Privacy Policy - Compass Hospitality

Last updated: June 2026

1. Scope of This PolicyThis Privacy Policy applies exclusively to the corporate website at compasshospitality.com (the "Website"), operated by Compass Hospitality Co., Ltd. It describes what personal data we collect through this Website, why we collect it, who we share it with, and your rights as a data subject.This Policy does not cover personal data collected at individual hotel properties. Each hotel operates under its own privacy notice in accordance with applicable local law. If you have made a hotel booking or stayed at one of our properties, please refer to that hotel's privacy notice.2. Who We Are — Data Controller

Data Controller	Compass Hospitality Co., Ltd.
Company registration	0105544048923
Registered address	Suite 10/91 Trendy Office Tower, 5th Floor, Sukhumvit Soi 13, Bangkok 10110, Thailand
Thai data protection	dpo@compasshospitality.com
UK data protection	dpo@compasshospitality.com

UK operations note: Compass Hospitality manages hotel properties in the United Kingdom. Where personal data of UK residents is processed in connection with those properties, such processing is also subject to the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations 2003 (PECR). Contact dpo@compasshospitality.com for UK-specific enquiries.3. Personal Data We CollectWe collect only what is necessary for the specific purposes described below. We collect personal data through three channels on this Website:3.1 Hotel Marketing Sign-Up Form

Data collected	Name, email address, telephone number
Purpose	To send you promotional communications, special offers, and news about Compass Hospitality hotels
Legal basis (TH)	Consent — PDPA Section 19
Legal basis (UK)	Consent — UK GDPR Article 6(1)(a) and PECR Regulation 22

3.2 Group Tour Enquiry Form

Data collected	Name, email address
Purpose	To send you group tour offers and follow up on your group travel enquiry
Legal basis (TH)	Consent — PDPA Section 19
Legal basis (UK)	Consent — UK GDPR Article 6(1)(a) and PECR Regulation 22

3.3 Website Analytics and Advertising

Data collected	IP address, browser type, device type, pages visited, session duration, referral source, ad interaction data
Purpose	To understand how visitors use this Website and to measure the effectiveness of our advertising campaigns
Legal basis (TH)	Consent for advertising cookies (PDPA Section 19); Legitimate interests for analytics (PDPA Section 24(5))
Legal basis (UK)	Consent for advertising and analytics cookies — UK GDPR Article 6(1)(a) and PECR
Collected via	Google Analytics and Google Ads — see Section 5 for details

We do not collect: payment card data, passport or ID numbers, health or sensitive data, social media profile data, loyalty programme data, on-property guest data, or employment application data through this Website.4. How We Use Your Data

Purpose	Data Used	Legal Basis
Send hotel promotional emails	Name, email, phone (via Mailjet)	Consent
Send group tour marketing emails	Name, email (via Mailchimp)	Consent
Website analytics and improvement	IP, behavioral data (via Google Analytics)	Legitimate interests / Consent
Targeted advertising	Behavioral, device data (via Google Ads)	Consent
Maintain unsubscribe / suppression records	Email address	Legal obligation

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects. We do not sell your personal data.5. Data Processors and International TransfersWe use the following third-party processors to deliver the services described above. All processors are contractually required to process your data only on our instructions and to maintain appropriate security measures.

Processor	Location	Data Processed	Purpose	Transfer Mechanism
Ematic Solutions	Singapore	Name, email, phone	Mailjet account management	Data transferred under contractual data protection safeguards
Mailjet / Sinch Email SAS	France (EU)	Name, email, phone	Email delivery — hotel marketing	TH visitors: PDPA consent basis. UK visitors: UK adequacy decision for EEA ✓
Mailchimp (Intuit Inc.)	United States	Name, email	Email delivery — group tours	Data transferred under contractual data protection safeguards — see mailchimp.com/legal
Google LLC	United States	IP, behavioral, device data	Analytics and advertising	Google Ads Data Processing Terms (SCCs). TH: consent basis. UK: UK SCCs in place.

You may request details of the specific safeguards in place for any international transfer by contacting dpo@compasshospitality.com (Thailand enquiries) or dpo@compasshospitality.com (UK enquiries).Mailjet's standard Data Processing Agreement is available at mailjet.com/legal. Mailchimp's Data Processing Addendum is available at mailchimp.com/legal. Google's Data Processing Terms are available at business.safety.google/adsprocessorterms.6. Data Retention

Data	Retention Period	Basis
Name, email, phone — hotel marketing (Mailjet)	Until unsubscribe, or 3 years from last engagement	Consent
Name, email — group tours (Mailchimp)	Until unsubscribe, or 3 years from last engagement	Consent
Analytics data (Google Analytics)	26 months (Google Analytics default retention setting)	Legitimate interests
Consent records (timestamp, source, IP)	6 years	Legal obligation — evidence of lawful processing
Unsubscribe / suppression list	6 years from unsubscribe date	Legal obligation — prevent re-contact

We do not retain financial data, booking records, or payment information through this Website. References to HMRC or 7-year financial retention in prior versions of this Policy are removed as they do not apply to data collected through compasshospitality.com.7. Your Rights7.1 Thai Residents — PDPA RightsIf you are located in Thailand or your data is processed under Thai law, you have the following rights under the Personal Data Protection Act B.E. 2562:

Right to be informed (มาตรา 23): Know what data we collect and how it is used
Right of access (มาตรา 30): Request a copy of the personal data we hold about you
Right to rectification (มาตรา 35): Request correction of inaccurate or incomplete data
Right to erasure (มาตรา 33): Request deletion of your data where no lawful basis remains
Right to restriction (มาตรา 34): Request that we pause processing while a dispute is pending
Right to data portability (มาตรา 31): Receive your data in a machine-readable format
Right to object (มาตรา 32): Object to processing based on legitimate interests, including direct marketing
Right to withdraw consent (มาตรา 19): Withdraw consent at any time without penalty

Right to complain to the PDPC (มาตรา 73): You have the right to lodge a complaint with the Personal Data Protection Committee (สคส.).

Website: www.pdpc.or.th
Address: สำนักงานคณะกรรมการคุ้มครองข้อมูลส่วนบุคคล, กรุงเทพมหานคร

7.2 UK Residents — UK GDPR RightsIf you are located in the United Kingdom or your data is processed under UK GDPR, you have the following rights:

Access (Art. 15): Receive a copy of your personal data and information about how it is processed
Rectification (Art. 16): Request correction of inaccurate or incomplete data
Erasure (Art. 17): Request deletion where no lawful basis remains
Restriction (Art. 18): Request that we pause processing while a dispute or objection is pending
Portability (Art. 20): Receive your data in a structured, machine-readable format
Object (Art. 21): Object to direct marketing — this right is absolute and will always be honoured immediately
Withdraw consent (Art. 7(3)): Withdraw consent at any time without penalty

Right to complain to the ICO: You have the right to lodge a complaint with the UK Information Commissioner's Office.

Website: www.ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

To exercise any right, contact the appropriate DPO email above. We will respond within 30 days. We may verify your identity before fulfilling your request.8. Cookies8.1 What Cookies We Use

Cookie Type	Provider	Purpose	Consent Required
Essential	Website platform	Session management, security	No
Analytics	Google Analytics (Google LLC)	Website usage statistics and improvement	Yes
Advertising	Google Ads (Google LLC)	Measure ad effectiveness, targeted advertising	Yes

8.2 Managing CookiesWhen you first visit this Website, a cookie consent banner will ask for your preferences. You may accept all, reject non-essential, or manage categories individually. You can change your preferences at any time via the cookie settings link in the website footer.You may also control cookies through your browser settings. Note that disabling essential cookies may affect website functionality.Google Analytics opt-out: Install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.9. Security and Breach NotificationWe implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include SSL/TLS encryption for data in transit, access controls, and regular security reviews.No internet transmission is entirely secure. You are advised not to send sensitive personal information (such as payment card details or passport numbers) to us by email.In the event of a personal data breach:

Thai residents (PDPA Section 37): We will notify the สคส. within 72 hours where the breach is likely to risk the rights and freedoms of data subjects. Affected individuals will be notified without undue delay where the breach poses high risk.
UK residents (UK GDPR Article 33): We will notify the ICO within 72 hours. Affected individuals will be notified without undue delay where the breach poses high risk.

10. Third-Party LinksThis Website contains links to individual hotel websites and third-party platforms. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policy of any third-party site before submitting personal information.11. ChildrenThis Website is not directed at children. We do not knowingly collect personal data from individuals under 20 years of age (Thailand) or 18 years of age (United Kingdom and other jurisdictions). If you believe a minor has submitted personal data through this Website, please contact dpo@compasshospitality.com and we will delete it promptly.12. Changes to This PolicyWe may update this Policy from time to time. When we do, we will publish the revised version on this page with an updated "Last updated" date. We will notify active subscribers of material changes by email before they take effect. Continued use of this Website after changes constitutes acceptance of the updated Policy.13. Contact

Thailand — data protection	dpo@compasshospitality.com
UK — data protection	dpo@compasshospitality.com
Postal address	Data Protection Officer, Compass Hospitality Co., Ltd., Suite 10/91 Trendy Office Tower, 5th Floor, Sukhumvit Soi 13, Bangkok 10110, Thailand