Privacy Policy

Buying a villa means trusting us with more than an email address — in time, it means sending us your passport and your bank records. This policy explains exactly what we collect at each stage, why we hold it, who else sees it, and how long it stays with us.

1. Who we are

Open Space Villas Co., Ltd ("Open Space Villas", "we", "us") is the data controller responsible for the personal data described in this policy.

2. What this policy covers

This policy covers our website at openspacevillas.com, the enquiries we receive through it and through other channels, and the personal data we handle during the sale and purchase of our properties — including Green Valley on Koh Phangan. We have written it to cover the whole process rather than the website alone, because the most sensitive information we hold is collected later, when a purchase is underway.

We do not currently operate rental or resort management services. When resort operations begin, we will update this policy before collecting any guest data.

3. The laws that apply

We are a Thai company and our processing is governed by Thailand's Personal Data Protection Act B.E. 2562 (2019)(the "PDPA").

We advertise only within Thailand, but our buyers come from around the world. Where we hold personal data about someone located in the European Economic Area or the United Kingdom, we also honour the rights set out in the General Data Protection Regulation(the "GDPR"). Where the two frameworks differ, we apply whichever gives you the stronger protection.

4. What we collect, and when

We collect different information at different stages. Nothing in a later stage is collected unless you choose to move to it.

Our properties are sold as a registered 30-year lease of the land together with ownership of the structure built on it. Registering that lease requires us to submit identity and transaction documents to the Thai Land Department. We do not require you to form a Thai company to buy from us, so we do not collect company shareholder or director records.

5. Where we collect it from

• Our website form. Sent directly to our own email inbox. It is not stored in any third-party marketing platform.
• WhatsApp. Many buyers prefer to speak with us there. Those conversations are carried on Meta's infrastructure and are subject to WhatsApp's own privacy terms as well as this policy.
• Facebook and Instagram lead forms. We run advertising on Meta's platforms. If you submit one of their lead forms, Meta collects your details on its own systems first and we then retrieve them. Meta acts as an independent controller for the data it holds about you on its platforms.
• Email, telephone, and in person. Including site visits and meetings.
• From your advisers. Where your lawyer, broker, or bank provides documents on your behalf during a purchase.

6. Why we process it, and our lawful basis

7. Cookies and tracking

Once we begin running advertising campaigns, we will use the Meta (Facebook/Instagram) Pixel on our website to measure how those campaigns perform. Before the pixel loads, you will be shown a cookie banner, and it will run only if you choose "Accept". If you choose "Decline", or simply close the banner, the pixel will not load and no advertising cookie will be set. You can change your choice at any time using "Cookie Preferences" in the footer of every page.

This applies to our own website. It does not extend to Facebook, Instagram, or WhatsApp, which apply their own tracking when you use their apps directly — including if you message us on WhatsApp or respond to one of our lead-generation ads, in which case Meta collects your details on its own systems as well as passing them to us, as described in section 5.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

8. Who we share it with

We share personal data only where it is necessary, and only with:

• Google — our email and Google Sheets, where enquiry records are kept.
• Vercel — our website hosting provider.
• Meta — for WhatsApp conversations and advertising lead forms.
• The Thai Land Department — to register your lease and structure ownership.
• The Anti-Money Laundering Office (AMLO) and other Thai authorities — where we are legally required to report or respond.
• Banks and professional advisers — lawyers, accountants, and licensed agents involved in your transaction.

9. International transfers

Our email, document storage, and website hosting are provided by international companies, so your data may be stored or processed outside Thailand. Where we transfer personal data abroad, we do so in reliance on the conditions permitted by sections 28 and 29 of the PDPA — principally because the transfer is necessary to perform our contract with you, or under the contractual safeguards our providers offer, including standard contractual clauses where applicable.

10. How long we keep it

• Enquiries that do not lead to a purchase — kept for up to two years from our last contact, then deleted. You can ask us to delete them sooner.
• Identity and source-of-funds records — kept for a minimum of five years after the end of our business relationship, as Thai anti-money-laundering law requires.
• Contracts and transaction records — kept for up to ten years, reflecting the limitation period for contractual claims in Thailand and our tax and accounting obligations.

11. Your rights

Under the PDPA — and, if you are in the EEA or UK, under the GDPR — you may ask us to give you access to your data or a copy of it, correct it if it is wrong, delete it, restrict or object to how we use it, transfer it to another provider, or withdraw a consent you previously gave. Exercising these rights is free, and we will respond within 30 days.

12. How we protect it

Our website is served entirely over an encrypted connection. Enquiries go straight to a business email account protected by two-factor authentication, and identity documents are held in access-controlled storage available only to the people handling your transaction. We keep the amount of data we collect deliberately small, which is itself a meaningful protection.

13. If something goes wrong

If a personal data breach occurs, we will notify Thailand's Personal Data Protection Committee within 72 hours of becoming aware of it, as the PDPA requires. Where a breach is likely to create a high risk to your rights and freedoms, we will notify you directly and without undue delay.

14. Children

Our properties and services are intended for adults. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.

15. Changes to this policy

If we change how we handle personal data — for example when resort and rental operations begin — we will update this page and change the date at the top. Where a change materially affects your rights, we will tell you directly.

16. Contact and complaints

To exercise any of your rights, or to ask how we handle your information, email us at contact@openspacevillas.com or write to us at the address in section 1. We would always prefer to resolve a concern with you directly.

You also have the right to complain to the Office of the Personal Data Protection Committee (PDPC) in Thailand. If you are in the EEA or the UK, you may instead complain to your local data protection authority.