Privacy Policy

Tajlandia ("Tajlandia," "we," "us," or "our")

Last updated: August 27, 2026

1. Who We Are

Tajlandia is operated by Tajlandia Digital Sp. z o.o., a company registered at ul. Marszałkowska 126/134, 00-008 Warsaw, Poland, registration/tax number KRS 0000999999 / NIP 525-00-00-000 ("Company," "we," "us"). We provide a symbolic-ownership website and digital certificate service themed around locations in Thailand (the "Service"), marketed to users worldwide, including in Thailand and Poland/the European Union.

For any privacy question, contact us at hello@tajlandia.pl. If we have appointed a Data Protection Officer, their contact details are: dpo@tajlandia.pl.

This Privacy Policy explains what personal data we collect, why, how we use and protect it, who we share it with, and what rights you have, including specific rights available to residents of Poland/the EEA under the General Data Protection Regulation (GDPR) and to residents of Thailand under the Personal Data Protection Act B.E. 2562 (2019) ("Thai PDPA").

2. Personal Data We Collect

We collect the following categories of personal data:

a) Information you give us directly

Name, email address, and (optionally) phone number when you join our priority list, create an account, or claim a symbolic location.
Billing and payment details (processed by our third-party payment processor; see Section 6; we do not store full card numbers).
Delivery details for a gift (recipient's name and email address, and any personal message you write).
Communications you send us (support requests, feedback, correspondence).

b) Information collected automatically

Device and log data: IP address, browser type, operating system, referring URLs, pages viewed, and timestamps.
Cookies and similar tracking technologies used for essential functionality, analytics, and (where consented) marketing.
Approximate location inferred from IP address (for currency/language display and fraud prevention).

c) Information from third parties

Data from payment processors confirming successful/failed transactions.
Data from analytics and advertising partners (for example, ad click IDs), where you arrived via a marketing campaign.

We do not knowingly collect special/sensitive categories of personal data (for example, health, religion, biometric data) and ask that you not submit such data to us.

3. Why We Use Your Data (Purposes & Legal Basis)

Purpose	Data Used	Legal Basis (GDPR, Poland/EU)	Basis (Thai PDPA)
Creating your account, processing your symbolic claim, and issuing your digital certificate	Name, email, order details	Performance of a contract (Art. 6(1)(b))	Necessary for contract performance
Processing payment	Billing details	Performance of a contract (Art. 6(1)(b))	Necessary for contract performance
Sending gifted certificates to a third party you designate	Recipient name/email, your message	Performance of a contract / your instruction (Art. 6(1)(b))	Consent / contract necessity
Customer support	Contact and order data	Legitimate interest (Art. 6(1)(f))	Legitimate interest
Marketing emails and priority-list updates	Email address	Consent (Art. 6(1)(a)) - opt-in, withdrawable anytime	Consent, withdrawable anytime
Site security, fraud prevention, abuse detection	IP address, device/log data	Legitimate interest (Art. 6(1)(f))	Legitimate interest
Analytics and improving the Service	Usage data, cookies	Consent (for non-essential cookies) / legitimate interest	Consent / legitimate interest
Complying with legal obligations (tax, accounting, regulatory requests)	Billing/order records	Legal obligation (Art. 6(1)(c))	Legal obligation

We never sell your personal data to third parties for their own independent marketing purposes.

4. Cookies and Tracking

We use cookies and similar technologies for essential site functionality, analytics, and (where you consent) marketing/retargeting. Non-essential cookies are only set after you give consent via our cookie banner, in line with Polish/EU e-Privacy and GDPR requirements and Thai PDPA consent standards. You can withdraw consent at any time through your browser settings or by contacting us at hello@tajlandia.pl.

5. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes above:

Account and order/certificate records: for the life of your account, plus up to 6 years afterward to meet Polish/Thai tax, accounting, and consumer-claim record-keeping obligations.
Marketing consent data: until you unsubscribe or withdraw consent, plus a suppression record kept indefinitely to honor your opt-out.
Support communications: up to 3 years after resolution.
Cookie/analytics data: typically 6 to 26 months, depending on the tool and purpose.

When data is no longer needed, we securely delete or anonymize it.

6. Who We Share Your Data With

We share personal data only where necessary, with:

Payment processors (for example, Stripe, PayU, or similar) to process transactions. They act as independent controllers or processors under their own privacy terms.
Hosting, cloud storage, and IT service providers who process data on our behalf under data processing agreements.
Email/communications platforms used to send transactional and marketing emails.
Analytics and advertising providers, only with your cookie consent where required.
Professional advisers (lawyers, accountants, auditors) where necessary.
Regulators, courts, or law enforcement, where required by Thai, Polish, or EU law, or to establish, exercise, or defend legal claims.
A successor entity, if we undergo a merger, acquisition, or asset sale, subject to this Policy (or equivalent protections) continuing to apply.

We do not permit third parties to use your personal data for their own unrelated purposes without your consent.

7. International Data Transfers

Because Tajlandia serves users in both Thailand and Poland/the EU, your data may be transferred and processed outside your home country, including to Poland, Thailand, and other European Union countries.

For EEA/Polish users: where we transfer personal data outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs), an adequacy decision, or another safeguard recognized under GDPR Chapter V. You may request a copy of the relevant safeguard by contacting us.
For Thai users: where we transfer personal data outside Thailand, we ensure the destination country/organization has adequate data protection standards, or we rely on another legal basis permitted under Section 28 of the Thai PDPA (such as your explicit consent, contract necessity, or approved safeguards such as binding corporate rules/standard contractual clauses recognized by the Thai PDPC).

8. Your Rights

If you are in Poland/the EEA (GDPR rights)

You have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten"), subject to legal exceptions.
Restrict or object to certain processing, including direct marketing (you can object to marketing at any time, free of charge).
Data portability - receive your data in a structured, machine-readable format.
Withdraw consent at any time, without affecting processing carried out before withdrawal.
Lodge a complaint with the Polish supervisory authority, the Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl), or with the supervisory authority of your own EU member state.

If you are in Thailand (PDPA rights)

You have the right to:

Access and obtain a copy of your personal data, or request disclosure of how it was obtained.
Request rectification of inaccurate data.
Request erasure, destruction, or anonymization of your data, subject to legal exceptions.
Object to collection, use, or disclosure of your data.
Restrict processing in certain circumstances.
Data portability, where technically feasible.
Withdraw consent at any time (this does not affect processing carried out before withdrawal).
Lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand if you believe we have violated the PDPA.

For all users

Regardless of location, you may exercise the above rights (to the extent applicable to you) by emailing hello@tajlandia.pl. We will respond within the timeframe required by applicable law (generally one month under GDPR, extendable by two further months for complex requests; 30 days under the Thai PDPA framework as a matter of good practice). We may need to verify your identity before actioning a request.

9. Children's Privacy

The Service is not directed at children, and we do not knowingly collect personal data from anyone under 18 years old (or the age of legal majority/digital consent in their jurisdiction, for example 16 in Poland unless a lower age down to 13 applies under Polish implementing law for information-society-service consent). If we learn we have collected data from a child without appropriate consent, we will delete it promptly. Parents/guardians who believe their child has provided us data should contact hello@tajlandia.pl.

10. Data Security

We use appropriate technical and organizational measures (encryption in transit, access controls, staff confidentiality obligations, and vendor due diligence) to protect your personal data against unauthorized access, loss, misuse, or alteration. No system is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach likely to result in a risk to your rights, we will notify the relevant supervisory authority (UODO for Poland/EEA-relevant breaches; the Thai PDPC for Thailand-relevant breaches) and affected individuals as required by applicable law.

11. Automated Decision-Making

We do not use your personal data for automated decision-making, including profiling, that produces legal or similarly significant effects on you.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date, and where changes are material, we will provide additional notice (for example, by email or a website banner) before the change takes effect.

13. Contact Us

Tajlandia Digital Sp. z o.o.
ul. Marszałkowska 126/134, 00-008 Warsaw, Poland
Email: hello@tajlandia.pl
Data Protection Officer: dpo@tajlandia.pl