PRIVACY NOTICE
H.I.S. Tours Co., Ltd. and its affiliated companies (collectively referred to as the “Company”, “we”, “us” or “our”) place the highest importance on protecting your privacy and personal data. As a provider of international travel experiences and a broad range of services across our affiliated businesses—including professional travel services, carefully selected quality products for young members of the family,
and other products and services—we have prepared this Privacy Notice to explain how we collect, use, disclose and protect your personal data under the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”), as well as your rights.
1. Who Does This Notice Apply To?
This Privacy Notice applies to the following persons (collectively referred to as “you” or the “data subject”):
1.1 Individual customers
Current customers, former customers and prospective customers, such as individuals who register to request information or participate in marketing activities.
1.2 Individuals associated with corporate customers
Directors, authorized representatives, agents, employees or contact persons of business partner organizations or corporate customers.
1.3 Other individuals whose information is provided to the Company
Beneficiaries under an insurance policy or contract, or reference persons identified in relevant documents.
2. Sources and Types of Personal Data We Collect
We collect your personal data from the following sources:
2.1 Directly from you
Through communication channels used to request information or book travel services, both offline and
online.
2.2 From third parties
2.2.1 Your employer: Where your employer books services or coordinates travel arrangements and benefits for you.
2.2.2 Travel agents or business partners: Where they forward information for coordination purposes.
2.2.3. Family members or travel companions: Where they make a booking on your behalf.
2.3 From publicly available sources
Your company’s website, your organization, other public sources or referrals.
3. Categories of Personal Data We Process
3.1 Identification information
Full name, nickname, age, gender, date of birth, nationality, photograph, signature, national identification number, passport number, passport bio-data page and visa information.
3.2 Contact information
Current address, registered address, document delivery address, mobile telephone number, emailaddress and LINE ID.
3.3 Travel and service details
Photographs taken during travel, travel history, flight number, hotel booking details and selected tour programs.
3.4 Financial information
Payment details, proof of payment or transfer slips, bank account number and partial credit/debit card information.
3.5 Reference person information
Name and telephone number of an emergency contact person.
3.6 Sensitive personal data
Food allergy information, medical conditions, disability information and religion.
4. Necessity of Processing
Where personal data is required for entering into or performing a contract, or for compliance with applicable law, and you do not wish to provide
such personal data, the Company reserves the right not to proceed because the information necessary for performance is unavailable or the Company
may otherwise incur legal liability.
The Company does not have a policy of collecting sensitive personal data, such as religious beliefs or blood type appearing on a national identification card or other documents, without a lawful basis or your consent. You are therefore requested to redact such information before submitting the documents to the Company. If the Company has no lawful basis for processing such information and you have not redacted it, you acknowledge and agree that the Company may conceal, strike through, black out or delete such sensitive personal data immediately upon receipt.
5. Purposes of Processing
We process your personal data on different lawful bases for the following purposes:
5.1 Travel services and bookings
Examples : To reserve airline tickets, hotels, rental cars, train tickets and admission tickets, and to arrange tour programs under the contract you have purchased.
Lawful Basis : Performance of a contract
5.2 Membership and benefits administration
Examples : To register you for a membership card.
Lawful Basis : Performance of a contract and compliance with a legal obligation
5.3 Document and visa processing
Examples : To coordinate with embassies or visa application centers and prepare travel documents in accordance with the requirements of
each country.
Lawful Basis : Performance of a contract and compliance with a legal obligation
5.4 Safety and insurance arrangements
Examples : To arrange travel insurance and coordinate with medical facilities or your emergency contact in the event of an emergency or accident during travel.
Lawful Basis : Performance of a contract and vital interests
5.5 Claims management
Examples : To handle complaints, resolve disputes and provide remedies for damage.
Lawful Basis : Legitimate interests and legal claims
5.6 Payments and taxes
Examples : To verify deposits and service payments, process refunds, issue receipts and tax invoices, and prepare
accounting records as required by law.
Lawful Basis : Performance of a contract and compliance with a legal obligation.
5.7 Personalized care and assistance
Examples : To arrange suitable meals, such as halal or vegetarian meals, and accommodate health-related or disability-related limitations that you have notified to us.
Lawful Basis : Explicit consent for sensitive personal data
5.8 Communications and notifications
Examples : To notify you of travel schedules, appointments, flight or hotel changes, and to respond to inquiries through various channels.
Lawful Basis : Performance of a contract and legitimate interests
5.9 Service development and marketing
Examples : To obtain post-travel feedback, notify you of privileges or new tour promotions, and prepare public relations materials where you have consented to photographs or video recordings.
Lawful Basis : Consent or legitimate interests
If we have any additional purposes, we will notify you and obtain additional consent, unless the law permits such processing without consent.
6. Disclosure of Personal Data
We may disclose personal data to third parties only to the extent necessary to achieve the following purposes:
6.1 Service providers
Transportation providers such as airlines, railway operators, cruise companies and car rental companies; accommodation providers; booking management system providers; insurance companies; e-commerce platforms; and information technology service providers.
6.2 Other organizations
Business partners, banks, auditors, external auditors, legal advisers, business transferees, assignees and social media platforms.
6.3 Government authorities
Department of Tourism, Immigration Bureau, Revenue Department, Office of the Personal Data Protection Committee, courts and other relevant government authorities.
7. Cross-Border Transfer of Personal Data
Due to the nature of the Company’s international travel business, the Company may need to send or transfer your personal data to countries or recipients outside Thailand for the purpose of performing the contract you have entered into with the Company, as follows:
7.1 Primary Destination Countries
7.1.1 Japan (affiliate: H.I.S. Co., Ltd.) and other countries included in the tour program you have selected.
7.2 Categories of Overseas Recipients
7.2.1 Affiliated companies : To coordinate and provide assistance while you are staying or travelling in the relevant country.
7.2.2 Local travel service providers : Overseas partner tour operators responsible for arranging transportation, local tour guides and travel programs.
7.2.3 Overseas accommodation and hotel providers : To reserve accommodation in accordance with your tour itinerary.
7.3 Personal Data Protection Standards
Where the destination country does not provide an adequate level of personal data protection as required by law, and to ensure that the transfer is necessary for performance of the contract, the Company will implement the following measures:
7.3.1 Require overseas recipients to maintain appropriate data security measures in accordance with the standards prescribed by personal data protection law.
7.3.2 Standard Contractual Clauses.
7.3.3 Binding Corporate Rules.
7.3.4 Obtain your consent where necessary.
8. Retention Periods
We will retain your personal data for as long as necessary to achieve the purposes stated in this Privacy Notice. Upon expiry of the applicable retention period, the Company will delete, destroy or anonymize the personal data.
8.1 General service information
10 years from termination of the contract or the last use of services (based on the applicable statutory limitation period).
8.2 Financial and tax information
5–10 years in accordance with the Accounting Act / Revenue Code and other applicable laws.
8.3 Sensitive personal data (health, religion, etc.)
1 year from the date of the most recent trip, or until you withdraw your consent.
8.4 Marketing information
Until you withdraw your consent, or 3 years from the last contact.
8.5 Photographs/videos for public relations
Until you withdraw your consent.
9. Data Security
The Company implements appropriate and stringent technical, administrative and physical security measures to prevent the loss, unauthorized access, use, alteration or disclosure of personal data. Access to your personal data is
restricted to personnel whose duties and responsibilities require such access on
a need-to-know basis. The Company also uses appropriate technologies for data
protection and authentication.
In addition, where the Company engages external service providers to process personal data, the Company selects and supervises such providers to ensure that they maintain adequate security measures consistent with the Company’s policies, so that your personal data remains securely protected throughout the retention period.
10. Data Subject Rights
Subject to the conditions prescribed by law, you have the following rights:
10.1 Right to Withdraw Consent
For purposes for which you have given consent, you may withdraw your consent at any time while your personal data remains under the Company’s control. Withdrawal of consent will not affect any processing lawfully carried out on the basis of your consent before its withdrawal.
10.2 Right to Be Informed
You have the right to be informed of the purposes for which your personal data is collected, used or disclosed, together with the relevant details. The Company provides such information through this Privacy Notice before or at the time your personal data is collected.
10.3 Right of Access and to Obtain a Copy, Including Disclosure of the Source of Your Personal Data
You have the right to request access to personal data under the Company’s responsibility and to obtain a copy of such data, including the right to request disclosure of the source of personal data that you did not consent to provide.
10.4 Right to Data Portability Where Data Is Held in a Specific Format
You have the right to receive your personal data in a format that can be read or used by automated tools or devices, and to request that such data be sent or transferred to another data controller where this can be carried out by automated means.
10.5 Right to Object
You have the right to object to the collection, use or disclosure of your personal data in certain circumstances, such as processing for marketing purposes or profiling.
10.6 Right to Restriction of Processing
You have the right to request that the Company temporarily restrict the use of your personal data, for example while the Company verifies the accuracy of data that you have challenged.
10.7 Right to Erasure or Destruction
You have the right to request that the Company delete, destroy or anonymize your personal data when it is no longer necessary for the relevant purposes or when you withdraw your consent.
10.8 Right to Rectification
You have the right to request that the Company correct your personal data so that it is accurate, current, complete and not misleading.
10.9 Right to Lodge a Complaint with the Expert Committee under the Personal Data Protection Law
Please note that your rights are not absolute. In certain circumstances, the Company may need to refuse your request where there is a lawful reason to do so, such as where the request conflicts with applicable law or a court order.
You may submit a request to exercise your rights through the contact channels specified in Section 12 of this Privacy Notice. The Company will process the request within 30 days from receipt, or within the period prescribed by law.
11. Changes to This Privacy Notice
The Company may periodically review and amend this Privacy Notice to reflect changes in its operations, legal requirements or technology. Material changes will be notified through an appropriate channel, such as email, the Company’s website or a notice provided before use of the services.
12. Contact Channels
For questions about the collection, use or disclosure of your personal data, or to exercise your rights under this Privacy Notice,
please contact us at:
E-mail: tha-ww
his-world.com
Contact address: 246 Times Square Building, 12th Floor, Khlong Toei, Bangkok 10110, Thailand
Issued on 1 August B.E. 2569 (2026)