Last updated: 13 November 2026
This policy explains what personal data HAVANOA collects on www.havanoa.com, why, where it is stored, how long it is kept and how you can ask us to delete it. It is written for the Thai Personal Data Protection Act B.E. 2562 (2019) (PDPA) and the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is [[TO BE COMPLETED BY HAVANOA: legal entity name, registered address and registration number of the data controller]]. HAVANOA is the brand name. Contact for anything about your data: hello@havanoa.com.
2. What we collect
- When you ask us to contact you (the “Prefer that we contact you?” form on the Owners page, the enquiry form, or the consent button in the website chat): your first name, your WhatsApp number or email address, your message and the details you choose (for example property type, location, bedrooms, dates), the listing or page you were viewing, your language and, if you arrived from a campaign link, its source (UTM parameters).
- When you tap a contact button (WhatsApp, LINE, Telegram, Instagram, Messenger, email, phone): the channel you chose, the listing or page, your language, the campaign source if any, and a pseudonymous technical identifier (a one-way hash of your connection address, never the address itself), used to avoid duplicate notifications and abuse. The message itself is sent by you in that app; we receive it there, under that app’s own privacy terms.
- When you use the website chat: the messages you type, to answer you. Before you give consent in the chat, no contact details are stored with the conversation.
- Anonymous page views: the page visited, the referring site or campaign, and a random session number kept in your browser tab. No name, no IP address.
We do not use advertising cookies or third-party analytics on this website today. The site stores your language choice, your currency choice, the campaign source of your visit and your chat history in your own browser, only to make the site work as you set it.
3. Why we use it
- To answer your request: send you property details, a sale or income estimate, or booking information, by the channel you chose. Legal basis: your consent (PDPA section 19; GDPR article 6(1)(a)) and steps taken at your request before a contract (GDPR article 6(1)(b)).
- To keep the site working and safe (avoiding duplicate alerts, spam and abuse) and to know which pages and campaigns are useful, using anonymous or pseudonymous data. Legal basis: our legitimate interest (PDPA section 24(5); GDPR article 6(1)(f)).
We do not sell your data and do not use it for automated decisions.
4. Where it is stored and who processes it
- Our website database and our automation server (n8n), on a server we rent from Hostinger.
- Our customer list in Airtable and in Google Sheets.
- An instant internal notification to our team on Telegram, and an internal copy by email to our mailbox hello@havanoa.com (Zoho Mail).
- Website chat messages are processed by DeepSeek, the AI service that writes the chat answers.
- Stay bookings made on our booking site are handled by Hostex, our booking system.
Some of these providers are located outside Thailand and outside the European Union. Where data is transferred abroad, we rely on the providers’ contractual safeguards (such as the EU Standard Contractual Clauses) or on your consent.
5. How long we keep it
- Anonymous page views: 120 days, then deleted automatically.
- Requests, contact details and contact-button records: [[TO BE COMPLETED BY HAVANOA: how long requests and contact details are kept, e.g. 24 months after the last contact]]. You can ask us to delete them at any time.
6. Your rights
You can ask to access your data, correct it, delete it, receive a copy, restrict or object to its use, and withdraw your consent at any time (this does not affect what was done before). Write to hello@havanoa.com from the email address or WhatsApp number you gave us, or tell us which one it was; we answer within 30 days. You may also complain to the Thai Personal Data Protection Committee (PDPC) or, if you live in the European Union, to the data protection authority of your country.
7. Changes
We update this page when what we collect or the services we use change. The date at the top shows the latest version.