1. Our roles: controller and processor

For the property's own account and billing data, Naya People is the data controller. For guest data captured through bookings and LINE, the property is the controller and Naya People acts as its data processor, handling that data only on the property's instructions.

2. Information we collect

Depending on how the Service is used, this may include:

• Property account data — the details and admin users of the property.
• Guest data — name, contact details, LINE identifier, booking dates, room and stay details, and messages sent through LINE.
• Usage and device data — log-ins, IP address and actions in the web admin.
• Billing data — the information needed to invoice your subscription.

3. How we use personal data

We use personal data to take and manage bookings, hold room availability, communicate with guests through LINE on the property's behalf, secure and support the Service, process billing, and meet legal obligations.

4. Legal basis (PDPA)

We rely on the lawful bases under the PDPA — performance of a contract, legitimate interests in running and securing the Service, consent where required, and compliance with law. The property is responsible for having a lawful basis for the guest data processed through the Service.

5. Third-party platforms and sharing

The Service operates through LINE; guest interactions are also subject to LINE's own privacy terms. We do not sell personal data. We share it only with sub-processors that host and support the Service, professional advisers, or authorities where required by law.

6. Data retention

We keep personal data for as long as the account is active and as needed to provide the Service. After cancellation we make your data available for export for a reasonable period, then delete or anonymise it unless the law requires longer retention.

7. Data security

We apply appropriate technical and organisational measures — including access controls, encryption in transit, and database-level tenant isolation — to protect personal data against unauthorised access, loss or misuse.

8. Your rights under the PDPA

Subject to the PDPA, guests and other data subjects may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. As processor, we forward such requests to the relevant property (controller) or assist in responding.

9. International data transfers

Data is primarily processed in Thailand. Where a sub-processor operates outside Thailand, we put appropriate safeguards in place as required by the PDPA.

10. Children's privacy

The Service is intended for businesses. Where a guest booking involves a minor's data, the property is responsible for handling it lawfully, including obtaining any consent required.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here and, for material changes, provide reasonable notice.

12. Contact us

For privacy questions or to exercise your rights, contact Naya People Co., Ltd. using the details below. This policy is governed by the laws of Thailand.