NAWA Spa
TH/EN
Become a partner
Legal

Privacy Policy

Last updated: 24 September 2026

This policy explains how NAWA collects, uses and protects your personal data when you use nawaspa.com and apply to or take part in our Partner Program. It is written to meet Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) and, for visitors in Europe, the GDPR.

1. Who we are

NAWA provides a hotel and spa management system and runs the NAWA Partner Program. We are the data controller for information collected through nawaspa.com and the Partner Program.

Note: each spa or hotel that uses the NAWA system has its own separate privacy policy for its own booking site. This policy covers only the central nawaspa.com site and the Partner Program.

2. Information we collect

Information you give us directly

When you apply to the Partner Program we collect: your name, email, phone number, company or business name (if any), applicant type (individual/company), your experience in the hotel, spa and travel industry, and any additional message you include.

Once you are approved and use the portal, we store what you submit — the companies you refer, their contacts, and the information needed to calculate and pay your commission (including payee and tax details).

Information collected automatically

We use two analytics tools to understand overall usage: Vercel Analytics — cookieless, storing no cookies and not identifying you (e.g. pages visited and approximate region from IP) — and Google Analytics 4, which uses cookies (_ga, _ga_*) and online identifiers to measure visits and on-page interactions such as scrolling, link clicks, downloads and form starts/submissions (never what you type). Google Analytics runs only if you accept analytics cookies, and we keep Google signals and ad personalisation turned off. Our public forms use Cloudflare Turnstile to prevent spam and bots.

3. Purposes and legal bases

  • Assessing applications: reviewing and contacting partner applicants (basis: steps before entering a contract, and consent).
  • Running the program: opening portal accounts, recording referrals, calculating and paying commission (basis: performance of a contract).
  • Tax and accounting: issuing documents and withholding tax as required by law (basis: legal obligation).
  • Analytics: aggregate, non-identifying usage measurement via Vercel Analytics, which uses no cookies (basis: legitimate interest); and usage measurement via Google Analytics 4, which uses cookies, only with your consent (basis: consent).
  • Security: preventing misuse and spam (basis: legitimate interest).

4. Cookies and analytics

We show a cookie-consent banner on your first visit. Cookies strictly necessary for the site always run; non-essential cookies — the analytics cookies set by Google Analytics (_ga, _ga_*) — run only if you accept, and you can change or withdraw your choice at any time. Vercel Analytics is cookieless.

5. Disclosure and sub-processors

We do not sell your personal data. We share it only as needed with service providers who help us operate, under data-processing agreements:

  • Supabase: database and authentication.
  • Vercel: website hosting and usage analytics.
  • Google: website usage analytics (Google Analytics 4) — only with your analytics-cookie consent.
  • Brevo: sending email (e.g. application decisions and login details).
  • Cloudflare: bot and spam protection (Turnstile).
  • Upstash: rate limiting for security.

We may disclose data where required by law, or to protect rights and safety.

6. International transfers

Some providers above may process data on servers outside Thailand. Where that happens, we ensure appropriate safeguards as required by the PDPA.

7. Data retention

We keep application and partner data for as long as needed for the purposes above. For active partners we keep it for the duration of the relationship, and afterwards only as long as tax and accounting law requires (generally up to 10 years). Applications that are not accepted are kept only as long as needed, then deleted or anonymised.

8. Your rights under the PDPA

Under the PDPA you have the right to: access and obtain a copy of your data, correct it, erase or destroy it, restrict its use, object to processing, request portability, and withdraw consent at any time (withdrawal does not affect processing already lawfully carried out).

To exercise these rights, contact us below. You also have the right to complain to Thailand’s Personal Data Protection Committee (PDPC) if you believe processing is unlawful.

9. Data security

We use appropriate technical and organisational measures, such as encryption in transit, access limited to those who need it, and access logging. No system is 100% secure, so please keep your portal password confidential.

10. Contact us

For questions about this policy, or to exercise your rights, contact:
Email: info@nawaone.co

11. Changes to this policy

We may update this policy from time to time. For significant changes we will update the “Last updated” date above and notify you as appropriate.