Privacy Policy

At LAMH, your privacy is treated with the same care, discretion, and attention to detail that we bring to every Travel Experience we craft. This Privacy Policy explains how we collect, use, disclose, and otherwise process your Personal Data, as well as the rights and choices available to you in relation to your Personal Data.

01 Introduction

This Privacy Policy ("Privacy Policy" or "Policy") explains how LAMH Management Asia Co., Ltd. ("LAMH", "we", "us", or "our") collects, uses, discloses, and otherwise processes the Personal Data of individuals who access or use the LAMH Experiences platform, website, and related services (collectively, the "LAMH Platform"), receive services from LAMH whether through or outside the LAMH Platform, make enquiries, request quotations or consultations, book or participate in any Travel Experience, or otherwise interact with us (collectively, the "Services").

For the purposes of this Privacy Policy, "Travel Experiences" means the luxury travel experiences comprising carefully selected itineraries and related services curated, designed, marketed, coordinated, and offered by LAMH under the LAMH Experiences brand through the LAMH Platform or, where applicable, outside the LAMH Platform.

LAMH is committed to protecting your privacy and handling your Personal Data in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand ("PDPA") and its subordinate regulations, notifications, guidelines, and official interpretations, as well as all other applicable data protection, privacy, and cybersecurity laws and regulations (Collectively, the "Data Protection Laws"). LAMH recognizes the importance of the Personal Data entrusted to us and are committed to processing such Personal Data responsibly, fairly, transparently, and securely.

"Personal Data" means information about an individual which enables the identification of that individual directly or indirectly but does not include information specifically about a deceased person.

This Privacy Policy applies to all Personal Data collected by LAMH, whether obtained through the LAMH Platform or through any other means in connection with the Services. By accessing or using the LAMH Platform or the Services, or otherwise providing your Personal Data to LAMH, you acknowledge that you have read and understood this Privacy Policy. Where your consent is required under applicable law for any processing activity, LAMH will obtain such consent in accordance with the PDPA and other applicable Data Protection Laws. Where consent is not required, LAMH may process your Personal Data on any other lawful basis permitted under applicable law.

LAMH may revise this Privacy Policy from time to time to reflect changes in applicable law, our business operations, or our data processing practices. Any updated version will be published on the LAMH Platform and will become effective from the date specified therein. Your continued use of the LAMH Platform or the Services after the effective date of the revised Privacy Policy constitutes your acknowledgment of the updated Privacy Policy.

If you have not reached the age of legal majority in your jurisdiction, you should not provide your Personal Data to LAMH unless you have obtained the prior consent of your parent or legal guardian where required by applicable law. LAMH does not knowingly collect Personal Data from minors without the required authorization. If we become aware that Personal Data of a minor has been collected without the necessary authorization, we may delete such Personal Data or take any other action required or permitted under applicable law.

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your Personal Data, please refer to the "Contact Us" section at the end of this Privacy Policy.

02 Personal Data Collected

2.1 LAMH may collect your Personal Data directly from you or, where permitted by applicable law, from other lawful sources in connection with your use of the LAMH Platform or the Services. We may collect your Personal Data in a variety of circumstances, including when you:

• access or use the LAMH Platform or the Services;
• create, register, or maintain an account with LAMH;
• submit a booking request, request a quotation, arrange a consultation, make an enquiry, or otherwise communicate with us;
• complete and submit any form, application, questionnaire, waiver, declaration, consent form, or other document, whether electronically or in hard copy;
• enter into any agreement or transaction with LAMH or otherwise engage us to provide the Services;
• communicate or interact with us by email, telephone, messaging applications, social media platforms, in person, or through any other communication channel;
• use the LAMH Platform or otherwise interact with our online services, including through cookies, analytics technologies, or similar technologies as described in this Privacy Policy;
• make or attempt to make any payment or other transaction in connection with the Services;
• participate in the Services, event, survey, or other activity organized or conducted by LAMH;
• submit feedback, enquiries, complaints, testimonials, reviews, or other information to LAMH;
• provide your Personal Data to us for any other purpose in connection with the Services; or
• otherwise interact with LAMH in any capacity.

The circumstances described above are illustrative only and are not intended to be exhaustive.

Where you provide LAMH with Personal Data relating to another individual, you represent and warrant that you are authorized to disclose such Personal Data to LAMH and, where required by applicable law, have obtained all necessary consents or have any other lawful basis for doing so. You further acknowledge that LAMH may collect, use, disclose, transfer, and otherwise process such Personal Data in accordance with this Privacy Policy.

LAMH may also collect your Personal Data from third parties, including our business partners, vendors, and other persons who disclose your Personal Data to us with your consent or based on the Data Protection Laws, as well as from publicly available sources, media providers or owners, third-party websites, and social media platforms.

2.2 The categories of Personal Data that LAMH may collect include, but are not limited to, the following:

• Identity and personal contact information, such as your title, first name, last name, nickname, date of birth, age, gender, nationality, email address, telephone number, residential or correspondence address, passport number, identification number, visa information, identification documents, and other contact details;
• Account information, such as your user ID, username, password, profile photograph, account preferences, and other information associated with your account on the LAMH Platform, where applicable;
• Booking and Travel Experience information, such as your booking details, itinerary, travel preferences, accommodation preferences, transportation arrangements, special requests, emergency contact details, and other information necessary for designing, arranging, and delivering the Travel Experience;
• Payment and transaction information, such as payment details, billing information, credit/debit card details, bank account details, payment history, transaction records, invoices, receipts, and other information relating to payments made in connection with the Services;
• Communication information, including but not limited to correspondence and communications between you and LAMH through the LAMH Platform, email, telephone, messaging applications, social media platforms, SMS, or any other communication channels;
• Health and accessibility information*, including but not limited to medical conditions, dietary requirements, allergies, disabilities, mobility requirements, or other health-related information that you voluntarily provide or that is reasonably required for the safe and appropriate delivery of the Travel Experiences;
• Personal Data relating to other participants**, including but not limited to identity, contact, travel, health, accessibility, or other information that you provide where you make a booking on behalf of other participants;
• Technical and usage information, including your Internet Protocol (IP) address, device identifiers, browser type and version, operating system, device settings, cookies, location data (where enabled), log data, browsing behavior, pages visited, time spent on the LAMH Platform, clickstream data, and other information relating to your access to and use of the LAMH Platform and the Services; and
• Any other Personal Data that you voluntarily provide to LAMH or that LAMH lawfully collects in connection with the Services.

*Special Categories of Personal Data: Where the provision of the Services requires LAMH to process health-related information (such as medical conditions, allergies, dietary requirements, disabilities, or accessibility requirements), LAMH will process such Personal Data only where permitted under applicable law and only to the extent necessary for the safe and appropriate delivery of the Travel Experiences.

**Other Participants: Where you provide Personal Data relating to other participants, LAMH will process such Personal Data for the same purposes set out above to the extent necessary for arranging and providing the Travel Experiences.

Processing Purposes, Data Collected & Legal Basis

2.3 Certain Personal Data is necessary for LAMH to provide the Services, enter into or perform a contract with you, comply with applicable legal obligations, or otherwise fulfill the purposes described in this Privacy Policy. If you choose not to provide such Personal Data, withdraw your consent (where applicable), object to the processing of your Personal Data, or request the deletion of Personal Data that is necessary for such purposes, LAMH may be unable to provide, continue providing, or complete some or all of the requested Services.

You may exercise your rights in relation to your Personal Data at any time by contacting us using the contact details set out in the "Contact Us" section of this Privacy Policy. For further information, please refer to the section titled "Your Rights in Relation to Your Personal Data".

03 Data Processing

3.1 We may collect, use, disclose, transfer, and/or otherwise process your Personal Data for one or more of the following purposes:

• to establish, manage, administer, and maintain your relationship, account, or registration with us, including your access to and use of the LAMH Platform and the Services;
• to receive, process, confirm, administer, and fulfill your bookings, reservations, purchases, payments, cancellations, amendments, or other transactions relating to our Services;
• to design, arrange, coordinate, deliver, and manage Travel Experiences, itineraries, transportation, accommodation, dining, wellness, activities, events, and other Services requested by or provided to you;
• to communicate with you regarding your bookings, itineraries, travel arrangements, enquiries, requests, account, transactions, operational updates, service notifications, customer support, emergency situations, or other matters relating to our Services;
• to coordinate with our vendors, business partners, service providers, agents, contractors, payment service providers, insurers, logistics providers, transportation providers, hotels, airlines, yacht operators, helicopter operators, restaurants, wellness providers, guides, activity operators, governmental authorities, affiliates, and/or other relevant third parties to the extent necessary to arrange, facilitate, or perform the Services requested by you;
• to verify your identity, conduct due diligence, comply with know-your-customer (KYC), anti-money laundering (AML), sanctions screening, fraud prevention, risk management, security screening, or other compliance procedures, where applicable;
• to maintain the security, integrity, availability, and proper operation of the LAMH Platform, systems, networks, Services, and business operations, including preventing, detecting, investigating, and responding to fraud, unauthorized access, cyber incidents, misconduct, illegal activities, or other security threats;
• to investigate, manage, respond to, or resolve complaints, disputes, incidents, claims, accidents, insurance matters, customer feedback, or requests relating to the Services;
• to comply with applicable laws, regulations, regulatory requirements, court orders, governmental requests, industry standards, internal compliance policies, or legal processes, and to establish, exercise, or defend legal claims;
• to conduct internal business administration, audits, compliance reviews, governance, accounting, financial reporting, business continuity planning, record keeping, and document retention;
• to conduct research, analytics, statistical analysis, market research, service improvement, quality assurance, customer satisfaction surveys, business planning, and operational improvements;
• to send you information relating to our Services, including service announcements, operational notices, booking updates, marketing communications, invitations to events, and information regarding products or services offered by us, our affiliates, or our business partners, where permitted by applicable law. You may opt out of receiving marketing communications at any time by using the unsubscribe link included in our marketing communications, updating your communication preferences through your account settings (where available), or contacting us using the contact details set out in this Privacy Policy;
• to store, host, transmit, transfer, back up, archive, or otherwise process your Personal Data within or outside the jurisdiction in which it was collected, including through cloud service providers and other technology service providers, subject to applicable Data Protection Laws; and
• to perform any other purpose that is directly related, reasonably necessary, or ancillary to the above purposes, or any other purpose that we notify you of at or before the time your Personal Data is collected, where required by applicable law.

3.2 The purposes described in Clause 3.1 are intended to be comprehensive but may not describe every specific processing activity undertaken by LAMH. Depending on the nature of your relationship with us, the Services requested, or applicable legal requirements, we may collect, use, disclose, transfer, or otherwise process your Personal Data for additional purposes that are compatible with the Purposes described above or as otherwise permitted or required under applicable Data Protection Laws.

Where required by applicable law, we will notify you of such additional purposes and obtain your consent before processing your Personal Data for those purposes.

04 Data Disclosure

In the course of LAMH's business, we may disclose, transfer, or otherwise make available your Personal Data to third parties, whether located in Thailand or overseas, where such disclosure or transfer is reasonably necessary to:

• fulfill the purposes set out in Clause 3.1;
• perform or facilitate the performance of our contractual obligations;
• comply with applicable laws, regulations, legal processes, or requests from competent governmental or regulatory authorities;
• establish, exercise, or defend legal rights or claims;
• protect the rights, property, safety, security, or legitimate interests of LAMH, our customers, vendors, business partners, personnel, or the public; or
• carry out any corporate transaction, including any merger, acquisition, restructuring, reorganization, sale of business or assets, joint venture, financing transaction, or similar transaction involving LAMH.

Such recipients may include, without limitation:

• our affiliates, subsidiaries, parent companies, and related companies;
• booking and reservation management platform provider. Personal Data is shared with such provider solely to facilitate and manage bookings and reservations;
• vendors and business partners engaged to arrange, facilitate, or provide Travel Experiences, accommodation, transportation, dining, wellness, adventure activities, concierge services, or other Services requested by you. We will disclose only the Personal Data that is reasonably necessary for the relevant vendors or business partner to perform the requested Services. Certain experiences, including aviation services, remote expeditions, or restricted-access destinations, may require us to disclose additional identity, travel, or regulatory information to authorized operators or competent authorities where required by applicable law or operational requirements;
• contractors, consultants, professional advisers, auditors, insurers, financial institutions, payment service providers, cloud service providers, data hosting providers, customer relationship management providers, communication service providers, information technology service providers, analytics providers, customer support providers, and other service providers engaged to support our business operations;
• concierge personnel, travel advisers, destination management companies, and other representatives engaged by LAMH to coordinate or deliver the Services requested by you;
• governmental authorities, regulators, courts, law enforcement agencies, or other competent authorities where disclosure is required or permitted by applicable law;
• any purchaser, transferee, assignee, successor, or other party involved in a merger, acquisition, business transfer, corporate restructuring, or similar transaction involving all or part of LAMH's business or assets; and
• any other person or entity to whom disclosure is permitted or required under applicable law or with your consent, where required.

Where we engage third-party service providers to process Personal Data on our behalf, we require them to implement appropriate technical and organizational security measures, process Personal Data only in accordance with our instructions and applicable laws, and maintain the confidentiality and security of such Personal Data.

Where Personal Data is transferred outside Thailand, LAMH will implement appropriate safeguards and comply with the requirements of applicable Data Protection Laws governing cross-border transfers of Personal Data.

05 Discretion & Confidentiality

Due to the nature of the Services provided by LAMH, we recognize that many of our customers expect a high degree of privacy and discretion. Accordingly:

• we treat your Personal Data, booking information, travel arrangements, preferences, and other information relating to your use of the Services as confidential;
• except as necessary to provide the Services, comply with applicable laws, or with your consent, we will not disclose your identity, participation in, or association with any experience; and
• we will not use your Personal Data, photographs, testimonials, or other identifying information for publicity, editorial, promotional, or marketing purposes without your prior consent where required by applicable law.

06 Data Security

6.1 Data Security

LAMH implements appropriate technical, administrative, and organizational measures to safeguard your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized access, disclosure, misuse, or other unlawful processing.

Such measures include, where appropriate:

• encryption technologies, including Transport Layer Security (TLS) and Secure Sockets Layer (SSL), for the secure transmission of Personal Data;
• role-based access controls, authentication mechanisms, and restricted access to Personal Data on a need-to-know basis;
• network security measures, including firewalls, endpoint protection, anti-virus and anti-malware solutions, and ongoing security monitoring;
• secure cloud infrastructure and technology platforms, including our booking management platform, which processes Personal Data solely on our behalf and in accordance with our instructions;
• payment processing through reputable payment service providers that maintain appropriate payment security standards, including PCI-DSS compliance where applicable;
• periodic security reviews, vulnerability assessments, and incident response procedures; and
• regular privacy, confidentiality, and information security training for personnel with access to Personal Data.

6.2 LAMH implements reasonable and appropriate technical, administrative, and organizational measures to safeguard your Personal Data in accordance with applicable Data Protection Laws. However, no method of electronic transmission over the internet or electronic storage is completely secure. Accordingly, while we take reasonable steps to protect your Personal Data, we cannot guarantee the absolute security of any information transmitted to or stored on our systems against events beyond our reasonable control, including sophisticated cyberattacks, malicious hacking, system failures, or other unauthorized acts of third parties.

07 Cookies & Tracking

LAMH uses cookies and other similar technologies on the LAMH Platform to operate, secure, improve, and personalize your experience. These technologies may also be used to remember your preferences, analyze the performance and usage of the LAMH Platform, and, where permitted by applicable law, deliver relevant marketing communications.

The cookies and similar technologies we use may include:

• Essential Cookies, which are necessary for the operation, security, and functionality of the LAMH Platform and cannot be disabled;
• Preference Cookies, which remember your settings and preferences to enhance your user experience;
• Analytics Cookies, which help us understand how users interact with the LAMH Platform, monitor performance, and improve our Services; and
• Marketing Cookies, which may be used to deliver relevant advertisements, measure the effectiveness of marketing campaigns, and personalize marketing communications.

Except for Essential Cookies, cookies and similar technologies will only be placed on your device where required by applicable law after you have provided your consent through our Cookie Preference Center. You may withdraw or modify your cookie preferences at any time through the Cookie Preference Center or your browser settings. Please note that disabling certain cookies may affect the functionality or performance of the LAMH Platform.

For further information about our use of cookies and similar technologies, including the types of cookies we use, their purposes, and how you can manage your preferences, please refer to our Cookies Policy available at [insert link].

08 Cross-Border Transfers of Personal Data

In the course of providing the Services, your Personal Data may be transferred to, stored, accessed, or otherwise processed in countries outside Thailand where LAMH, our vendors, service providers, business partners, affiliates, or technology providers operate.

Where Personal Data is transferred outside Thailand, LAMH will ensure that such transfer is carried out in accordance with applicable data protection laws and that appropriate safeguards are implemented to protect your Personal Data. Such safeguards may include contractual obligations, data transfer agreements, certification mechanisms, or other legally recognized measures designed to ensure an adequate level of protection for your Personal Data.

By using our Services or otherwise providing your Personal Data to us, you acknowledge that your Personal Data may be transferred, stored, or processed in jurisdictions outside your country of residence for the purposes described in this Privacy Policy.

Destination Countries / Jurisdictions

09 Data Retention

LAMH will retain your Personal Data only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, perform our contractual obligations, comply with applicable laws, resolve disputes, establish, exercise, or defend legal claims, and protect our legitimate interests.

The retention period applicable to your Personal Data depends on the nature of the Personal Data and the purpose for which it was collected. Unless a longer retention period is required or permitted by applicable law, LAMH generally retains Personal Data in accordance with the following schedule:

Where Personal Data is no longer required for the purposes for which it was collected, or where the applicable retention period has expired, LAMH will securely delete, destroy, anonymize, or otherwise de-identify such Personal Data without prior notice in accordance with applicable laws and our internal data retention policies.

If you cease using the LAMH Platform, or your account is suspended, revoked, or terminated, or the Services provided to you are completed or terminated, LAMH may continue to retain and process your Personal Data for the applicable retention periods set out above, or for such longer period as may be required or permitted by applicable law.

10 Your Rights in Relation to Your Personal Data

10.1 Right to be Informed. You have the right to be informed, before or at the time of collection, of the purposes for the collection, use, or disclosure of your Personal Data, the retention period, and the identity and contact details of the data controller, as set out in this Privacy Policy.

Consent. You may choose whether to provide the Personal Data requested by us and whether to consent to our collection, use, and disclosure of such Personal Data where consent is required by applicable law. However, if you choose not to provide the requested Personal Data, provide incomplete information, or withhold or withdraw your consent where such Personal Data is necessary for the provision of the Services, we may be unable to provide certain Services or functionalities, or may not be able to provide the Services to you at all.

10.2 Right to Access. Where you maintain an account with us, you may access and, where applicable, update certain Personal Data through your account settings on the LAMH Platform. If you do not have an account, or if the requested information is not available through your account, you may submit a written request to access your Personal Data held by us.

Before processing your request, we may require sufficient information to verify your identity and the nature of your request. Upon receiving adequate information, we will process your request in accordance with the Data Protection Laws. Please note that certain categories of Personal Data may be exempt from access requests under the Data Protection laws.

10.3 Right to Object. You have the right to object to the collection, use, or disclosure of your Personal Data where such processing is carried out without your consent where consent is required, or where your Personal Data is processed for direct marketing, research, or other purposes as permitted under the Data Protection Laws.

10.4 Right to Erasure & Right to be Forgotten. You may request that we erase, destroy, anonymize, or otherwise de-identify your Personal Data where permitted by the Data Protection Laws, including where you have withdrawn your consent, successfully objected to the processing of your Personal Data, the Personal Data is no longer necessary for the purposes for which it was collected, or where our processing does not comply with the Data Protection Laws.

10.5 Right to Restriction of Processing. You may request that we temporarily suspend or restrict the processing of your Personal Data while we consider or verify your request, objection, or the accuracy of your Personal Data. Where you are entitled to request the deletion of your Personal Data, you may instead request that we restrict the processing of such Personal Data in accordance with the Data Protection Laws.

10.6 Right to Rectification. You have the right to request that we correct, update, or complete any Personal Data that is inaccurate, incomplete, misleading, or not current. Where we have sufficient information to process your request, we will correct your Personal Data within thirty (30) days. If we are unable to do so within such period, we will notify you of the earliest date by which the correction can be completed. We reserve the right to refuse a request for rectification where permitted by the Data Protection Laws.

10.7 Right to Withdrawal of Consent. Where our processing of your Personal Data is based on your consent, you may withdraw such consent at any time by contacting us using the contact details set out in the "Contact Us" section of this Privacy Policy or by using any other method made available by us. We will process your request in accordance with Data Protection Laws. Please note that withdrawing your consent will not affect the lawfulness of any processing carried out before the withdrawal. Depending on the nature of your request, the withdrawal of consent may prevent us from continuing to provide certain Services and may result in the suspension or termination of your account, relationship, or contract with us where such processing is necessary.

10.8 Right to Complaints. If you believe that LAMH has processed your Personal Data in a manner that does not comply with the Data Protection Laws, you have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) or any other competent supervisory authority.

The exercise of the rights described above is subject to the conditions, limitations, and exceptions prescribed by the Data Protection Laws. Where permitted by applicable law, LAMH may refuse or limit a request where there are lawful grounds for doing so.

If you have any questions regarding this Privacy Policy or wish to exercise any of your rights, please contact us through the contact details provided in the "Contact Us" section of this Privacy Policy.

11 Third-party Collection

In providing the Services, LAMH may engage or integrate with third-party platforms, payment service providers, booking systems, technology providers, vendors, or other business partners. Where such third parties process Personal Data on our behalf, we require them to implement appropriate security measures and process Personal Data only in accordance with our instructions and the Data Protection Laws.

Certain third-party platforms or websites that are linked to, integrated with, or accessible through the LAMH Platform may operate independently from LAMH and maintain their own privacy policies and data collection practices. Where you voluntarily access or provide information directly to such third parties, your Personal Data will be collected and processed in accordance with their respective privacy policies and terms. LAMH is not responsible for the privacy practices, content, or security measures of such independent third parties.

Where Personal Data is collected directly by an independent third party rather than by LAMH, such collection, use, disclosure, retention, and other processing activities are governed by the privacy policy and practices of that third party. We encourage you to review the privacy policies of any third-party platform, website, or service before providing your Personal Data.

12 Minors' Privacy

The LAMH Platform and the Services are not intended for minors under the age of twenty (20). We do not knowingly collect, use, or retain any Personal Data or non-personally identifiable information from individuals under the age of twenty (20), nor do we knowingly direct the LAMH Platform or the Services to such individuals. Parents or legal guardians are responsible for ensuring that their children or wards do not provide any Personal Data to LAMH.

If you provide Personal Data relating to a minor under the age of twenty (20) to LAMH, or to a data controller operating on the system through which you access or use our Services, and LAMH is contractually required to process such Personal Data, you acknowledge and consent to LAMH's collection, use, and retention of such Personal Data. You further represent that you are authorized to provide such consent on behalf of the minor and agree that such processing shall be subject to the terms and conditions set out in this Privacy Policy.

If we become aware that a minor under the age of twenty (20) has created an account or provided Personal Data without the consent of their parent or legal guardian, we will take appropriate steps to close the relevant account and remove and/or delete such Personal Data from our records.

13 Terms and Conditions

Please refer to the Terms of Service, which contain the terms governing your use of the LAMH Platform and the Services, including applicable disclaimers, limitations of liability, and other relevant policies.

14 Policy Updates

LAMH may amend this Privacy Policy from time to time, and you will be able to view the amended terms and conditions of this Privacy Policy on the LAMH Platform. The use of the LAMH Platform, Services, activities and/or communication with us after the effect of the updated Privacy Policy is deemed the acknowledgement of the updated Privacy Policy.

15 Contact Us

In case you notice that LAMH does not comply with the Data Protection Laws, prior to lodging complaints to the Personal Data Protection Committee (PDPC) or any other competent supervisory authority, please contact us first in order to give us the opportunity to be informed about the matters of fact, to clarify on other issues, and to address your concerns.

If you have any questions, suggestions or concerns about our practices regarding personal data protection, or requests in accordance with your rights under the PDPA and Data Protection Laws, please contact us at the address listed below. We will provide additional information regarding personal data protection.

Address: 319 Chamchuri Square, Room 24006, 24th Floor, Phaya Thai Road, Bangkok 10330, Thailand

Email: [email protected]

Last Updated: 30 July 2026