Privacy Policy

This Privacy Policy explains how Moychay Thai Co., Ltd. collects, uses, discloses and protects personal data on the website teaphuket.com, in the chat with our virtual tea guide Cha and when you contact us through the website. It is our privacy notice under section 23 of Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").

1. Data controller

Moychay Thai Co., Ltd. (บริษัท โมยชาย ไทย จำกัด), a company registered in Thailand, juristic person registration number 0835566044401.
Registered office: 49/33 Ban Don – Cherng Talay Road, Cherng Talay Subdistrict, Thalang District, Phuket 83110, Thailand.
Tea house Moychay Phuket: 2nd floor, Boat Avenue, Bangtao, Phuket.
Privacy contact: [email protected], +66 81 795 9110.

We have not appointed a data protection officer, as the PDPA does not require one for our activities. Please send any privacy request to the contacts above.

2. Scope

This policy covers teaphuket.com in all languages, its contact and wholesale forms and the Cha chat. Our online shop, messengers, maps and social networks that the site links to are separate services with their own terms and privacy policies.

3. What personal data we collect

Contact and wholesale forms: your name, email, optionally a WhatsApp or Telegram contact, your message; for wholesale enquiries also the company name and type of business; the page and language of the form.
Chat with Cha: the messages you write, the page where the chat started, the interface language and, only if you decide to leave it, a phone number, messenger name or email for our team.
When you contact us directly by WhatsApp, Telegram, phone or email from the site – what you send us through those services.
Technical data: IP address, browser and device type, pages visited, time of visit, approximate location derived from the IP address, and the buttons you press (for example "Get directions", messengers, the online shop).

We collect this data directly from you and automatically when you use the site. We do not ask for sensitive data (health, religion, biometric data, criminal records, ID numbers). Please do not send it in forms or in the chat.

4. Why we use your data and on what legal basis

Answering your enquiry, arranging a visit, a tea ceremony, an event or a wholesale offer – steps taken at your request before entering into a contract (PDPA section 24(3)).
Running the chat with Cha, including handing the conversation to our team when you ask for it – steps at your request (section 24(3)) and our legitimate interest in helping visitors quickly (section 24(5)).
Keeping the site, forms and chat secure and protecting them from spam, fraud and abuse – our legitimate interest (section 24(5)).
Understanding how the site is used and measuring our advertising with analytics and advertising tools – our legitimate interest in improving the site and our services (section 24(5)). You can object at any time (see sections 10 and 11).
Complying with the law, for example accounting and tax rules or lawful requests from authorities – legal obligation (section 24(6)).

Where we rely on legitimate interest, we have balanced it against your rights and use only the data needed. If we ever want to use your data for a purpose that needs your consent (for example marketing messages), we will ask for it first. We do not sell personal data.

5. Do you have to give us your data?

No. Giving us data is voluntary. Fields marked as required in the forms are needed to answer you: without a way to contact you we cannot reply. You can visit the site and talk to Cha without telling us who you are.

6. Cha, our virtual tea guide

Cha is a virtual assistant that answers automatically with the help of artificial intelligence. Its answers can be inaccurate; prices, bookings and availability are confirmed only by our team. Cha does not make decisions with legal or similarly significant effects on you.
To generate an answer, your messages and the recent part of the conversation are processed by an external artificial intelligence service provider under a contract with us. Under its terms, this data is not used to train its models.
If you choose "Talk to a person", the conversation is passed to our team's work chat, where team members reply to you in the same window.
Chats are deleted automatically 30 days after the last message. Your browser keeps a random session key so you can return to the same chat; you can remove it by clearing the site data in your browser.
The content of chats is never sent to analytics or advertising tools: they only learn that the chat was opened or a button was pressed.

7. Who receives your data

We share personal data only with those who need it for the purposes above, and only to the extent needed:

Our authorised team members who answer enquiries and chats.
Hosting, cloud and security providers – website delivery, protection from attacks and spam, processing of forms and the chat, chat storage.
Messaging services – delivery of form enquiries and chat requests to our team.
An artificial intelligence service provider – automatic answers in the chat.
Analytics and advertising services – visit statistics, click maps and an anonymised replay of how pages are scrolled and clicked, measurement of our ads. What you type into the chat and the forms is excluded from these recordings.
Map and spreadsheet services – the map on the site and the events schedule.
Professional advisers (accountants, auditors, lawyers) bound by confidentiality, and government authorities or courts where the law requires it.

Service providers process data on our instructions or, for their own services, as independent controllers under their own privacy policies. You can ask us for the list of our current providers.

8. Transfers outside Thailand

Some of our service providers store or process data outside Thailand, for example in the United States, the European Union or other countries. When data is sent abroad we rely on the safeguards permitted by sections 28–29 of the PDPA, such as contractual data protection terms (standard contractual clauses) with the provider, and use only providers that maintain recognised security standards.

9. How long we keep data

Chats with Cha – 30 days after the last message, then deleted automatically.
Form enquiries and messages to our team – as long as needed to answer you and to continue the cooperation you asked for, and afterwards as long as the law requires (for example, accounting records), then deleted or anonymised.
Technical anti-spam records – irreversibly hashed IP values for up to 2 days.
Analytics and advertising data – for the period set in the settings of the respective services, after which it is deleted or aggregated.

10. Cookies and similar technologies

Necessary: the chat session key in your browser's local storage and the anti-spam check that protects the forms and the chat. Without them these features do not work.
Analytics: cookies and similar identifiers that count visits and show which pages and buttons are used.
Advertising: cookies that measure the results of our ads.

You can block or delete cookies and site data in your browser settings or use your browser's tracking protection; the site keeps working without analytics and advertising cookies. You can also object to analytics by writing to us.

11. How we protect data

We use appropriate technical and organisational measures: encrypted connections (HTTPS), access only for authorised team members, protection of the forms and the chat against automated abuse, storage of IP addresses only in hashed form, minimal data collection and automatic deletion of chats. No system is completely secure, but we review these measures and, if a personal data breach occurs, we will act as required by the PDPA, including notifying the authority and you where required.

12. Your rights

Under the PDPA you have the right to:

access your personal data and obtain a copy, and ask how we obtained data you did not give us;
receive your data in a commonly used electronic format or ask us to send it to another controller (data portability);
object to processing based on our legitimate interest, including analytics;
ask us to delete, destroy or anonymise your data;
ask us to restrict the use of your data;
ask us to correct inaccurate or incomplete data;
withdraw consent at any time where we rely on consent, without affecting processing before the withdrawal;
complain to the Office of the Personal Data Protection Committee (PDPC) of Thailand.

To use your rights, write to [email protected]. We may ask you to confirm your identity and will answer within 30 days. In some cases set by the law we may refuse a request and will explain why. To help us find a chat, tell us roughly when it took place and on which page.

13. Children

The site is not directed at children. If you are under 20 years old, please ask a parent or guardian before sending us personal data. If we learn that we hold data of a minor without the required consent, we will delete it.

14. Changes to this policy

We may update this policy when the site, our services or the law change. The date of the last update is shown at the top of this page; significant changes will also be highlighted on the site.