Version dated October 10, 2026
1. Data Controller and Contact Information
The data controller responsible for data processing on this website, as well as for handling cruise inquiries and reservations, is:
Cruise Asia Co., Ltd.133/14 Ratchaprarop Road, Makkasan, Rajthevi, 10400 Bangkok, Thailand
Email: res@cruiseasia.net
Phone: +66 (0)2 640 1400
Website: https://www.cruiseasia.net / https://www.rvriverkwai.com
Data protection inquiries can be submitted directly to executive management at res@cruiseasia.net.
2. Website Access, Hosting, and Security
When accessing our website, technical log files (server log files) are automatically processed by our hosting provider (Akamai / Linode; server location: Singapore/Southeast Asia) and our security service provider (Cloudflare Inc., USA).
Processed Data: IP address, date and time of access, requested URL, referrer URL, volume of data transferred, web browser, and operating system.
Purpose & Legal Basis: Technical delivery of the website, performance optimization, spam prevention, and ensuring IT security (Legitimate Interest).
Storage Duration: Server log files are automatically deleted after 14 days at the latest. Backup copies are overwritten on a rolling basis after a maximum of 30 days.
Encryption: The entire website enforces end-to-end transport encryption (HTTPS/TLS).
3. Inquiries, Bookings, and Data Storage
We process your details to answer inquiries, prepare tailored cruise offers, and manage bookings for the RV River Kwai.
Processed Data: Name, email address, phone number, requested date, number of guests, dietary preferences/allergies, passport details (for passenger manifests), and payment proofs.
Special Categories of Data (e.g., Health/Dietary Requirements): If you provide us with sensitive details (such as allergies or mobility restrictions), we process these strictly based on your explicit consent for the safe execution of the cruise.
Storage and Processing:Reservation and guest data are processed locally and in the Google services we use. We use Google Sheets for reservation and rooming administration and Google email services for email correspondence. Processing in these services is not exclusively local.
Transfer to Third Parties: Sharing your data with unauthorized third parties or data brokers is categorically excluded. Transfers occur solely to partners directly involved in the journey (e.g., local transfer companies or harbor authorities in Kanchanaburi) as far as strictly required to fulfill the contract.
4. Google Workspace, Email & Form Processing
For email correspondence and internal operational processing, we use Google Workspace Business (Google Asia Pacific Pte. Ltd., Singapore / Google Ireland Limited).
Data Processing Agreement: A Data Processing Addendum (DPA) incorporating Standard Contractual Clauses (SCCs) is active with Google.
Email & Form Routing: Inquiries submitted via our website forms are transmitted to our central Google mailboxes using TLS encryption. Form logs stored on the website backend are automatically purged after 30 days.
Access Control: Access to Google mailboxes is restricted to authorized staff (Reservations & Sales) and protected by mandatory multi-factor authentication (2FA/MFA).
5. Cookies and Analytics Preferences
Our website uses cookies. Necessary cookies guarantee core website functionality. Analytics cookies help us understand how visitors interact with the site.
| Cookie Name | Type / Provider | Purpose | Storage Duration |
|---|---|---|---|
| ca_analytics_consent_v1 | Necessary (First-party) | Stores your preference selected in the cookie banner. | 180 days |
| PHPSESSID / wp-settings-* | Necessary (First-party) | Secures technical session & form validation. | End of session |
| _ga / _ga_* | Analytics (Google Analytics) | Distinguishes users and tracks page views. | Max. 14 months |
You can update or revoke your cookie settings at any time via the "Cookie Settings" link in our website footer.
6. Google Analytics 4 and Tag Manager
Subject to your consent via our cookie banner, we use Google Analytics 4 (GA4) and Google Tag Manager (Google Ireland Limited / Google LLC).
Scope of Measurement: Page views, session duration, traffic source (campaigns/referrers), and brochure PDF downloads are recorded. No names, email addresses, or form entries are transmitted to Google Analytics.
IP Anonymization: IP anonymization is enabled by default in GA4; IP addresses are truncated by Google within EU/EEA member states or at regional access nodes.
Retention Period: Event-level data retention in GA4 is configured to 14 months.
Revocation: You may revoke your consent with future effect at any time through our cookie settings.
7. Google Maps, YouTube, and reCAPTCHA
To ensure system functionality and security, we integrate the following services:
Google reCAPTCHA: Distinguishes human interaction from automated spam in form submissions. Technical data (IP address, mouse movements, dwell time) is sent to Google (Legal Basis: Legitimate Interest in IT security).
Google Maps & YouTube: Displays location maps and cruise video content. Media is integrated in privacy-enhanced mode (YouTube Privacy-Enhanced Mode). Technical access logs may be processed by Google upon loading.
8. International Data Transfers
Cruise Asia Co., Ltd. operates out of Thailand. Data processing occurs primarily in Thailand, as well as via service providers located in Singapore and the EU (Google data centers).
Where personal data is transferred outside the EU/EEA or Thailand, appropriate safeguards (such as EU Standard Contractual Clauses and corresponding measures under the Thai Personal Data Protection Act – PDPA) ensure an adequate level of data protection.
9. Data Retention and Deletion Schedule
We store personal data only for as long as necessary to fulfill the intended purpose or to comply with statutory retention requirements:
Server Log Files & Form Logs: 14 to 30 days.
Non-Binding Inquiries (Without Booking): Deletion after 6 months.
Completed Bookings & Invoices: Retained for 10 years in accordance with Thai commercial and tax laws.
Sensitive Guest Data (Dietary/Health): Deleted no later than 30 days after the end of the cruise.
Analytics Data: Max. 14 months.
Upon expiry of the respective periods, data is permanently and irreversibly erased from our local systems.
10. Your Rights
Under applicable data protection laws (in particular the Thai PDPA and, where applicable, the GDPR for residents in the EU), you possess the following rights:
Access & Copy: The right to request confirmation and a copy of your personal data processed by us.
Rectification: The right to correct inaccurate or incomplete data.
Erasure ("Right to be Forgotten"): The right to request data deletion, provided no statutory retention obligations apply.
Restriction & Objection: The right to object to or request the restriction of processing.
Withdrawal of Consent: You may withdraw consent (e.g., for analytics cookies) at any time with future effect.
Right to Lodge a Complaint: The right to lodge a complaint with the competent supervisory authority (Office of the Personal Data Protection Committee – PDPC in Thailand or the supervisory authority in your EU member state of residence).
To exercise your rights, please submit your request by email to: res@cruiseasia.net.
11. Currency and Amendments
This Privacy Policy is currently valid and effective as of October 10, 2026. Future technical developments or legal updates may require adjustments to this policy. The latest version can always be accessed on this page.
