Privacy Notice

Maison Siam Co., Ltd. is the data controller for the personal data described in this notice.

• Registered office: 1188/25 The Triple, Soi Wat Dan Samrong, Samrong Nuea, Samut Prakarn District, Samut Prakarn 10270, Thailand
• Tax ID: 0105568136288
• Privacy contact: privacy@maison-siam.com

Send any question about this notice, and any request about your own personal data, to privacy@maison-siam.com. That address reaches the people at Maison Siam who handle data protection.

This notice covers three groups. Read the part that applies to you.

• Owners: people and companies whose property we manage under a rental management agreement, together with the co-owners and representatives they name
• Tenants and guests: people who rent or stay in a property we manage, whether on a long-term lease, a mid-term stay or a short booking
• Enquirers: anyone who contacts us through maison-siam.com, by email, LINE or WhatsApp, including people who use our income estimator

It also covers ordinary visitors to maison-siam.com who never contact us. For them, only the "Cookies and analytics" section below applies.

To sign and perform a rental management agreement we collect:

• Identity: full name, nationality, date of birth, and a copy of your passport or Thai ID card
• Contact: postal address, email, phone, LINE or WhatsApp
• Property: address and unit number, title deed or lease details, juristic person details, condo by-laws, access and key information
• Financial: bank account details for rent remittance, tax identification number, withholding tax details, invoices and statements
• Relationship: the agreement itself, our correspondence with you, service and inspection reports, and photographs of the property

Where you give us personal data about someone else, for example a co-owner, an existing tenant or a representative, you confirm you are entitled to share it with us for these purposes. Please make sure they have seen this notice.

To let a property and to run a tenancy or a booking we collect:

• Identity: full name, nationality, date of birth, passport number and passport copy, or the ID card for Thai nationals
• Contact: email, phone, messaging handle, home address
• Stay: check-in and check-out dates, the property and unit, number of guests, booking reference, the platform you booked through, special requests, and the messages you send us
• Financial: rent, deposit, payment records and, for a long-term tenancy, the lease
• Immigration: the details Thai law requires us to report to the Immigration Bureau for foreign nationals, known as the TM30 report
• Operational: maintenance requests, incident reports, and access or key handover records

Most of this reaches us through the platform you booked on or through our property management system, rather than directly from you.

From the website we collect what you type into a form, and little else:

• Your name, your email, and your phone number if you choose to give it
• What you tell us about your property: building or area, unit type, size, condition, current rent or management arrangement
• For a booking enquiry: dates, number of guests, and the property you asked about
• Your message

Two technical items travel with a form submission. Your IP address is processed to check that you are not a bot and to rate-limit abuse of the form. If you arrived from an advertisement, the campaign tags carried in the link you clicked are recorded, so we know which campaign produced the enquiry.

If you accept analytics cookies, Google Analytics also collects usage data about your visit. See "Cookies and analytics" below.

We do not ask for sensitive personal data as the PDPA defines it. A passport or ID card copy can carry some anyway, for example the religion field on a Thai ID card. We do not use that information for any purpose, and you are free to redact it before you send the copy. We do not collect health data, biometric data or criminal records.

The PDPA requires a lawful basis for every purpose. Ours are set out below.

To perform a contract with you:

• Managing your property under the rental management agreement: listing it, pricing it, coordinating housekeeping and maintenance, collecting and remitting rent, and reporting to you
• Letting the property to a tenant, or taking and running a booking for a guest
• Handling deposits, payments, refunds and the checkout reconciliation

To meet a legal obligation:

• Reporting the stay of foreign nationals to the Immigration Bureau (TM30)
• Withholding tax, issuing receipts and invoices, keeping accounting records, and filing with the Revenue Department
• Answering a lawful request from a court, a regulator or the police

For our legitimate interest, weighed against your rights:

• Answering the enquiry you sent us, and following it up
• Keeping our business records, protecting our property and our people, preventing fraud and abuse of our website, and establishing or defending a legal claim
• Improving the dataset behind our income estimator, in aggregated form that identifies nobody

With your consent:

• Analytics cookies on this website
• Marketing emails and updates, where you asked to receive them

You can withdraw consent at any time. Withdrawing it does not affect what we did lawfully before you withdrew, and it does not stop the processing we carry out to perform a contract or to meet a legal obligation.

We share personal data only where there is a reason to, and only with these categories of recipient:

• Booking platforms: Airbnb, Booking.com and the other channels a property is listed on, for the booking itself
• Our property management system: Hostaway, where listings, bookings, guest messages and financial records are held
• Email and communication providers: Resend, which sends our transactional email, and Google Workspace, which hosts our mail
• Website infrastructure: Vercel, which hosts maison-siam.com, Cloudflare Turnstile, which screens form submissions for bots, and Upstash, which holds short-lived rate-limit records
• Analytics: Google Analytics, and only if you accepted analytics cookies
• People who attend the property: housekeeping, maintenance technicians, contractors and the building juristic person, each given only what they need for the job
• Payment and banking partners, for rent collection and remittance
• Professional advisers: our accountant, tax adviser, auditor, insurer and lawyers, all under a duty of confidence
• Government authorities: the Immigration Bureau, the Revenue Department, and any authority we are legally required to report to
• The owner of the property: a tenant's or guest's name and stay details form part of the reporting we owe the owner

We do not sell personal data. We do not share it with advertisers or data brokers.

Several of the providers listed above are based outside Thailand, mainly in the United States and the European Union. Some owners live outside Thailand, so reporting to them sends data abroad as well.

The PDPA allows a transfer abroad where the destination country has adequate protection, or where one of the grounds in sections 28 and 29 applies. We rely on:

• Contract performance: the transfer is necessary to perform our agreement with you, or to take the steps you asked for before entering it, for example listing your property or confirming your booking
• Legal obligation: where the report we have to make is itself required of us
• Appropriate safeguards: our providers are engaged under data protection terms carrying the standard contractual clauses or equivalent commitments, with enforceable rights and effective remedies for you
• Consent: where none of the above covers the transfer, we ask for your consent first, and tell you if the destination lacks adequate protection

You can ask us which providers hold your data and on what basis. Write to privacy@maison-siam.com.

We keep personal data only as long as we need it, then delete or anonymise it.

• Enquiries that do not become a client relationship: 24 months from your last contact with us
• Owner agreements and the records that go with them: for the life of the agreement, then 10 years, the general limitation period under the Thai Civil and Commercial Code
• Tenancy and booking records: for the life of the tenancy or stay, then 5 years
• Accounting, tax and withholding records: 5 years, as the Accounting Act and the Revenue Code require, and longer while an assessment or audit is open
• Immigration reports (TM30): for as long as immigration law requires
• Website analytics: no longer than 14 months
• Your cookie choice: stored in your own browser until you change it or clear it

Where we have to keep one record for a legal reason, we keep that record and delete the rest.

We use established platforms for the systems that hold personal data, and we keep the number of people with access small.

• maison-siam.com is served over HTTPS, so anything you send through a form is encrypted in transit
• The platforms we rely on, including Hostaway, Google Workspace and Vercel, encrypt data at rest and are operated to recognised security standards
• The accounts that hold personal data, including Google Workspace and Hostaway, are protected by two-factor authentication
• Access to owner, tenant and guest records is limited to the Maison Siam team members whose work requires it
• Contractors and service providers are given only the details they need for the job in front of them

We are a small company, and our measures are proportionate to that. We keep them under review and strengthen them as we grow.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and we will tell you directly where the law requires it.

The PDPA gives you these rights over your personal data:

• Access: ask whether we hold data about you, and receive a copy of it
• Portability: receive the data you gave us in a machine-readable format, or have it sent to another controller where that is technically possible
• Rectification: have data that is wrong, out of date or incomplete put right
• Erasure: ask us to delete or anonymise your data, where we no longer need it, where you have withdrawn consent, or where the processing was unlawful
• Restriction: ask us to suspend the use of your data instead of deleting it, for example while a correction is being checked
• Objection: object to processing we base on legitimate interest, and to direct marketing at any time
• Withdraw consent: for anything we do on the basis of consent, including analytics cookies and marketing email
• Complain: lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Bangkok

To exercise any of these, email privacy@maison-siam.com. Tell us which right you want to use, and enough detail for us to find your records. We may ask you to confirm your identity first, so that we never hand your data to the wrong person. We answer within 30 days.

Some rights have limits. We can refuse to delete a record we are legally required to keep, and when that is the reason we will say so.

If you are in the European Economic Area or the United Kingdom, the GDPR may apply to you as well. The rights above map closely onto the GDPR ones, and the same address handles the request.

maison-siam.com uses essential cookies to function, and Google Analytics only if you accept it.

On your first visit a banner asks you to accept or decline analytics. Decline and no analytics cookies are set. Your choice is stored in your own browser rather than on our servers, and you can change it at any time through "Cookie settings" in the footer.

Google Analytics tells us which pages people visit, roughly where they came from and which device they used, so that we can improve the site. We run no advertising or retargeting cookies.

Our cookies page carries the full list.

Our services are not directed at children. We do not knowingly collect personal data from anyone under 20, the age of majority in Thailand, except where a child is named as a guest on a booking an adult has made. In that case we collect only the name and age needed for the stay and for any report the law requires of us.

We update this notice when our processing changes, or when the law does. The current version is always the one published on this page, with the last updated date shown at the top. Where a change materially affects owners under a signed agreement, we tell them in writing.