Privacy
PRIVACY NOTICE
Effective date: 23 September 2026 · Version: 001
Last updated
01
Who We Are And Scope
KulturaSense is an experiential travel brand operated by CU Creative Tourism Education Co., Ltd. (Head Office), a company registered in Thailand.
CU Creative Tourism Education Co., Ltd. is the personal data controller responsible for the collection, use and disclosure of personal data described in this Privacy Notice.
Head-office address:
CU Creative Tourism Education Co., Ltd. (Head Office)
308/39 Krung Kasem Road, SI Yaek Mahanak Subdistrict, Dusit, Bangkok 10300
Company Registration No.: 0195569000410
Privacy contact: contact@kulturasense.com
This Privacy Notice applies when you visit the KulturaSense website, submit a reservation or contact form, correspond with us, request or make a booking, participate in an experience, or otherwise interact with KulturaSense.
It also explains how we disclose information to venues, guides, drivers, boat operators, activity providers, community partners and other parties involved in arranging your requested experience. Where another party independently determines how it uses your data for its own purposes, that party’s privacy notice may also apply.
02
Personal Data We Collect
Depending on how you interact with us, we may collect:
Identity and contact information — name, country of residence or departure, organisation, email address, telephone number, LINE ID, WhatsApp number and preferred contact channel.
Reservation and booking information — selected program, preferred or flexible date, number of guests, ages of children without requesting their names unless necessary, pickup and return details, language preference, quotation and booking status.
Requirements for the experience — dietary preferences, allergies, accessibility or mobility requirements, massage preferences or suitability information, and other information you voluntarily provide. Some of this may be sensitive personal data as explained in Section 5.
Communications — messages, email and messaging correspondence, changes, feedback, complaints, incident reports and other communications connected with a reservation or experience.
Photographic information — identifiable photographs or videos where photography is offered and you have made the relevant choice described in Section 6.
Business and transaction records — quotation, invoice, payment status and transaction reference where a booking proceeds. At present, the website accepts reservations only and does not collect online card-payment details.
Consent and preference records — the choices you make, the wording and version shown to you, language, date and time of the choice, and withdrawal or preference changes.
Technical and security information — IP address, browser or device signals, security tokens, cookie preferences, submission counts, website logs and information necessary to secure the site and forms.
Please do not provide information that is not reasonably necessary for your reservation or experience.
03
How We Obtain Personal Data
We obtain personal data:
Directly from you through the website, email, telephone, LINE, WhatsApp, forms and conversations.
From a person acting for you, such as a travel adviser, employer, hotel concierge, colleague, family member or group organiser. That person should be authorised to provide the information and should make this notice available to the relevant guests.
From service partners involved in the experience, such as a venue, guide, driver, boat operator, activity provider, photographer or insurer, where they provide operational updates or information connected with your booking.
Automatically through the website and security technologies, subject to the cookie choices described in Section 14.
04
Purpose And Lawful Basis
We process personal data only where a lawful basis is available and only as necessary for the stated purpose.
Reservations, quotations and bookings — to respond, check availability, prepare a quotation, communicate with you and take requested steps before entering into a contract or to perform a confirmed booking.
Program delivery — to coordinate transport, venues, hosts, guides, meals, activities, safety and requested arrangements necessary to perform the booking.
Sensitive requirements — to assess suitability and arrange safety, accessibility, dietary or wellness needs on the basis described in Section 5.
Marketing — to send program news and offers only where you have given optional consent. Refusing or withdrawing marketing consent does not affect a booking.
Photography — for personal image delivery and promotional use only according to Section 6.
Business administration and security — to operate and protect the website, prevent fraud or abuse, manage records, respond to complaints and establish, exercise or defend legal claims, where permitted by our legitimate interests and after considering your rights.
Legal obligations — to comply with accounting, tax, regulatory, court or lawful government requirements.
We do not use personal data without an appropriate legal basis and advance notice.
05
Sensitive Personal Data
Information about health, allergies, disability, massage suitability and certain dietary or accessibility needs may be sensitive personal data. A dietary request may also reveal religious beliefs.
Where we ask you to provide sensitive information, we will display a separate explicit-consent request before collecting it, unless another lawful exception under the PDPA clearly applies. The consent will not be pre-selected or combined with marketing or promotional consent.
We use this information only to assess suitability, protect health and safety, or arrange the requested experience. We share only the portion reasonably required by a relevant venue, meal provider, guide, massage provider, activity host, driver, insurer or other service provider.
You may decline to provide sensitive information. However, we may be unable to confirm a meal, massage, route or activity safely without information that is genuinely necessary.
Please provide only necessary details. If you prefer not to enter sensitive information on the website, contact us at contact@kulturasense.com to discuss an appropriate alternative.
06
Photography And Image Use
Where photography is offered, we will provide separate choices for:
Photography and personal delivery — permission to photograph you during the program and send selected images to you or the group organiser.
KulturaSense promotion — permission for KulturaSense to use selected identifiable images on its website, social media, presentations or other promotional communications.
Partner promotion — where applicable, separate permission for an identified or clearly described venue, photographer or community partner to use selected images for its own communications.
These choices are optional and will not affect the price or quality of the program. Promotional consent will not be pre-selected. You may ask not to be photographed or may withdraw promotional consent by contacting us.
Withdrawal does not affect use that occurred lawfully before withdrawal. We will take reasonable steps to stop future use and remove images from channels we control, but cannot always retrieve printed materials, third-party reposts or materials already distributed.
For a child, photography and promotional use will require authorisation from a parent, guardian or other person legally entitled to act for the child.
08
International Transfers
Some technology or service providers may store, access or process personal data outside Thailand.
Before making a cross-border transfer, we will use a mechanism permitted by the PDPA and applicable regulations. Depending on the transfer, this may include recognised protection in the destination, binding corporate rules, appropriate contractual and organisational safeguards, or a lawful statutory exception.
We will also consider the nature of the information, the destination, access controls, encryption and other supplementary safeguards. You may contact us for further information about the safeguards relevant to your data.
09
How Long We Retain Personal Data
We retain personal data only for as long as reasonably necessary for the relevant purpose and legal requirements.
Reservations and contact messages that do not proceed to a booking — generally up to two years after the last meaningful contact, unless a shorter period is appropriate or the record is needed for a complaint or legal claim.
Confirmed booking, invoice and transaction records — for the period required under applicable accounting, tax, contractual and limitation laws.
Sensitive requirements — normally removed or de-identified within 90 days after the program, unless necessary to manage an incident, complaint, insurance matter or legal claim.
Personal-delivery photographs — for the period reasonably necessary to select and deliver them, normally no longer than 90 days after delivery unless you request otherwise.
Promotional photographs — while the relevant consent and purpose remain valid, subject to periodic review and withdrawal.
Marketing records — while you remain subscribed. After withdrawal, we may retain a minimal suppression record to ensure that we do not contact you again and to demonstrate the withdrawal.
Security, bot-prevention and website logs — for the period configured and reasonably necessary for security, abuse prevention and investigation.
Consent records — for as long as needed to demonstrate the consent and to comply with legal obligations.
When retention ends, we delete, securely destroy or anonymise the information. Residual copies may remain temporarily in restricted backups until the backup cycle expires.
10
Security And Personal Data Breaches
We apply administrative, technical and physical safeguards appropriate to the nature and risk of the personal data. Measures may include access controls, individual user accounts, authentication controls, encryption in transit, secure configuration, logging, backups, staff confidentiality and procedures for service providers and incidents.
No system is completely secure. Where required by law, we will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach. Where a breach is likely to result in a high risk to individuals’ rights and freedoms, we will also notify affected individuals without undue delay.
11
Your Rights
Subject to the conditions and exceptions under applicable law, you may request to:
Access and obtain a copy of your personal data.
Receive or transfer eligible data in a machine-readable form.
Object to certain processing.
Have data erased, destroyed or anonymised.
Restrict certain processing.
Correct inaccurate, outdated or incomplete data.
Withdraw consent at any time for processing based on consent.
Complain to the Office of the Personal Data Protection Committee.
Withdrawal does not affect processing lawfully carried out before withdrawal. Some requests may be limited where retention or processing is required or permitted by law.
Exercise a right, contact contact@kulturasense.com. We may request information reasonably necessary to verify identity and protect your data. We will respond without undue delay and within the period required by applicable law. If we cannot fulfil a request, we will explain the reason where required.
12
Required And Optional Information
You are not required to provide personal data unless it is necessary to respond to or perform your request.
Your name and one contact method are required for us to respond.
Program, date and party-size information may be required to check availability or prepare a quotation.
Certain dietary, allergy, mobility or health information may be necessary to determine whether a service can be delivered safely, but you may choose not to provide it. We may then be unable to confirm the affected service.
Marketing, photography and promotional-use choices are optional and do not affect booking price or ordinary service.
Where consent is withdrawn, we will stop the processing that relied on it, subject to lawful retention and processing on another applicable basis.
13
Children
Our website and booking forms are intended for adults. We do not knowingly invite a child to submit personal data directly.
Where a child participates, an authorised adult may provide only the minimum information necessary, such as age, dietary or safety requirements. The adult must be authorised to act for the child and provide any consent required by law.
Identifiable photography or promotional use concerning a child requires appropriate authorisation from a parent, guardian or legally authorised person.
If you believe a child provided information without appropriate involvement, contact us so that we can assess and take appropriate action.
15
Third-Party Sites, Services And Future Online Payment
A link to a third-party website is governed by that party’s own privacy information after you leave our website.
This does not remove KulturaSense’s responsibility for its own collection or disclosure of data to partners involved in your reservation or program.
The website does not currently accept online payments or collect full payment-card details. If online payment is introduced, we will update this notice, identify the payment provider, explain the data flow and present relevant information before payment details are collected.
16
International Visitors And Changes To This Notice
Privacy laws outside Thailand may apply where their territorial and substantive requirements are met. Nothing in this notice is intended to remove mandatory rights that apply to you.
We may update this notice when our services, technology, partners or legal obligations change. We will show the effective date and version. Where a material change affects you, we will provide appropriate notice. Where a new purpose requires consent, we will request that consent before beginning the new processing.
17
Contact Us
For questions, consent withdrawals or requests concerning personal data, contact:
CU Creative Tourism Education Co., Ltd. (Head Office)
Address: 308/39 Krung Kasem Road, SI Yaek Mahanak Subdistrict, Dusit, Bangkok 10300
Email: contact@kulturasense.com
We may request information reasonably necessary to verify identity before responding to a rights request.
You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee where applicable.