PRIVACY POLICY

1.1 Overview & Scope

Wood U Need Creative & Entertainment Co., Ltd. (“Wood U Need Space,” “we,” “us,” or “our”) is committed to safeguarding personal data in full compliance with the Thailand Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). This Privacy Policy describes how we collect, use, store, disclose, and protect personal data collected through:

• Our website (www.wooduneed.space) and related booking channels.

• In-person visits to our creative sanctuary, artisanal cafe, art showroom, and workshop spaces in Doi Saket, Chiang Mai.

• Overnight accommodations at our two-room nature homestay (Sanctuary Units 1 & 2).

• E-commerce purchases of handcrafted woodwork, ceramics, art pieces, and cafe delivery orders.

1.2 Data Controller Information

• Data Controller: Wood U Need Creative & Entertainment Co., Ltd.

• Registered Address: Doi Saket, Chiang Mai 50220, Thailand

• Data Protection Contact: privacy@wooduneed.space / contact@wooduneed.space

1.3 Personal Data We Collect

We collect personal data directly from you or through automated technical means:

1. Identity & Contact Details: Full name, nationality, national ID or passport number, telephone number, email address, physical delivery address, and emergency contact details.

2. Homestay & Immigration Compliance Data: Passport copies, entry visa details, arrival/departure dates, and TM.30 notification records required under the Thai Immigration Act B.E. 2522.

3. Transaction & Payment Data: Order history, billing address, bank transfer slips (for PromptPay/bank wires), and transaction tokens provided by licensed payment gateways. (Note: Full credit card numbers are processed directly by our PCI-DSS-compliant payment processors and are never stored on our servers).

4. Workshop & Event Participant Data: Session preferences, dietary restrictions or food allergies (for events involving tastings or tea ceremonies), and participant feedback.

5. Technical & Browsing Data: IP address, device type, browser settings, operating system, pages visited, and session cookies collected via our website platform (Wix).

6. Visual Records: CCTV footage operating in public, exterior, and common sanctuary grounds for security and safety purposes; event photography where prior notice or explicit consent has been given.

1.4 Legal Bases & Purposes for Processing

Under the PDPA, we process your personal data based on the following legal grounds:

• Performance of Contract: To fulfill e-commerce orders, confirm workshop registrations, manage homestay bookings, and process payments.

• Legal Obligation: To comply with Thai law, including TM.30 guest reporting to the Chiang Mai Immigration Bureau, commercial tax invoicing, and corporate accounting requirements under the Thai Revenue Code.

• Legitimate Interests: To ensure physical security on sanctuary grounds, improve website functionality, manage workshop capacities, and prevent fraud.

• Consent: To send promotional newsletters, community event invitations, and special retreat offers via email or messaging channels (which can be withdrawn at any time).

1.5 Data Sharing & Disclosures

We do not sell, rent, or trade your personal data. We disclose information only to:

• Government & Regulatory Authorities: The Immigration Bureau of Thailand (for TM.30 hotel/homestay compliance) and the Thai Revenue Department.

• Third-Party Service Providers: Licensed payment processors (e.g., Kasikornbank K BIZ, Opn/Omise), delivery partners (Thailand Post, Flash Express, GrabFood), and web hosting/IT providers (Wix) under strict data protection agreements.

• Professional Advisors: Our retained legal counsel, licensed corporate accountants, and auditors.

1.6 Data Retention & Security

• Retention Periods: Transaction and tax records are retained for a minimum of 5 to 7 years in accordance with Thai accounting regulations. Homestay guest records and TM.30 filings are retained as required by immigration authorities. General inquiry and marketing data are retained until you request deletion or unsubscribe.

• Security Measures: We implement administrative, physical, and technical safeguards, including SSL/TLS encryption, restricted access controls, and secure local storage, to protect against unauthorized access, loss, or alteration.

1.7 Your Rights Under the PDPA

As a data subject, you hold the following rights:

• Right to Access: Request a copy of your personal data held by us.

• Right to Rectification: Request correction of inaccurate or incomplete personal data.

• Right to Erasure (“Right to be Forgotten”): Request deletion of your data where processing is no longer necessary or lacks legal grounds.

• Right to Restriction & Objection: Restrict or object to the processing of your data under statutory circumstances.

• Right to Data Portability: Receive your data in a structured, machine-readable format.

• Right to Withdraw Consent: Revoke marketing consent without affecting prior lawful processing.

• Right to Lodge a Complaint: Submit a complaint to the Office of the Personal Data Protection Committee (PDPC) of Thailand if you believe your rights have been infringed.

To exercise any of these rights, contact us in writing at wunspace@gmail.com