, pages viewed, and timestamps. Collected automatically when you visit the Site.
• Cookie data: see our Cookie Policy for the full list.

We do not knowingly collect special categories of data (such as health, religion, or biometric data) through the Site. If a tour requires medical disclosure for safety, that information is collected separately on the day and stored only for the duration of the tour plus any required insurance retention period.

3. Why we use your information

• To respond to enquiries and quote requests.
• To confirm, prepare, and operate the ATV tour you have booked.
• To meet safety, insurance, and tax obligations under Thai law.
• To improve the Site through aggregated, anonymous analytics.
• With your consent, to send marketing or seasonal offers (you can unsubscribe at any time).
• To detect and prevent fraud, abuse, and security incidents.

4. Lawful basis for processing

Where GDPR or similar laws apply, we process personal data on one or more of these grounds:

• Contract: to deliver the tour you booked.
• Legitimate interests: to run, secure, and improve our website and business, balanced against your rights.
• Consent: for non-essential cookies, marketing, and any optional features. You may withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, safety, and regulatory rules.

5. Who we share information with

We do not sell your personal data. We share it only with the following categories of recipients, where strictly necessary:

• Booking platforms such as GetYourGuide, when you book through them.
• Communication tools such as WhatsApp (Meta) when you message us or use our contact form.
• Hosting and infrastructure providers who store the website and serve fonts and maps (Hostinger, Google Fonts, Google Maps).
• Insurance providers and regulators when required for safety, claims, or legal obligations.
• Professional advisors such as accountants and lawyers, under confidentiality.

Each recipient processes data under their own privacy terms. Where they act as our processor, we use written agreements that require GDPR-equivalent safeguards.

6. Cookies and tracking

We use a small number of cookies to make the Site work and, with your consent, to understand how visitors use it. See the Cookie Policy for the full list. You can change your choice at any time using the "Cookie settings" link in the footer.

7. How long we keep data

• Enquiry messages: kept for up to 24 months after the last contact, then deleted.
• Booking records: kept for as long as required by Thai accounting and tax law (typically 5 years), then deleted.
• Tour-day photos and videos: kept for up to 12 months unless you ask us to delete them sooner, or you provide marketing consent.
• Analytics data: retained in aggregated, non-identifying form only.
• Cookie consent records: 12 months (then we ask you again).

8. International transfers

Our servers and some of our service providers are located outside Thailand and outside the European Economic Area. When personal data is transferred internationally, we rely on safeguards such as the European Commission's Standard Contractual Clauses, adequacy decisions, or your explicit consent where required. You can request a copy of the safeguards used by contacting us.

9. How we protect your data

We use HTTPS encryption across the Site, restrict access to personal data to authorised staff, and regularly review our security practices. No system is perfectly secure, however, and we cannot guarantee absolute security. If a breach occurs that is likely to cause significant risk to your rights, we will notify you and the relevant authority within the timelines required by law.

10. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with a supervisory authority in your country.

To exercise these rights, email xploreatv@gmail.com. We will respond within 30 days (or sooner where the law requires) and may ask you to verify your identity.

11. Regional rights

European Union and United Kingdom (GDPR / UK GDPR)

If you are in the EU or UK, you have all the rights listed above. You can lodge a complaint with the data protection authority in your country (a list is available at edpb.europa.eu) or, in the UK, with the Information Commissioner's Office.

California, United States (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, to opt out of "sales" or "sharing" (we do not sell or share personal information for cross-context behavioural advertising), and to limit the use of sensitive personal information. We do not discriminate against you for exercising these rights. Submit a request by emailing xploreatv@gmail.com.

Other US states

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), and other states with comprehensive privacy laws have similar rights to access, delete, correct, and opt out. Use the same contact details to make a request.

Thailand (PDPA)

Under the Thai Personal Data Protection Act B.E. 2562 (2019), you have rights of access, rectification, erasure, restriction, objection, and data portability. The supervisory authority is the Personal Data Protection Committee (PDPC) of Thailand.

Singapore (PDPA)

If you reside in Singapore, you have rights to access, correct, and withdraw consent under the Singapore Personal Data Protection Act. Contact the Personal Data Protection Commission (PDPC) Singapore for complaints.

Other Asian jurisdictions

We aim to align with comparable rights granted under the laws of Japan (APPI), South Korea (PIPA), Hong Kong (PDPO), Malaysia (PDPA 2010), the Philippines (Data Privacy Act 2012), Indonesia (PDP Law), and India (DPDP Act 2023). If your local law gives you stronger rights than this policy describes, those rights take priority.

12. Children's privacy

The Site is not directed at children under 16. We do not knowingly collect personal data from children online. If you believe a child has provided us with personal data through this Site, please contact us so we can delete it. ATV tours have minimum age and supervision rules — see our FAQ.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be highlighted on the Site or, where we have your contact details and your consent, communicated to you directly.

14. How to contact us