Who controls your data
The data controller is Access Transit Express LLC, registered in USA at 30 N Gould St Ste R, Sheridan, WY, 82801, USA.
Our Bangkok operation processes your data on our
instructions in order to deliver the service.
Data-protection enquiries go to info@
What we collect
When you make a booking
- Name of the lead traveller, and the names of other travellers where a supplier or a national park requires a manifest.
- Email address and mobile or WhatsApp number.
- Country of residence.
- Hotel or pick-up address, room number, drop-off address.
- Flight number and airline, where the booking involves an airport.
- The experience, date, option and party size booked, and the amount paid.
- Anything you volunteer in the special-requests field — which may include health or dietary information.
When you contact us
- Your name, email address, phone number if you give one, and the content of your message.
Automatically, when you use this site
- IP address, browser and device type, and the pages you visited, held in server logs.
- Approximate country, derived from the IP address by our hosting provider.
- A cookieless page-view count via Cloudflare Web Analytics — no identifier, nothing stored on your device. See the cookie policy.
- Cart, wishlist and currency preference — stored in your own browser, not sent to us.
What we never collect
Card numbers, expiry dates and security codes. Payment is processed on our payment provider's own hosted page. That data never enters, transits or rests on our systems. We receive only a payment reference, the amount, the result, and the last four digits for reconciliation.
Why we process it, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Taking and fulfilling your booking | Contact details, travel details, payment reference | Performance of a contract (Thai PDPA s.24(3); GDPR art. 6(1)(b)) |
| Passing details to the operating supplier | Names, party size, pick-up address, flight number | Performance of a contract |
| Meeting safety and dietary needs you tell us about | Health and dietary information you volunteer | Explicit consent (Thai PDPA s.26; GDPR art. 9(2)(a)) — you may withdraw it, though we may then be unable to run the trip safely |
| Answering enquiries and complaints | Contact details and message content | Legitimate interests — running a business that answers its customers |
| Fraud prevention and payment-dispute defence | IP address, device, order details, correspondence | Legitimate interests, and legal obligation where a scheme requires evidence |
| Accounting, tax and statutory record-keeping | Invoice and transaction records | Legal obligation (applicable US tax law; Thai Revenue Code for the operation's own records) |
| Analytics, if you accept analytics cookies | Pages visited, device type | Consent — withdrawable at any time |
We do not sell personal data, and we do not send marketing email unless you have specifically asked for it.
Who we share it with
- Operating suppliers — the boat operator, transfer company, guide or airport handler performing your booking. They receive only what they need to deliver it: names, party size, meeting point, flight number, and any safety-relevant requirement you told us about.
- Airport authorities and national park offices, where a manifest or a named pass is a condition of entry.
- Our payment service provider, which processes the payment and holds the card data we never see.
- Our hosting and email providers, acting as processors under contract.
- Professional advisers, auditors and authorities, where we are legally required to disclose.
Every processor is bound by contract to use the data only on our instructions and to keep it secure.
International transfers
This is a cross-border business by design: the controller is registered in USA and the service is delivered in Thailand. Your booking data therefore moves between the two as a matter of course, and on to the Thai supplier performing your trip.
Our website is served from a global content-delivery network, and some processors operate outside both countries and outside the EEA. International transfers are subject to applicable data-protection requirements, including Thai PDPA requirements for Thai data and appropriate safeguards for EEA and UK data.
How long we keep it
| Record | Retention |
|---|---|
| Booking and transaction records | 10 years under our record-retention policy, subject to applicable legal requirements |
| Special-requests text, including health information | Deleted 90 days after the travel date |
| Enquiries and correspondence | 24 months from the last message |
| Server access logs | 30 days |
| Analytics data, where consented | 14 months |
| Cart, wishlist, currency and consent choice | In your browser only, until you clear it |
Your rights
Under applicable privacy law, including the Thai PDPA and, where it applies, the GDPR, you may:
- ask what we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased, where we have no overriding legal obligation to keep it;
- ask us to restrict processing while a dispute is resolved;
- object to processing based on legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting anything done before you withdrew it.
Write to info@
How we protect it
- TLS 1.3 encryption on every page and every form on this site.
- Booking records encrypted at rest, in access-controlled storage.
- Access limited to the operations staff who need it, on named accounts with multi-factor authentication.
- No card data on our systems at any point — see the payment security statement.
- Supplier contracts requiring confidentiality and deletion after the travel date.
If a breach occurs that is likely to affect your rights, we will notify you and the competent authority within 72 hours, or sooner where applicable law requires. Notifications are made to affected individuals and the relevant authorities as required by applicable law.
Cookies
We use strictly necessary storage to keep your cart and booking working, and analytics cookies only if you accept them. The detail, and how to change your mind, is in the cookie policy.
Children
This site is not directed at children and we do not knowingly collect data from anyone under 18 other than the names and ages of children travelling on a booking made by an adult. If you believe a child has given us data directly, tell us and we will delete it.
Changes to this notice
We review this notice at least annually. The date at the top of this page shows the last review. Material changes are notified by email to anyone with an active booking.
Contacting us, or complaining
Email info@
If you are unhappy with our response you may complain to the relevant authority in your jurisdiction or, where your data was handled by our Thai operation, to the Office of the Personal Data Protection Committee in Thailand. Residents of the EEA or the UK may also complain to their own national supervisory authority.