Privacy
Privacy policy
Getting in touch about recovery is personal. This policy explains, in plain English, what information we collect, why we need it, how we protect it and the choices you have.
Draft – to be reviewed by a qualified lawyer before launch.
In short: we only collect what we need to answer you and, if you stay with us, to support you. We never sell your information. We do not use advertising cookies or tracking. Anything you tell us about your health is treated as sensitive and is only used with your explicit consent.
Version: draft, October 2026. This policy is written to meet Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and, for visitors in the European Union, the UK and the European Economic Area, the General Data Protection Regulation (“GDPR”).
1. Who we are
The White Room is a non-medical sober living residence in Khao Tao, Hua Hin, Thailand. For this policy, “we”, “us” and “our” mean [Thai company name and registration number – TBC], which runs The White Room and is the data controller for your personal data.
Address: [street address – TBC], Khao Tao, Hua Hin, Prachuap Khiri Khan [postcode – TBC], Thailand.
Email: fred@thewhiteroomthailand.com
2. What we collect
When you contact us
When you message us on WhatsApp, email us, call us or use a contact form, we receive the information you choose to share. This is usually:
- your name and contact details (phone number, WhatsApp profile, email address);
- your message and any later conversation with us;
- practical details such as your country, preferred dates and how you heard about us.
A family member, friend or professional may also contact us about you. If they do, we ask them to confirm that you know about it and agree.
If you come to stay
If you decide to stay with us, we collect the information needed to arrange and support your stay, such as passport and visa details, emergency contacts and the details in your resident agreement. [list of resident data collected and the resident agreement – TBC]
When you visit this website
Our website is a simple static site. It does not use cookies and does not ask you to log in. Like every website, our hosting provider (Cloudflare) briefly processes technical data such as your IP address and browser type to deliver pages and protect the site from attacks.
3. Health information
To understand whether a stay is right for you, you may tell us about your recovery, your use of alcohol or drugs, your mental or physical health or any treatment you have had. Under the PDPA and the GDPR this is sensitive personal data and has extra protection.
- We only use it with your explicit consent, which you give when you choose to share it with us for this purpose.
- We only use it to assess whether we can support you safely and, if you stay, to support you during your stay.
- Please only share what you are comfortable sharing. You do not need to send medical records with a first enquiry.
- You can withdraw your consent at any time. This will not affect anything we did before, but it may mean we cannot offer you a stay.
The only exception is an emergency: if we believe someone’s life or health is in serious danger and they cannot give consent, we may share necessary information with emergency services or a hospital, as the law allows.
4. How we use it, and why
Data protection law requires a legal reason, called a lawful basis, for each use of your data.
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry and answer your questions | Steps you ask us to take before a possible agreement; our legitimate interest in answering messages |
| Assess whether a stay is suitable for you | Your explicit consent (for health information) |
| Arrange and provide your stay | Performing our agreement with you; explicit consent for health information |
| Meet legal duties, such as reporting foreign guests to Thai immigration where required | Legal obligation |
| Protect someone in an emergency | Vital interests |
| Keep the website secure and working | Legitimate interests |
We do not use your information for advertising, we do not send marketing messages without your consent, and we do not make automated decisions about you.
5. Who we share it with
We never sell or rent your personal data. We only share it when we need to:
- Service providers who help us run our communication and website: WhatsApp (Meta), Google Workspace for email, and Cloudflare for website hosting. They may only use the data to provide their service to us. [full list of processors, e.g. booking or accounting tools – TBC]
- People you ask us to involve, such as your treatment centre, therapist or family, and only with your consent.
- Authorities, when Thai law requires it.
- Emergency services or a hospital, if someone’s life or health is at serious risk.
6. Transfers outside Thailand
Some of our service providers store or process data outside Thailand, for example in the European Union or the United States. When this happens, we rely on the safeguards the PDPA and GDPR allow, such as the provider’s standard contractual clauses, or on your consent. You can ask us for more detail.
7. Cookies and analytics
This website does not set cookies and does not use advertising or social media tracking pixels. That is why you do not see a cookie banner.
To understand which pages are useful, we may use a privacy-friendly analytics service that does not use cookies and does not identify individual visitors. It only counts visits in aggregate, for example how many people viewed a page or tapped the WhatsApp button. [analytics provider, if any – TBC]
Links to WhatsApp, Instagram and Google Maps take you to those services, which have their own privacy policies.
8. How long we keep it
We keep personal data only as long as we need it for the purposes above, or as long as the law requires.
- Enquiries that do not lead to a stay: [retention period, e.g. 12 months after the last message – TBC]
- Records of residents: [retention period for resident records – TBC]
- Financial and tax records: as long as Thai law requires. [period to confirm – TBC]
After that, we delete the data or make it anonymous.
9. Keeping it safe
We are a small team. Only the people who need your information to help you can see it, and we take reasonable technical and practical steps to protect it from loss, misuse and unauthorised access. [security measures to describe, e.g. two-step verification on email and WhatsApp, locked storage for paper records – TBC]
No method of sending information over the internet is completely secure. If you prefer, you can ask to share sensitive details by phone instead of in writing.
If a data breach is likely to put your rights at risk, we will tell the regulator and, where required, you, within the time the law sets.
10. Your rights
Under the PDPA, and the GDPR where it applies, you have the right to:
- be told how your data is used (this policy);
- get a copy of your personal data;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data, or to stop or limit using it;
- object to us using your data based on our legitimate interests;
- receive your data in a commonly used format, or have it sent to someone else;
- withdraw your consent at any time;
- complain to a data protection authority (see below).
To use any of these rights, email fred@thewhiteroomthailand.com. We may need to check your identity first. We will reply within 30 days. Some rights have legal limits; if we cannot do what you ask, we will explain why.
11. Children
The White Room is for adults only. We do not knowingly collect personal data from children. If you think a child has sent us information, please contact us and we will delete it.
12. Changes to this policy
We may update this policy, for example if the law or our services change. The current version is always on this page, with the date it was last updated.
13. Contact and complaints
Questions about your privacy, or about this policy, are welcome. Email fred@thewhiteroomthailand.com or write to us at the address above.
Data protection officer or contact person: [name, if one is appointed – TBC]
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You can also complain to:
- in Thailand, the Office of the Personal Data Protection Committee (PDPC);
- in the EU or EEA, the data protection authority in the country where you live or work;
- in the UK, the Information Commissioner’s Office (ICO).
Representative in the EU or UK under the GDPR: [to be decided with the lawyer – TBC]
See also our website terms of use and what we are and are not.