Privacy Policy
Last Updated: September 16, 2026
Overview & Legal Entity
This Privacy Policy explains how Hua Hin Events, owned and operated by Elder Blossom Residence Co., Ltd. (we, us or our), handles personal data when you visit our website, book events or bundles, pay online through Omise, reserve at-door admission, subscribe to newsletters or contact us.
Data Controller Information
The designated data controller responsible for your personal data under the Thailand PDPA is:
Personal Data Collected & Consequences of Non-Provision
Required Booking & Contact Information:
Participant names, a contact email, telephone number and booking details marked as required are needed to arrange admission and communicate about the booking. Without them we cannot complete the reservation. Online payment also requires payment information submitted to Omise. Newsletter consent and optional notes are not a condition of booking. If you provide details for other participants, share this notice with them.
Payment & Transaction Identifiers:
Booking and transaction references, payment status, selected payment method and billing contact details. Online payments are processed through Omise. Card details are tokenized by the payment provider; our servers do not store full card numbers or CVV codes.
Technical Telemetry & Security Data:
When analytics is enabled, we use a random first-party browser cookie for up to 90 days to recognise repeat visits. A separate visit cookie expires after 30 minutes without a new pageview. We store secret-key hashes of these identifiers with the public page viewed, time, language, device type, browser, operating system, country estimate and general referral source. We do not store raw IP addresses, full browser identification strings, URL query parameters or email-management tokens in page-view records. These records are pseudonymous, not anonymous. They are retained for up to 365 days and shown to administrators in summary reports. Turning analytics off stops future collection and removes these cookies. Private account and email-management pages are excluded.
When analytics is enabled, our server temporarily uses your IP address to estimate your country using a locally stored country lookup database. We save only the country code in our page-view records, not the IP address, and do not send your IP address to an external country lookup service. This does not determine your precise location or nationality. VPNs, proxies and mobile networks can affect the estimate; if a country cannot be identified, it is recorded as unknown.
When analytics is enabled, we also measure approximate active time on pages and count accepted contact enquiries without saving their content in analytics. Time measurement pauses while a page is hidden or after one minute without interaction. These analytics records are kept for up to 365 days. You can turn analytics off using the cookie preferences below.
Event Photography & Video Media:
Photographs and video footage captured during public performances and cultural events for archival and promotional use on our official website and social media channels. Attendees who prefer not to appear in close-up media may inform our team on-site upon arrival or contact us to request exclusion.
Lawful Bases for Data Processing
We rely on contractual necessity for bookings, payments, confirmations and refunds; legal obligations for accounting and lawful authority requests; and legitimate interests, balanced against your rights, for proportionate security, fraud prevention, service improvement and event documentation. We rely on consent for optional newsletters and where required for analytics, advertising or identifiable promotional media. Consent can be withdrawn without affecting earlier lawful processing.
Data Retention Periods & Criteria
We retain booking and transaction records as needed to fulfil the booking, handle refunds or disputes and meet applicable accounting, tax and limitation periods. Security records are retained according to investigation needs and relevant claim periods. First-party page-view records are scheduled for deletion after 365 days. Newsletter contact details are retained while subscribed; after withdrawal, a limited suppression record may be kept to respect your choice. Media is reviewed against its continuing archival or promotional purpose. Data no longer needed is deleted or anonymized, subject to legal holds and backup rotation.
Third-Party Disclosures & Cross-Border Data Transfers
We do not sell or rent personal data. We disclose relevant data to the following recipients as needed for the purposes described in this notice:
Payment Gateways & Cloud Infrastructure:
Opn Payments / Omise Thailand (licensed payment gateway under the Bank of Thailand) for payment processing, Cloudflare R2 / CDN (global cloud infrastructure for asset delivery), and secure transactional email delivery services.
Analytics & Security Providers:
Google LLC (Google reCAPTCHA, Google Analytics) and Meta Platforms, Inc. (Meta Pixel) for fraud mitigation and engagement measurement.
Overseas Safeguards (PDPA Sec. 28/29):
Hosting, Cloudflare storage, email delivery, Omise, Google and Meta may process data outside Thailand, including in Singapore and the United States. International transfers must have an applicable PDPA basis, such as adequate protection, appropriate contractual safeguards supporting enforceable rights, or another lawful exception. Relevant safeguards include restricted access, secure transmission and data-processing terms where applicable. Contact info@huahinevents.com for information about recipients and applicable transfer safeguards.
Statutory Disclosures:
Government agencies, tax authorities, or law enforcement bodies when legally required under Thai statutory law.
Your Statutory Rights (PDPA Compliance)
Under the Thailand Personal Data Protection Act (PDPA), you possess the following statutory rights regarding your personal data:
Right to Access
Request access to or obtain a copy of the personal data we hold about you.
Right to Rectification
Request prompt correction of inaccurate, incomplete, or outdated personal records.
Right to Erasure
Request deletion or anonymization of your data where processing is no longer necessary or lawful.
Right to Restrict Processing
Request the temporary restriction of processing while data accuracy or lawful basis is verified.
Right to Object
Object at any time to data processing based on legitimate interests or direct marketing.
Right to Data Portability
Request your personal data in a structured, readable format, or request transmission to another controller where technically feasible.
Right to Withdraw Consent
Withdraw previously granted marketing or newsletter consent at any time without retroactive penalty.
Right to Lodge a Complaint
Lodge a complaint with the Personal Data Protection Committee (PDPC / สคส.) if you believe our data processing violates Thailand PDPA regulations.
To exercise your rights, contact info@huahinevents.com; we may verify your identity and explain any lawful limitations. You may lodge a complaint with Thailand’s Personal Data Protection Committee. Withdrawing newsletter consent does not affect necessary booking communications.
Cookies, Telemetry & Security (reCAPTCHA)
Cookies & Pseudonymized Telemetry: When analytics is enabled, we use a random first-party browser cookie for up to 90 days to recognise repeat visits. A separate visit cookie expires after 30 minutes without a new pageview. We store secret-key hashes of these identifiers with the public page viewed, time, language, device type, browser, operating system, country estimate and general referral source. We do not store raw IP addresses, full browser identification strings, URL query parameters or email-management tokens in page-view records. These records are pseudonymous, not anonymous. They are retained for up to 365 days and shown to administrators in summary reports. Turning analytics off stops future collection and removes these cookies. Private account and email-management pages are excluded.