Privacy Policy. Version dated October 24, 2026.
This page explains what data MyThai.online receives, why it needs the data, and how you can manage your choices. You can read our materials without registering. Analytics and partner widgets are enabled by default; you can turn them off using the “Cookie Settings” button.
Who is responsible for the data
The operator is MyThai Online Co., Ltd. (บริษัท มายไทย ออนไลน์ จำกัด), registration number 0775569002174. Address: 551/1 Moo 7, Hin Lek Fai, Hua Hin, Prachuap Khiri Khan 77110, Thailand. For questions about data, email info@mythai.online. No separate data protection officer (DPO) has been appointed; the company handles requests at this address.
What data we collect, why, and on what legal basis
| Purpose | Data and legal basis | Required? and retention period |
|---|---|---|
| Display and protect the website | IP address, request time, page address, technical browser details, service cookies, and error logs. Our legitimate interest in operating and securing the website (PDPA, Section 24(5)); compliance with mandatory retention requirements and lawful requests—Section 24(6). | Technical data is necessary to connect: without it, the website will not open. Retention periods for technical logs depend on hosting and security settings; no single maximum period is currently set. Records that the law requires us to keep are retained for the mandatory period; in the event of a dispute, until it is resolved. We retain your cookie choice for 180 days. |
| Register and maintain an account | Name, email, login, and a secure password hash; if you choose social login, an identifier and profile data you authorize us to access. Processing is based on your consent (PDPA, Section 19). Confirming consent and preventing abuse are based on our legitimate interest. | Registration requires a name/login, email, and data from the login method you choose. Without them, you cannot register, but you can still read the website. We keep the profile until the account is deleted; consent records and disputed records are kept for as long as needed to protect rights or meet mandatory retention requirements. |
| Publish and moderate a comment | Name, email, IP address, browser details, comment text, and time. Publication is based on your consent; moderation, handling complaints, protecting rights, and meeting legal requirements are based on our legitimate interest and legal obligations. | Comments are available only to registered users. Other readers can see your name and comment text; your email and IP address are not public. A comment and related data are kept while it remains posted; we review deletion requests in light of other people’s rights and legal requirements. You cannot leave a comment without giving consent. |
| Send replies to a comment | Email, a link to the discussion, and your subscription choice. Separate consent with email confirmation. | Optional. We keep the subscription until you unsubscribe; you can unsubscribe using the link in a notification or by emailing us. Delivery logs are described below. |
| Send an event reminder on Telegram | Telegram chat ID, event number, and reminder time. We receive these when you open our bot yourself using the “Remind me on Telegram” button on an event page and press “Start.” Processing is based on your consent (PDPA, Section 19); Telegram delivers the messages. | Optional. We keep the data until the reminder is sent, you cancel it (using the “Cancel reminder” button or the /stop command), or the event is canceled; we then delete it. For statistics, we keep only the number of reminders per event, without the chat ID. |
| Reply to a message through “Contact” or email | Name, email, subject, message, technical sending details, and a consent record. For the form, processing is based on your consent; for business correspondence you initiate, it is based on our legitimate interest, and when preparing a contract, on PDPA, Section 24(3). | Your name, email, and message are needed for us to receive your inquiry and reply. You can choose a subject from a list. The form will not submit without these details; you can email us directly instead. Copies of emails sent by the website are kept for 90 days—see the separate section. |
| Understand how people use the website | Google Analytics and Yandex Metrica: cookie identifiers, IP address and approximate location, browser, device, referral sources, pages visited, and actions taken. Metrica’s Webvisor records activity on a page: pointer movements, scrolling, clicks, and interactions with forms. Do not enter unnecessary personal details in open fields. The basis is consent, given by continuing to use the website after the cookie notice; you can disable analytics at any time using the “Cookie Settings” button. | Optional. Refusing does not prevent you from reading the website. Cookie durations are listed in the table; event-data retention is set in the counters’ accounts and has not been separately confirmed. Disabling analytics stops new data from being loaded but does not itself delete records already held by the provider. |
| Display partner blocks and social media features | IP address, browser, page, cookie identifiers, and activity in a widget. Tripster, Travelpayouts, Localrent, KiwiTaxi, and the Facebook SDK load by default; you can disable them as a group under “Partner Widgets and Social Media” in “Cookie Settings.” Signing in through a selected service happens only after you take a separate action and consent during registration. | Optional. If you decline, the website text and widget placeholders remain. Providers set their own retention periods under their rules; the known Tripster period is 180 days. |
We receive data from you, your browser, and the login service you choose. We do not ask you to send passport details, health information, or other sensitive data. We do not make decisions that have legal consequences for you automatically based on a visitor profile.
Who we share data with and in which countries
Employees and contractors who need access for the purposes listed above, as well as the providers below, may access the data. We disclose data to government authorities when legally required. Access to technical information does not mean that every provider receives your entire profile or correspondence.
- Bluehost, United States: website hosting, user and comment databases, server logs, and copies needed to operate the hosting service. QUIC.cloud, node in Germany/EU: page delivery and caching, IP address, and technical requests.
- Brevo: delivery of service emails and form messages, sender and recipient addresses, email content, and delivery information. Brevo is a European email service; the specific processing centers and subcontractors used for our account have not been separately confirmed. Cross-border processing may occur.
- Yandex Metrica, Russia: analytics events and Webvisor recordings. Google Analytics, United States: visit and interaction data. It loads after your first action on a page or after 5 seconds if analytics has not been disabled in “Cookie Settings.”
- Google reCAPTCHA and Google Fonts, United States: checks for automated activity and font loading. They receive your IP address, page address, and technical information; reCAPTCHA may analyze activity to protect against spam. These connections may occur independently of the analytics and partner-widget groups, on pages where the website uses them.
- Sign-in through Google (United States), VKontakte, Odnoklassniki, Yandex, Mail.ru (Russia), or Telegram: the service you choose verifies your sign-in and sends the profile information you authorize. Telegram has international infrastructure; the exact country where data is processed for our sign-in has not been confirmed. Do not choose this sign-in method if you do not want to exchange data with that service.
- Gravatar (Automattic, United States): profile image based on an identifier derived from your email and technical browser requests. This identifier may make it possible to associate the image with a profile; it does not guarantee anonymity.
- Tripster, Travelpayouts, Localrent, KiwiTaxi: partner widgets, technical information, and activity in the blocks. The providers have international infrastructure; the exact processing locations under each agreement have not been confirmed, and data may be transferred to Russia and other countries.
- Facebook SDK (Meta, United States): social-button features that require the SDK. Regular “share” links work without it. The SDK is enabled only in the widget group.
The level of data protection abroad, including in Russia and the United States, may differ from that in Thailand. For optional analytics and widgets, we ask you to make a choice after this notice; in other cases, the basis for a transfer must comply with PDPA Articles 28–29, for example, a transfer necessary to fulfill your request or established safeguards. This policy is not itself a contractual guarantee from a provider and does not replace checking the legal basis for a transfer.
Cookies and browser storage
Cookies are small records that a browser stores for a website or connected service. Necessary cookies support the session and security. Analytics and widgets are enabled by default and are not needed to read the site; you can disable them in “Cookie Settings.” Below are the website records we know about; names marked with “*” indicate a cookie family.
| Name | Purpose / group | Duration |
|---|---|---|
mt_consent | Text version, date, and permitted groups. Necessary first-party cookie; it also remembers your refusal. | 180 days; if the version changes, we ask again. |
_lscache_vary | LiteSpeed: the correct page variant. Necessary. | 2 days. |
wpdiscuz_nonce_* | Protects the comment form. Necessary. | Session. |
| Security service cookies with random names | Request checks and protection against abuse. Necessary. | 5 days. |
| WordPress session cookies when logged in | Maintain your login and account settings. Necessary after sign-in. | Session or the selected “remember me” duration. |
_ga, _ga_* | Google Analytics: distinguishes visits. Analytics. | 400 days. |
_ym_* | Yandex Metrica: visitor, visits, and technical indicators. Analytics. | Different durations; for example: _ym_uid and _ym_d —up to one year; _ym_isad —20 hours; _ym_visorc —up to 30 minutes. The actual set depends on the counter and browser. |
gb_uid | Tripster: widget visitor identifier. Widgets. | 180 days. |
mt-audience in localStorage | Your “I’m a tourist / I live here” choice, used to show the appropriate version of the website. | No automatic expiration; kept until the browser storage is cleared or you change your choice. |
—change the groups and save your choice. The same button is in the footer. When you withdraw consent, the page reloads to stop services that have already loaded. You can also withdraw consent by email. Processing that was lawful before withdrawal does not become unlawful because of it.
You can remove remaining cookies and local records, including third-party ones, through your browser. The website can delete only cookies it can access. Blocking necessary cookies may prevent sign-in, form submissions, and saving your choice.
Email storage, copies, and deletion
Copies of emails sent by the website itself (registration confirmations, password resets, reply notifications, and messages from the “Contact Us” form) are stored in the WP Mail SMTP log for 90 days , then deleted automatically. They contain the recipient address, subject, text, and delivery result. We keep correspondence in the info@mythai.online inbox for as long as it is needed to answer an inquiry and protect rights; no single retention period has been set.
After a justified request, we delete data that is no longer needed or restrict its use. If we are required to retain a record or need it to protect rights, we will explain why it is being kept. Deletion from backups depends on the backup update cycle; no single backup cleanup period has been separately confirmed. Copies are not used for routine operations after they have been deleted from the active system.
Your rights and how to submit a request
You may request access to and a copy of your data, correction, transfer where provided by law, deletion, or restriction of processing; object to processing; and withdraw consent. These rights are subject to the conditions and exceptions in the PDPA. Declining optional groups does not limit your ability to read the website.
Write to info@mythai.online, with the subject “Personal Data.” State what you are requesting, the account email, and any relevant links. To protect against requests from others, we may ask for minimal identity confirmation; do not send a passport in advance. We will reply no later than 30 days after receiving your request. If we cannot delete data, we will explain the basis and how to appeal.
You may file a complaint with Thailand’s Personal Data Protection Committee (PDPC) and its expert committee. The PDPC publishes current contact channels. PDPC. Contacting us first does not prevent you from filing a complaint.
Consent, children, and changes to this document
A separate document is provided for Russian citizens “Consent to the Processing of Personal Data” under Article 9 of Law No. 152-FZ. This policy explains how data is processed and does not itself constitute consent. The form checkbox applies to the purpose stated in the form; analytics and widgets are governed by the cookie notice and your settings.
For minors, the rules in Section 20 of the PDPA apply: for children under 10, consent is given by the holder of parental responsibility; in other cases, consent is also required if the child is not legally able to carry out the relevant action independently under Thai civil law. We do not present age 16 as a threshold established by this section. A representative may contact us about a child’s data.
If the purposes or contents of optional groups change, we will update the cookie notice. The current version is on this page.