Privacy Policy

Last updated: 6 Oct 2026

1. Who We Are

This website, https://luciole-bleue.com, and the accommodation services offered under the name La Luciole Bleue (“we,” “us,” or “our”) are based at 506 M.13, T. Tap Tai, A. Hua Hin, Prachuap Khiri Khan 77110, Thailand.

We are the data controller responsible for the personal data described in this policy. Based on the scale of our processing activities, we are not required to appoint a Data Protection Officer under Section 41 of Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

For any question about this policy or your personal data, or to exercise any of the rights described in Section 9, contact us at:

• Email: [email protected]
• Address: 506 M.13, T. Tap Tai, A. Hua Hin, Prachuap Khiri Khan 77110, Thailand

2. Personal Data We Collect

Website visitors. When you browse our website, our hosting and network providers (see Section 6) process technical connection data, such as your IP address, browser type and the pages you request, to deliver the site and protect it against attacks. Cloudflare also uses this data to give us overall visitor statistics without cookies. In addition, we collect limited statistical information, such as approximate location at city level, pages visited, and general visit patterns, through the analytics cookies described in Section 4.

Guests making a booking enquiry or reservation. When you enquire about or book a stay, we collect:

• Full name
• Nationality
• Contact details (email address, phone number)
• Dates and duration of stay
• Passport number and related passport identification details
• Payment information (processed directly by our payment provider; we do not store full card details ourselves)

We do not collect device or browser information as part of the booking process.

We collect your passport identifier because Thai law requires accommodation providers to register the details of foreign guests with local immigration authorities. This is a legal requirement, not optional, and we are unable to provide accommodation without it.

3. Why We Process Your Data

4. Cookies and Website Analytics

Our website uses analytics cookies (via Google) to understand how visitors use the site — for example, number of visitors, pages viewed, and approximate location at city level. Google Analytics 4 anonymizes IP addresses by default and does not store them, and location data is limited to a coarse, non-precise level.

Where required, we ask for your consent to these cookies when you first visit the site, and you may withdraw consent at any time through the cookie settings on our site or your browser settings.

Our website also uses a few strictly necessary cookies that do not require consent: one remembers the language you choose, and a session cookie keeps the site working while you browse. Our network provider, Cloudflare, may set security cookies to protect the site against automated attacks, and it measures overall traffic for us without cookies and without tracking individual visitors. Our pages also load fonts and a standard script library from Google’s servers, so Google receives your IP address when a page loads. 

5. Embedded Content

Our website includes embedded content from third parties, including our booking widget. Embedded content behaves the same way as if you had visited that third party’s website directly, and that third party’s own privacy policy governs their handling of your data.

6. Who We Share Your Data With

We share your data with the following service providers, each acting on our instructions:

• Beds24 — our property management system and booking engine, used to manage bookings, availability, and guest communication.
• Stripe — used to process payments securely. We do not store your full card details.
• Thailand Immigration Bureau — as required by law, in the same way hotels and other licensed accommodation providers must register their foreign guests.
• Hostinger — hosts our website.
• Cloudflare — delivers our website through its global network, protects it against attacks, and provides overall visitor statistics without cookies.
• Google — provides website analytics (Google Analytics) and serves the fonts and script library our pages use.
• Amazon Web Services — hosts the online guest library we share with guests during their stay.

We do not sell your personal data, and we do not share it with any party for that party’s own independent marketing purposes. 

7. International Data Transfers

Some of the providers listed in Section 6 are based outside Thailand, or process data outside Thailand, meaning your personal data may be transferred internationally.

Thailand’s Personal Data Protection Committee (PDPC) has not yet published a list of countries recognized as providing an adequate level of data protection. Where we transfer data outside Thailand, we rely on the applicable legal basis for each transfer, which may include standard contractual clauses recognized by the PDPC, the receiving provider’s own contractual data protection commitments, or the transfer being necessary for the performance of our contract with you. 

8. How Long We Retain Your Data

• Booking enquiries that do not result in a confirmed reservation are retained for 12 months, then deleted, unless you ask us to delete them sooner.
• For confirmed reservations, personal data (such as name, contact details, and passport identifier) is removed 3 years after checkout, and the underlying booking record is deleted entirely 5 years after checkout, in line with our property management system’s data retention settings.
• Passport and immigration registration data is retained for the period required under Thai immigration regulations, and in any event no longer than the periods set out above.
• We may retain limited data for longer where required under Thai accounting, tax, or other legal record-keeping obligations. 

9. Your Rights Under the PDPA

Under Thailand’s Personal Data Protection Act, you have the right to:

• Access the personal data we hold about you, and request a copy.
• Rectify inaccurate or incomplete personal data.
• Erase your personal data, except where we are required to keep it for legal, administrative, or security purposes.
• Restrict our processing of your data in certain circumstances.
• Object to certain processing, including direct marketing.
• Withdraw consent at any time, where processing is based on consent, without affecting processing already carried out.
• Receive a copy of your data in a structured, machine-readable format, where technically feasible.
• Lodge a complaint with Thailand’s Personal Data Protection Committee if you believe we have not complied with the PDPA.

To exercise any of these rights, contact us using the details in Section 1. 

10. Data Security

We take reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse, and we require our service providers to do the same. Our website is served only over encrypted connections (HTTPS), and all traffic passes through Cloudflare’s network, which filters attacks before it reaches our server. 

11. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or in applicable law. The date at the top of this page shows when it was last revised. 

12. Contact Us

If you have any questions about this policy or how we handle your personal data, contact us at [email protected].