Privacy Policy for evoitmax

Definitions

For clarity, we define common terms used throughout this policy so you can understand how your information is handled.

Why We Use Personal Data

We process personal data to provide safe, effective, and comfortable services to our guests, to manage bookings, and to comply with legal obligations.

• To perform booking administration, manage reservations, issue confirmations, and process payments.
• To coordinate medical and therapeutic care, including sharing necessary details with our in-house clinicians and allied providers with consent.
• To provide customer support and respond to inquiries, complaints, or requests related to stays and services.
• To maintain safety and security of guests and staff, including emergency response and incident reporting.
• To personalize guest experience, such as room setup, meal preferences, and activity recommendations based on provided preferences.
• To analyze and improve our services, facilities, and website performance through aggregated analytics.
• To fulfill legal and regulatory requirements, including tax and health reporting obligations in Thailand.
• To send marketing communications where you have opted in, such as newsletters or special offers, with the option to opt out at any time.

Legal Bases for Processing

We rely on lawful bases appropriate to each processing activity: contractual necessity, legitimate interests, consent, and legal obligations.

• Contractual necessity: to provide booked accommodation and care services when you enter into a contract with evoitmax.
• Legal obligation: to comply with statutory requirements such as tax records, health reporting, and law enforcement requests.
• Legitimate interests: for fraud prevention, security, service improvement, and communications that do not override your privacy rights.
• Consent: where processing requires explicit consent, for example sensitive health details or marketing communications when applicable.

If GDPR Applies

For individuals in the European Economic Area, the following outlines rights and lawful bases under GDPR when applicable.

• Right of access: you may request confirmation of whether we process your personal data and obtain a copy of that data.
• Right of rectification: you may request correction of inaccurate personal data.
• Right to erasure: you may request deletion of data where retention is no longer necessary or consent is withdrawn, subject to legal exceptions.
• Right to restriction and objection: you can request limitation of processing or object to specific processing activities based on legitimate interests.
• Right to data portability: where processing is based on consent or contract, you may request a structured, machine-readable copy of your data.
• Right to lodge a complaint with a supervisory authority if you believe processing breaches applicable data protection law.

Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and collect analytics to improve functionality.

Types include strictly necessary cookies for site operation, preference cookies for language and settings, analytics cookies to measure site usage, and marketing cookies where consent is given.

You may see four categories: necessary, preferences, analytics, and advertising. Necessary cookies are essential and cannot be disabled from the site interface.

You can manage cookie preferences via your browser settings or our cookie banner. Disabling cookies may affect site features and booking flows.

Read the full cookie policy on evoitmax.club for details on individual cookies and retention periods.

Data Sharing

We only share personal data with parties that need it to provide services, and we limit access to what is necessary for their role.

• Healthcare providers and therapists directly involved in guest care, with explicit consent or as required for safety.
• Payment processors and business institutions for transaction processing and fraud prevention.
• Government or regulatory authorities when required by law, such as public health reporting.
• Service providers and vendors who perform operations on our behalf under data processing agreements.
• Third-party booking platforms or travel agencies when you book through those channels and consent to data transfer.
• Legal advisors and insurers when necessary to defend or pursue legal claims or manage insurance matters.

International Transfers

When personal data is transferred outside Thailand, we ensure appropriate safeguards are in place such as standard contractual clauses, data processing agreements, or transfers to jurisdictions with adequate protections.

Transfers to service providers in other countries occur only after verifying appropriate safeguards and limiting data access to what's necessary for service delivery.

Data Retention

We retain personal data only as long as necessary to fulfill the purposes described, comply with legal obligations, and resolve disputes.

Account and booking records are retained for the minimum period required by Thai tax and regulatory law, typically several years for accounting and compliance purposes.

Communications and support correspondence are retained for a limited time to resolve issues and improve service, usually not longer than two years unless needed for legal purposes.

Security logs and access records are retained for operational security and fraud prevention, subject to periodic review and deletion.

When retention periods expire or you request deletion and no legal basis to retain remains, we will securely delete or anonymize personal data.

Security Measures

We implement reasonable administrative, technical, and physical measures to protect personal data against unauthorized access, loss, misuse, or disclosure. Measures are periodically reviewed and updated to reflect evolving risks and standards.

• Access control and role-based permissions to limit data access to authorized personnel only.
• Encryption of sensitive data in transit and where appropriate at rest, plus secure backups and disaster recovery procedures.
• Regular staff training on data protection, incident response plans, and periodic security audits.

Your Rights and How to Contact Us

At evoitmax we respect your control over personal data. As a visitor or client of our senior wellness sanctuary, you have clear rights regarding access, correction, portability and deletion of your personal information. Below we summarize those rights and how to exercise them.

• Right to access: You can request a copy of the personal data we hold about you and receive a readable summary of how it is processed.
• Right to rectification: If your personal details are incomplete or inaccurate, you may ask us to correct or update that information.
• Right to deletion: You may request removal of personal data where retention is no longer necessary or lawful, subject to legal or administrative exceptions.
• Right to data portability: Where applicable, you can request a structured, machine-readable copy of personal data we maintain about you.
• Right to object: You may object to certain processing activities including direct marketing and profiling where applicable under law.
• Right to restrict processing: You may ask us to limit how we use your data in specific circumstances while disputes are resolved.
• Right to withdraw consent: If you previously gave consent for specific uses (for example, marketing), you can withdraw it at any time without affecting prior processing.
• Right to complain: If you are not satisfied with our handling of personal data, you may lodge a complaint with the relevant supervisory authority in Thailand.

How to make a privacy rights request

To exercise any privacy right, contact our Data Protection Coordinator at the address or email provided below. Please include your full name, evoitmax account details if available, a description of the request and a copy of an identity document to help verify your request. We will respond after verifying your identity.

contact@evoitmax.club

We aim to acknowledge requests within 5 business days and provide a substantive response within 30 calendar days. Complex requests may require additional time; we will inform you if more time is needed.