Privacy Policy

Pattaya Ticket is the data controller for the personal data described in this policy. You can contact us at support@pattayaticket.com.

• Booking details: the lead traveler’s name, email address, phone number and nationality, your chosen language, and what you booked (experience, date, time, number and type of tickets, price).
• Account details: if you sign in with Google or Facebook, we receive your name, email address and profile picture from them. We never see your Google or Facebook password. If you sign in with an email link, we receive your email address and the name you give us.
• Payment details: payments are handled by Stripe. We see the payment status and amount, but not your full card number.
• Messages: anything you send us by email, LINE or the contact form on our Help Center (your name, email address, booking code if you give one, topic and message).
• Technical data: small files stored in your browser to remember your language, currency and sign-in, and basic server logs (such as IP address and browser type) used to keep the site secure and working.
• Visitor statistics: which pages are viewed, the country, device and browser type, and the website that sent you to us. Vercel counts these for us without cookies and without identifying you, and we leave out ticket and booking codes.

The booking details are needed to make your booking. Without them we can’t complete it or send you your tickets.

• To provide your booking (performing our contract with you): taking payment, sending your e-ticket, passing your booking to the attraction, and letting you see your tickets under My Tickets.
• To support you: answering questions and handling changes, cancellations and refunds.
• To keep the service safe (our legitimate interests): preventing fraud and misuse, and fixing problems.
• To improve the site (our legitimate interests): seeing which pages and experiences people visit, using the visitor statistics above.
• To meet legal duties: keeping accounting and tax records required by Thai law.

We never sell your personal data. We share it only with:

• The attraction or operator you booked (name, nationality, phone number and booking details) so they can prepare for and check in your visit. They may contact you about your booking, for example by phone or WhatsApp.
• Service providers that run the site for us: Stripe (payments), Supabase (database and sign-in), Vercel (website hosting and visitor statistics), Resend (sending emails), Zoho (our email inbox), LINE (messages to attractions) and Cloudflare Turnstile (checking that messages sent through our contact form come from a person, not a bot; see Cloudflare’s Turnstile privacy notice).
• Google or Facebook, only if you choose to sign in with them.
• Authorities, when the law requires it.

Some of these providers store or process data outside Thailand, for example in Singapore, the United States or the European Union. Some of these transfers are needed to complete your booking, such as processing your payment. In every case we rely on the provider’s data protection terms and safeguards, as the PDPA allows.

• Your account: until you ask us to delete it.
• Booking and payment records: for at least 5 years, as Thai accounting and tax laws require, then deleted.
• Unpaid bookings are cancelled automatically when their payment window ends.
• Support messages: 12 months after you send them. Messages sent through the Help Center form are then deleted from our database automatically, and we delete old emails in our support inbox at least once a year.

Under the PDPA you can ask us to:

• give you access to, or a copy of, your personal data;
• correct data that is wrong or incomplete;
• delete your data, or stop or limit how we use it;
• send your data to you or another company;
• withdraw any consent you gave us.

Email support@pattayaticket.com from the address on your booking or account. We reply within 30 days. To delete your account, see Delete your data. If you are unhappy with how we handle your data, you can complain to Thailand’s Office of the Personal Data Protection Committee (PDPC).

We only use what the site needs to work: remembering your language, your currency and whether you are signed in. We do not use advertising or tracking cookies, and our visitor statistics use no cookies at all.

Your data is sent over encrypted connections (HTTPS). Access to booking data is limited to people and systems that need it. Card payments are processed by Stripe, which is certified to the PCI DSS security standard.

Bookings must be made by an adult. Tickets for children can be included in an adult’s booking. We do not knowingly collect personal data directly from children.

We may update this policy from time to time. The date at the top shows when it last changed. If the changes are significant, we will tell you on the site or by email.