This policy explains what personal information 4islandskrabi.com collects, why, who receives it and what rights you have. It covers this website and the bookings and enquiries made through it.
The website is operated by Koh Tour Co., Ltd., a tour company registered in Thailand and trading as Kohtour.
Koh Tour Co., Ltd. is the data controller for the information described here. To use any of your rights, or with any question about your information, write to info@4islandskrabi.com.
We collect the information you give us and the basic technical data your browser sends automatically. We do not buy personal data from anyone.
When you book: your name, email address and phone number, the number and ages of the guests, the tour date and time, your hotel or pickup point, and any requests, dietary notes or accessibility needs you tell us about.
When you pay by card: your card details go directly into our payment provider's secure form. We never see or store the full card number, expiry date or security code.
When you contact us by the contact form, email, WhatsApp or live chat: your name, contact details and your message.
When you browse: our hosting and analytics providers record standard technical data such as IP address, browser and device type, the referring page, the pages you view and when.
There are no customer accounts on this website, so no login, password or stored profile.
We rely on performing our contract with you (your booking), complying with legal obligations (tax and licensing records) and our legitimate interest in running and improving the business. Where we rely on consent, such as for marketing email, you can withdraw it at any time.
We only send marketing email if you ask for it, and every message has an unsubscribe link. Confirmations and messages about a trip you have booked are not marketing.
Card, Apple Pay, Google Pay and PromptPay payments are processed by Stripe. Payment details are sent straight to Stripe and are not stored on our servers. Stripe is an independent controller of the payment data it handles, under its own privacy policy at stripe.com/privacy.
From Stripe we receive only what we need to match a payment to your booking: whether it succeeded, the amount and currency, and the card brand and last four digits.
If you choose to pay on the day, this website collects no card details at all.
Strictly necessary cookies make the site work: they keep your booking in progress, remember your currency and secure the payment step.
Analytics cookies from Google Analytics and Google Tag Manager show us, in aggregate, which pages and tours people look at. We do not use them to identify individual visitors.
Advertising and referral cookies connect a booking with the ad or partner that led to it. After a click on one of our Google ads, a cookie keeps the click identifier for up to 90 days, and if you then book or message us we attach it to your booking so we can report which ads led to bookings. A partner link or QR code sets a cookie that keeps the partner's code for up to 30 days so the booking is credited to them. Neither is used to build a profile of you.
Our live chat is provided by Crisp, which sets a cookie when you open the chat so the conversation continues across pages.
You can block or delete cookies in your browser settings; blocking the strictly necessary ones stops the booking flow from working.
We do not sell your personal information or share it for other companies' advertising. We share it only with:
Some suppliers are based outside Thailand, so your information may be transferred abroad. We rely on their contractual data-protection commitments and, for transfers out of the EEA, on standard contractual clauses.
Booking records are kept for as long as Thai accounting and tax law requires, currently five years from the end of the financial year concerned. Enquiries that do not lead to a booking are deleted within 24 months. Ad click identifiers expire after 90 days and partner codes after 30 days. Analytics data follows the shortest retention period our analytics provider offers.
Under Thailand's Personal Data Protection Act, and under the GDPR if you are in the European Economic Area or the United Kingdom, you can:
Write to info@4islandskrabi.com to use any of these rights. We reply within 30 days and may first ask you to confirm your identity.
Children are welcome on the trips. We record a child's name and age only as part of a booking made by a parent or guardian. The site is not aimed at children and we do not knowingly collect information directly from anyone under 16; if you think a child has sent us information, contact us and we will delete it.
The whole site is served over HTTPS, payment details go directly to Stripe, and access to booking records is limited to staff who need it. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.
We sometimes link to other websites, such as review sites or other Kohtour sites. We are not responsible for their content or privacy practices.
We may update this policy when our services or the law change. Significant changes affecting how we use your information will be stated clearly on this page.
Privacy questions, requests and complaints go to info@4islandskrabi.com, or by post to Koh Tour Co., Ltd., 9/61 Moo 5, Tambon Bophut, Koh Samui, Surat Thani 84320, Thailand. We answer email daily between 07:00 and 22:00 Thailand time (GMT+7).