Legal

Data Retention Notice

June 2026 · The Blue Spice Samui, Koh Samui

DATA RETENTION POLICY DRAFTED — AUTOMATION NOT IMPLEMENTED. Deletion periods described below reflect our intended policy. Manual deletion is available on request.

Overview

We retain personal data only as long as necessary to fulfil the purpose for which it was collected, to comply with legal obligations, and to resolve any disputes. All data is stored in our reservation management system hosted on Neon (PostgreSQL) infrastructure.

Retention Periods by Category

Reservation Data

Guest name, date, time, party size, special requests, and reservation status.

Retention period: 2 years from reservation date

Legal basis: Legitimate interest — operational records, dispute resolution.

Guest Contact Data

Name, email address, WhatsApp number, preferred language.

Retention period: 2 years from last interaction

Legal basis: Consent (provided at time of reservation) and legitimate interest.

Source Attribution Data

Website page, device type, locale, and referral source at time of reservation.

Retention period: 2 years from reservation date

Legal basis: Legitimate interest — service improvement and fraud prevention.

Consent Records

Record that consent was given, consent version, and timestamp.

Retention period: 3 years from date of consent

Legal basis: Legal obligation — evidence of consent under PDPA.

Communication Logs

Record of emails sent or queued in connection with a reservation.

Retention period: 2 years from send date

Legal basis: Legitimate interest — service delivery records.

Email Delivery Logs

Technical logs from Resend (email delivery provider) showing delivery status.

Retention period: Subject to Resend's own retention policy (typically 30–90 days for delivery logs).

Legal basis: Legitimate interest — troubleshooting and delivery verification.

Review / Follow-Up Records

Records of any review requests or follow-up emails sent after a visit.

Retention period: 1 year from send date

Legal basis: Consent. Will not be activated until separate consent is implemented.

Future Data Categories — Stricter Retention Required

The following data categories are associated with planned future integrations. They are not currently collected. Stricter retention rules and explicit consent will be required before any of these are activated.

Massage / Wellness Preference Data

Future

May include health conditions, treatment preferences, and practitioner notes. Requires heightened protection as potentially health-related data under PDPA. Retention period to be determined with legal review.

Beach Day QR / Contact Data

Future

Guest check-in, feedback, and follow-up data from Beach Day app. Retention period to be determined. Manager escalation records may require separate handling.

Requesting Deletion

You may request deletion of your personal data at any time by contacting us. We will respond within 30 days. Automated deletion has not yet been implemented; all deletion requests are handled manually. Data Subject Request page.

Contact

For questions about data retention, contact us at:

The Blue Spice Samui

24, 37, Tambon Bo Put, Chang Wat Surat Thani 84320, Thailand

info@thebluespice.com