Privacy Policy
Harmony Life Samui Co. LTD · 23/573, Moo 4, Bo Phut Subdistrict, Koh Samui 84320, Surat Thani Province, Thailand · Tax ID 0845567021090 · +66 80 876 8276 · hello@harmonylife.asia
Privacy Policy
Harmony Life Samui Co. LTD — harmonylife.asia
Version 1.0 — effective 12 August 2026
This notice is published in Polish and English. Both versions are meant to say exactly the same thing; if you find a difference, the version written in your own language is the one that applies to you. German and French versions are not published yet — if you would rather have any part of this explained in German or French, write to us and we will answer you in that language.
1. Who we are, and what this notice is
We are Harmony Life Samui Co. LTD, a company registered in Thailand. We rent out nine private-pool villas on Koh Samui. We are the data controller for the personal data described here — that means we decide why and how it is used, and we are the ones answerable for it.
| Company | Harmony Life Samui Co. LTD |
| Registered address | 23/573, Moo 4, Bo Phut Subdistrict, Koh Samui 84320, Surat Thani Province, Thailand |
| Thai tax ID | 0845567021090 |
| Represented by | Robert Szymanski |
| E-mail for privacy questions and data requests | robert@harmonylife.asia |
| General e-mail | hello@harmonylife.asia |
| Telephone | +66 80 876 8276 |
| Guest liaison | Kacper Szewczak — WhatsApp: https://wa.me/message/LG2JQHFUT3IOI1 |
| Website | https://www.harmonylife.asia |
This notice tells you what we collect, why, who else sees it, how long we keep it, and what you can make us do about it. It covers the website, the booking flow, the enquiry forms, and your stay with us. It does not cover other companies' websites you reach by clicking a link from ours.
We do not sell your data. We do not run advertising trackers. We do not build profiles of you. There is nothing hidden in this document that contradicts those three sentences.
2. Which privacy law applies to you
Two laws apply to us at the same time, and we comply with both.
Thailand's Personal Data Protection Act B.E. 2562 (PDPA) applies because we are a Thai company operating in Thailand.
The EU General Data Protection Regulation (GDPR) applies to us as well. We publish this site in Polish, German and French, we take card payments from people in Europe, and we clearly aim our business at guests travelling from the EU. That brings us inside Article 3(2)(a) GDPR — the rule that catches non-EU businesses offering services to people in the Union.
One important detail, because it is often stated wrongly: what matters under the GDPR is where you are, not what passport you hold. A Thai national booking from Warsaw is protected by the GDPR. A Polish national already living in Thailand may not be. We cannot reliably tell which is which at the moment you book, so we apply the GDPR standard to every booking, for everyone. Where the two laws differ, we apply whichever gives you more protection.
3. An EU representative — where we stand
Because we are established outside the EU and offer services to people inside it, Article 27 GDPR requires us to appoint a representative in an EU Member State whom you and data protection authorities can contact directly.
We have not appointed one. We would rather write that sentence than let you assume otherwise, and we are not going to fill this space with a name that does not exist. It is being dealt with, and this notice will be updated with the representative's name, postal address and e-mail when it is.
What this does not change: you can write straight to us at robert@harmonylife.asia, and we answer privacy requests ourselves, within the time limits in section 14. The missing representative is never a reason we will give you for a delay. And it takes nothing away from your right to complain to your own national authority — section 16 explains how, and you do not need to go through us to do it.
We are not required to appoint a Data Protection Officer under either the GDPR or the PDPA, and we have not appointed one. Privacy requests go to the addresses in section 15.
4. What we collect, why, on what legal basis, and for how long
This is the core table. Everything else in this notice explains or expands on it.
| # | What we do (purpose) | What we collect | Legal basis — GDPR | Legal basis — Thai PDPA | How long we keep it |
|---|---|---|---|---|---|
| 4.1 | Take and hold your reservation, check availability, hold the villa while you pay | Name, e-mail, stay dates, villa type, number of guests, your free-text notes, site language (locale), booking reference | Art. 6(1)(b) — necessary to take steps at your request before a contract, and then to perform it | s.24(3) — necessary to perform a contract you are party to | See 4.11–4.13 below |
| 4.2 | Take the reservation deposit, take the balance of the stay by card ten days before arrival, and issue refunds | Amount, currency, Stripe checkout session ID and payment ID, refund status, date | Art. 6(1)(b) | s.24(3) | See 4.13 |
| 4.3 | Contact you about your booking — confirmation, arrival details, changes, answering your questions | Name, e-mail, optional phone, the content of your messages to us | Art. 6(1)(b) | s.24(3) | See 4.13 |
| 4.4 | Phone contact where you gave us a number — urgent operational matters around arrival (late flight, gate code, storm) | Phone number (optional) | Art. 6(1)(f) — our legitimate interest in reaching you quickly when e-mail is too slow. It is optional, so we do not pretend it is "necessary" for the contract | s.24(5) — legitimate interest | Deleted with the booking record, or sooner if you ask |
| 4.5 | Stop abuse of the booking system — cap how many free, unpaid holds a single browser can place at once | Your IP address, captured automatically when you start checkout | Art. 6(1)(f) — legitimate interest. Full reasoning in section 5.1 | s.24(5) — legitimate interest | 30 days, then permanently erased. See 5.1 |
| 4.6 | Defend a card dispute (chargeback) if one is raised against a payment | The booking record, the version of the terms you accepted and when, the deposit receipt, our messages with you, your IP at purchase | Art. 6(1)(f) — establishing and defending legal claims | s.24(5) | See 4.13 |
| 4.7 | Answer enquiries sent through the forms on this site (long-stay enquiries, invitation/referral forms) | Name, e-mail, phone if you give one, your message, dates you mention, referral code if you arrived via a partner link | Art. 6(1)(b) where you are asking about a booking; Art. 6(1)(f) — responding to people who contact us — otherwise | s.24(3) / s.24(5) | 24 months from your last contact |
| 4.8 | Register you with Thai Immigration on arrival (TM.30) — anyone in Thailand who houses a foreign national must report them within 24 hours | Passport details, nationality, date of birth, arrival and departure dates, as required by the immigration form | Art. 6(1)(f) — our legitimate interest in complying with the law that governs us and in being able to accommodate you lawfully at all. We deliberately do not claim Art. 6(1)(c): that basis only covers obligations imposed by EU or Member State law, and this is Thai law | s.24(6) — compliance with a legal obligation | The report itself sits with the Immigration Bureau under their rules, not ours. Our own copy of your passport details is kept for 12 months after you check out, then deleted |
| 4.9 | Keep our accounts and meet Thai tax law | Booking reference, your name, dates, amount, currency, payment and refund IDs, the receipt and the accounting entry | Art. 6(1)(f) — legitimate interest in complying with Thai accounting and tax law and defending claims. Again, not Art. 6(1)(c), for the reason given in 4.8 | s.24(6) | 5 years from the end of the financial year (Thai Accounting Act B.E. 2543) |
| 4.10 | Send marketing e-mail — only if we ever launch a mailing list, and only if you tick the box | E-mail, name, language | Art. 6(1)(a) — your consent, which you can withdraw at any moment | s.24 — consent | Until you unsubscribe, plus 3 years for the consent record |
| 4.11 | Retention: reservations you started but never paid for | — | — | — | 90 days, then the whole record is deleted |
| 4.12 | Retention: bookings cancelled before any payment was taken | — | — | — | 12 months after the dates you had reserved |
| 4.13 | Retention: paid bookings | — | — | — | 540 days (about 18 months) after the later of the payment date and your check-out date. Then we delete everything except the minimal financial record in 4.9 — and we delete your free-text notes, your phone number, your locale and any residual IP at that point |
One thing worth saying plainly about our accounts. We are not registered for Thai VAT. Our prices carry no VAT, we do not issue a Thai tax invoice, and there is no VAT record about you anywhere in our systems — what section 4.9 covers is an ordinary receipt and the bookkeeping entry behind it.
Two things we want to say plainly about retention. The 540-day figure is not us being greedy. Card networks let a cardholder dispute a payment for services not yet received up to 540 days after the transaction, and we accept bookings up to 12 months ahead. If we deleted your record earlier, we would be unable to answer a dispute — including one raised fraudulently in your name. And the 5-year financial record is the legal minimum for a Thai company; it contains no free text, no phone number and no notes.
5. A closer look at three things
5.1 Your IP address, and why we think we are entitled to use it
When you press the button that starts checkout, our server records the IP address the request came from. Here is exactly what it does and does not do.
What it is for. A reservation hold is free and instant, and it takes a villa off sale for 35 minutes. We have nine villas. A handful of automated or bad-faith requests can make the whole property look fully booked. So we refuse a fourth simultaneous unpaid hold from the same IP address.
Why we cannot do it a gentler way. We also cap holds by e-mail address, at two at a time — but disposable e-mail addresses defeat that on their own. A CAPTCHA would put friction and an extra third-party company in front of every honest guest. Requiring payment before a hold would break the way booking works. The check has to live in the database because the site runs on stateless servers where in-memory counting does not work.
What it is never used for. We do not use your IP address to work out where you are, to price differently, to advertise, to measure the site, to build a profile, or to make any decision about you as a person. It is compared to a number and nothing else. It is never shared with anyone for this purpose.
Why we think this is fair to you. The check is invisible unless you are doing something no ordinary guest does. It involves a single technical identifier, not the content of anything. It is collected during a booking you started yourself, so using it to keep that booking system working is well within what you would reasonably expect. Recitals 47 and 49 of the GDPR recognise fraud prevention and system security as legitimate interests, and the EU Court of Justice confirmed in Breyer (C-582/14) that a website operator can have a legitimate interest in storing visitor data to protect the service.
How long we keep it. The abuse check only ever looks at holds that are still live, so your IP address stops being useful to us after about 35 minutes. It is erased 30 days after collection, automatically — nothing about that erasure depends on you asking for it. Thirty days rather than thirty-five minutes only because a repeated pattern of abuse sometimes needs looking at across a few weeks.
Your right to object. You can object to this specific use at any time under Art. 21(1) GDPR. Write to robert@harmonylife.asia. We will erase your address unless we can show compelling grounds to keep it, and we will tell you either way.
We also pass your IP address to Stripe as part of the payment, where it serves a second purpose: it is one of the pieces of evidence that proves a payment was genuinely made by you, and it is what we would use to defend you and us against a fraudulent dispute. You can ask us for the written balancing assessment behind all of this and we will send it to you.
5.2 Payments — what Stripe does and what we never see
Your card payments are handled by Stripe — both the reservation deposit and the balance of the stay, which you pay by card through a Stripe link we send you ten days before arrival. We never see, receive or store your card number, expiry date or security code. Those go straight from your browser to Stripe.
Stripe is not simply our supplier. For the card payment itself, Stripe acts as an independent controller: it decides how to handle your card details for completing the payment, for preventing fraud, and for meeting its own financial regulation. That processing runs under Stripe's own privacy policy, not ours. We describe this accurately rather than calling Stripe "our processor", because that would misdescribe who is answerable for your card data.
What we keep from a payment is: the amount, the currency, the Stripe checkout session and payment identifiers, whether it succeeded, and whether it was refunded. That is what lets us match a payment to your booking, refund you, and prove a payment happened.
Your card statement will show a charge for your Harmony Life booking, taken through Stripe. Banks shorten and reformat these descriptions, so the entry on your statement may not read exactly like our name — and a charge you cannot place is the charge people dispute. If you see one, e-mail us the date and the amount at hello@harmonylife.asia before you go to your bank, and we will identify it for you the same way we would answer a dispute.
5.3 Enquiry forms, and an honest word about FormSubmit
The enquiry forms on this site (the long-stay form and the invitation form) are delivered to us by e-mail through a free third-party service called FormSubmit. When you press send, your browser posts what you typed directly to FormSubmit's servers, and FormSubmit e-mails it to us.
We are telling you this in plain terms because we cannot honestly claim otherwise: FormSubmit does not offer us a data processing agreement, Standard Contractual Clauses, or a stated retention period or server location. Every other company in section 7 does. Please do not put anything sensitive in a form message. If you would rather not use FormSubmit at all, e-mail us directly at hello@harmonylife.asia — it reaches the same inbox, and an e-mail is treated exactly like a form.
If you arrived through a partner's invitation link (/go/<code>), the referral code travels with your enquiry so we know who to thank. We do not send your name, e-mail, phone number or booking details to referral partners — not when you enquire, not when you book, and not when commission is settled. Partners have no login, no dashboard and no report from us. What a partner is told is how many bookings came through their code and what commission that adds up to. If your booking is the only one under a code, a partner may of course be able to work out that you came — but that is inference from what they already knew when they gave you the link, not something we disclose.
6. Do you have to give us this data?
| Data | Do you have to? | What happens if you don't |
|---|---|---|
| Name, e-mail, stay dates, villa type, number of guests | Yes — we cannot make a booking without them | No reservation can be made |
| Phone number | No, optional | Nothing. We will use e-mail |
| Notes / special requests | No, optional | Nothing. We just won't know about a request |
| Site language | Collected automatically from your choice of language | — |
| IP address | Collected automatically with your request; it is not something you type | — |
| Card details | Required by Stripe to take the deposit and, later, the balance | The payment cannot be made |
| Passport details at check-in | Yes — Thai law requires us to report foreign guests to Immigration | We cannot lawfully accommodate you |
None of this is a statutory requirement under EU law. The booking fields are a contractual requirement — they are what a reservation is made of. The passport requirement is imposed on us by Thai immigration law.
7. Who else receives your data
We keep this list short on purpose, and we name every company rather than hiding behind "trusted partners".
| Recipient | Where | Their role | What they actually receive |
|---|---|---|---|
| Supabase | Singapore (managed PostgreSQL) | Our processor — this is the database your reservation lives in | The whole reservation record: name, e-mail, optional phone, dates, villa type, guest count, notes, locale, booking reference, Stripe identifiers, and your IP address until it is erased |
| Vercel | United States / global CDN | Our processor — hosts and serves this website | Everything you send to the site passes through Vercel in transit, plus standard server logs including IP address, request time, page requested and browser user-agent |
| Stripe | United States / global | Independent controller for the card payment; our processor for related services | Your card details (which we never see), your name and e-mail, the amount and currency, the booking description, and your IP address at the moment of purchase |
| Resend | United States | Our processor — sends transactional e-mail (booking confirmations). Not yet enabled at the date of this notice | Your name, e-mail address, booking reference and booking details, so the message can be written and delivered |
| FormSubmit | Not disclosed — FormSubmit publishes no server location | Delivers enquiry-form messages to our inbox. See our honest warning in section 5.3 | Whatever you type into an enquiry form: name, e-mail, phone if given, message, dates, referral code |
| Google (Google Apps Script / Google Sheets) | United States / global | Our processor — the private spreadsheet the owner uses to reconcile bookings | One row per booking: booking reference, villa, check-in and check-out dates, number of nights, number of guests, your name, your e-mail, your phone if given, the deposit amount, and your language |
| Our own team | Thailand | Not a third party — Robert Szymanski, Kacper Szewczak and the villa operations staff | Only what they need to prepare and run your stay |
Three notes on Google, because "Google" covers several very different things. The only guest data that reaches Google is the booking row described above, sent from our server to a private Google Sheet used as the owner's booking log. Separately, the site uses two Google typefaces (Inter and Playfair Display) — but these are downloaded once when the site is built and served from our own domain, so your browser never contacts Google to load a font and Google never sees your visit. And the "Open in Google Maps" link is an ordinary outbound link: nothing is sent to Google unless you click it, and if you do, you are on Google's website under Google's privacy policy.
There is no Google Analytics on this site, and no other analytics or advertising product from anyone. If we ever add one, we will update this notice before it goes live and ask for your consent first — analytics is not exempt from the consent rules described in section 9, and we are not going to pretend it is.
WhatsApp. If you message Kacper on WhatsApp, that conversation happens on Meta's platform and Meta processes it under its own terms. We use WhatsApp because guests like it, but we do not control it. For anything formal — a data request, a complaint, a cancellation — please use e-mail, so there is a proper record.
We also disclose data where we are legally required to: to Thai Immigration (section 4.8), to the Thai Revenue Department in the ordinary course of tax administration, and to a court, regulator or card network where we are obliged to respond. We will tell you if that happens, unless we are legally forbidden from doing so.
8. Sending data outside the EU — described honestly
Some businesses in our position write "we are outside the EU already, so international transfer rules do not apply to us." That is not correct, and we would rather explain the real position.
Where our processing is caught by the GDPR because we offer accommodation to people in the EU, Chapter V of the GDPR applies to us as a data exporter — even though we are in Thailand and our suppliers are in Singapore and the United States. The rule is triggered by us being subject to the GDPR, not by data physically leaving Europe.
Neither Thailand nor Singapore has an EU adequacy decision. So for each of the suppliers above we rely on the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914. Recital 7 of that Decision expressly permits a non-EU controller who is subject to Art. 3(2) GDPR — that is us — to use them.
| Recipient | Country | Safeguard we rely on |
|---|---|---|
| Supabase | Singapore | Standard Contractual Clauses (2021/914) under Supabase's Data Processing Addendum |
| Vercel | United States | SCCs under Vercel's DPA; EU-US Data Privacy Framework where certified |
| Stripe | United States | SCCs via Stripe's Data Transfers Addendum; EU-US Data Privacy Framework where certified |
| Resend | United States | SCCs under Resend's DPA (once transactional e-mail is enabled) |
| United States | SCCs under Google's data processing terms | |
| FormSubmit | Unknown | None. We have no agreement, no clauses and no stated safeguard with FormSubmit. See section 5.3 |
In each case the clauses are the ones that form part of the supplier's data processing terms as we have accepted them for our account — we did not negotiate bespoke ones and we are not going to imply that we did. Ask us and we will send you the exact document that applies, or tell you plainly if there isn't one, as with FormSubmit. Write to robert@harmonylife.asia.
Under the Thai PDPA, the same transfers are made under sections 28–29: appropriate safeguards through the data processing agreements above, and, for the payment leg, the exemption for transfers necessary to perform a contract with you.
In the other direction: when you type your details into a form on this site, you are sending them to us in Thailand yourself. Under EU guidance that is not a "transfer" needing its own safeguards, because there is no EU-based exporter — but you should know that your data is held and used in Thailand, and that Thailand's data protection regime, while modelled on the GDPR, is not identical to it.
9. Cookies and browser storage
This site does not use advertising cookies, analytics cookies, social media pixels, or fingerprinting. There is no cookie banner because, for the checkout cookie, none is legally required — and we would rather earn that position than over-claim it.
| Name | Type | What it does | How long | Consent needed? |
|---|---|---|---|---|
hl_res |
Cookie, first-party, HttpOnly, Secure, SameSite=Lax | Holds your reservation ID so that our server can confirm this browser is the one that made this reservation — it stops a stranger cancelling your hold | 40 minutes | No. It is strictly necessary for the checkout you asked for |
hl_ref |
Local storage (localStorage) | Remembers the referral code if you arrived through a partner's invitation link, so the partner gets credited | Until you clear it | Not exempt — it is not strictly necessary, and we are not going to claim it is. See below |
About hl_res. It is set only after you actively click to check out — never just from visiting a page. It is HttpOnly, so no script can read it. It lasts 40 minutes, matching the 35-minute hold. It carries no tracking function of any kind. It falls squarely within the exemption for storage that is strictly necessary to provide a service you explicitly requested — art. 399(3)(2) of the Polish Prawo komunikacji elektronicznej, § 25(2) Nr. 2 TDDDG in Germany, and Art. 82 of the French Loi Informatique et Libertés as read by the CNIL. Being exempt from consent does not exempt us from telling you about it, which is what this table is for.
About the referral code — the honest version. The referral code exists so that a partner who sent you to us gets credited. That is a commercial purpose that serves us and the partner, not a service you asked for. We are not going to claim it is "strictly necessary", because a regulator could check that claim against our own source code and find it wanting — and over-claiming here would undermine the entirely correct statement we just made about hl_res.
So we have decided the browser is the wrong place for it: the code is moving off your device and onto our own server, carried through the referral journey where it never touches your storage at all. That change has not shipped yet, and until it does this is exactly what happens. If you open a link like /go/kacp, your browser stores that short partner code — the literal text kacp — in local storage, so the partner is still credited if you wander off to the main site and enquire from another page. It is a partner's code, not an identifier for you: it is the same string for everyone who follows that partner's link, it says nothing about who you are, it is read only by our own enquiry forms, and it is never used to follow you around this site or any other. It has no expiry of its own, so it stays until you clear your browser's site data.
You can delete both of these at any time through your browser settings, and nothing about making or keeping a booking depends on the referral code — though deleting hl_res mid-checkout may mean you have to start the booking again. If you would rather not deal with browser settings, write to robert@harmonylife.asia and we will strip the referral code from anything we hold about you.
10. Automated decisions and profiling
We do not make automated decisions about you that produce legal effects or similarly significant effects, and we do not profile you. There is no algorithm scoring you, no dynamic pricing based on your device or country, and no automated acceptance or refusal of guests.
The abuse check described in section 5.1 is a fixed threshold applied to concurrent unpaid holds — "four at once from this address, wait a moment". It reaches no conclusion about you as a person and does not decide whether you may book. We mention it here rather than staying silent, so you can judge that for yourself.
11. Security
We protect your data with measures appropriate to its sensitivity: the whole site is served over HTTPS; the reservation database is a managed service with access restricted to the people who need it; card data never touches our systems at all; the checkout cookie is HttpOnly and Secure; and secrets and API keys are held server-side, never in the code your browser downloads.
No system is perfect. If a personal data breach happens and it is likely to put your rights at risk, we will tell you, and we will notify the relevant authorities — within 72 hours where feasible, as both the GDPR (Art. 33) and the Thai PDPA (s.37) require. Because we have no establishment in the EU, we must notify every supervisory authority concerned, not just one.
12. Children
Our villas are family-friendly and children are welcome as guests. But the booking is made by an adult, and this website is not directed at children. We do not knowingly collect personal data from a child making their own booking. If you believe a child has given us data directly, write to robert@harmonylife.asia and we will delete it.
13. Your rights
You have all of the following. They are free to use, and using them will never affect how we treat you as a guest.
| Right | What it means in practice |
|---|---|
| Access (GDPR Art. 15 / PDPA s.30) | Ask us what we hold about you and get a copy. The first copy is free |
| Rectification (Art. 16 / s.36) | Get anything wrong or incomplete fixed — a misspelled name, wrong dates, wrong guest count |
| Erasure (Art. 17 / s.33) | Ask us to delete your data. This one has honest limits — see below |
| Restriction (Art. 18 / s.34) | Tell us to keep the data but stop using it, for example while we sort out a dispute about whether it is accurate |
| Portability (Art. 20 / s.31) | Get your booking data in a structured, machine-readable file, or have us send it to someone else |
| Object (Art. 21(1)) | Object to the things we do on the basis of legitimate interest — the IP abuse check, and phone contact. We stop unless we can show compelling grounds |
| Object to marketing (Art. 21(2)) | Absolute. No balancing, no conditions, no delay. If we ever send marketing and you say stop, we stop |
| Withdraw consent (Art. 7(3) / PDPA) | Applies to the marketing list only. Withdrawing is as easy as giving it, and it does not make what we did before unlawful |
| Not be subject to automated decisions (Art. 22) | There are none. See section 10 |
| Complain (Art. 77 / PDPA) | See section 16 |
About erasure, honestly. We would rather tell you the limits now than refuse you later. We cannot delete data we still need to give you the stay you have booked; we cannot delete the payment evidence while a card dispute is still possible (up to 540 days); and we cannot delete the minimal financial record that Thai law requires us to keep for five years. Outside those cases, we will delete. And when a retention period ends, we delete without you having to ask. Any notice that promises unconditional deletion is promising something it will break.
14. How to exercise your rights
Write to robert@harmonylife.asia, with "Privacy request" in the subject line. Or post to Harmony Life Samui Co. LTD at the address in section 1. If you would rather telephone first, the number is +66 80 876 8276 — but please follow up in writing, so both of us have a record.
What happens next:
- We reply within one month. If your request is complicated we may take up to two further months, but we will tell you within the first month if that happens, and why.
- It is free, unless a request is manifestly unfounded or excessive — and we will explain ourselves before charging anything.
- We will ask you to confirm who you are only if we genuinely doubt it, and we will ask for the least we need. We will not demand a passport scan as a reflex; usually a message from the e-mail address on the booking is enough.
- If we refuse any part of a request, we will tell you which part, why, and how to challenge it.
WhatsApp is fine for asking a quick question about privacy. For a formal request, please use e-mail — a messaging app is a poor place to verify identity and a poor record for both of us.
15. Contact details, in one place
| For | Contact |
|---|---|
| Privacy requests and questions | robert@harmonylife.asia — Robert Szymanski |
| General enquiries, bookings, anything else | hello@harmonylife.asia |
| Guest liaison, day to day | Kacper Szewczak — WhatsApp: https://wa.me/message/LG2JQHFUT3IOI1 |
| Telephone | +66 80 876 8276 |
| Post | Harmony Life Samui Co. LTD, 23/573, Moo 4, Bo Phut Subdistrict, Koh Samui 84320, Surat Thani Province, Thailand |
16. Complaining to a data protection authority
Please come to us first — robert@harmonylife.asia — because most problems are a misunderstanding we can fix in a day. But you never have to, and you do not need our permission to go elsewhere.
You have the right to complain to a data protection supervisory authority. One thing to know about our structure: because we have no establishment in the European Union, there is no single "lead" authority for us and no one-stop-shop. That works in your favour. You can complain to the authority of the EU or EEA country where you live, where you work, or where you think the problem happened — in your own language.
- Poland — Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl
- Germany — the data protection authority of your federal state (a list is published by the BfDI at bfdi.bund.de)
- France — Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, 75007 Paris, cnil.fr
- Any other EU/EEA country — your national authority is equally competent
- Thailand — because we are a Thai company, you may also complain to the Personal Data Protection Committee (PDPC), pdpc.or.th
If your complaint is about our service rather than your data, write to hello@harmonylife.asia: we reply within 3 working days and aim to have it resolved within 14 days.
You can also go to court instead of, or as well as, complaining. Under Art. 79(2) GDPR you may bring proceedings in the courts of the EU country where you live — you do not have to come to Thailand.
17. Changes to this notice
If we change how we use your data, we will update this page, change the version number and effective date at the top, and — where the change matters to you — e-mail everyone with a live booking before it takes effect. We will never quietly start using data we already hold for a new purpose without telling you first.
Previous versions are available on request.
18. Things this notice deliberately does not say
We would rather list what we have left out than let you assume it.
- We do not claim to be certified, audited, or accredited by anyone. We have no privacy seal.
- We do not name a representative in the European Union, because we have not appointed one. Section 3 says so in full rather than leaving a name-shaped gap you might read as filled.
- We do not claim membership of any dispute-resolution scheme. The EU's ODR platform was shut down on 20 July 2025 and no longer exists; if you see a link to it anywhere on our site, it is a mistake and we would be grateful if you told us.
- We do not promise a response time faster than the one in section 14, because we would rather meet a promise than make a better one.
- We do not print numbers we cannot stand behind. The company name, address and Thai tax ID in section 1 are the identifiers we publish, and each of them can be checked against the Thai company register. Anything we could not verify has been left out of this notice rather than dressed up as a fact.
Harmony Life Samui Co. LTD · Thai tax ID 0845567021090 · 23/573, Moo 4, Bo Phut Subdistrict, Koh Samui 84320, Surat Thani Province, Thailand · hello@harmonylife.asia · +66 80 876 8276 · Version 1.0, effective 12 August 2026