1. About this Notice
This Notice applies to personal data processed when you visit, use, communicate with, or otherwise interact with LunosLab and its services. It should be read together with any applicable agreement with LunosLab and any privacy notice issued by a hotel or other customer that uses our services.
2. Our role: controller and processor
When LunosLab is a data controller
LunosLab is the data controller for personal data we process to operate our business and services, including data relating to our website visitors, prospective customers, account holders, and business contacts.
When LunosLab is a data processor
When a hotel or other customer uses LunosLab to process personal data on its behalf, that customer is the data controller and LunosLab acts as its data processor. We process that personal data only under the customer’s documented instructions and the applicable data processing agreement.
3. Categories of personal data
Depending on how you interact with us, we may process the following categories of personal data:
- Identity data, such as your name, job title, and organization.
- Contact data, such as your email address, telephone number, and business address.
- Account and authentication data, such as account identifiers, credentials, and access permissions.
- Hotel guest and booking data provided by a hotel customer, such as guest names, reservation details, stay preferences, and service requests.
- Communications data, such as enquiries, support requests, feedback, and correspondence with us.
- Technical data, such as IP address, device, browser, operating system, log data, and approximate location derived from IP address.
- Usage data, such as service interactions, feature usage, and audit records.
- Billing and transaction data necessary to administer payments and subscriptions.
4. Sources of personal data
- Directly from you when you create an account, contact us, submit information, or use our services.
- From a hotel or other customer that provides personal data to us for processing on its behalf.
- From authorized users within your organization who administer or use the services.
- Automatically from your device or use of the services through cookies, logs, and similar technologies.
- From third parties where permitted by law, including service providers, business partners, and publicly available sources.
5. Purposes of processing
- To provide, operate, maintain, and deliver the services requested by you or our customer.
- To create and manage accounts, authenticate users, and administer access controls.
- To respond to enquiries, provide customer support, and resolve technical issues.
- To protect the security, integrity, and availability of our services, systems, and users.
- To analyze service use, troubleshoot, develop, and improve our services.
- To send service-related communications and, where permitted, marketing communications.
- To comply with legal obligations, enforce our agreements, and establish, exercise, or defend legal claims.
6. Legal bases for processing
Where the Personal Data Protection Act B.E. 2562 (2019) or other applicable law requires a legal basis, we process personal data on one or more of the following bases:
- Performance of a contract or steps taken at your request before entering into a contract.
- Compliance with a legal obligation.
- Our or a third party’s legitimate interests, where those interests are not overridden by your rights and freedoms.
- Your consent, where consent is required or otherwise appropriate.
7. Use of artificial intelligence
LunosLab may use artificial intelligence and machine learning technologies to help process information, generate suggested responses, summarize content, classify requests, and improve service functionality. AI-generated output may be inaccurate, incomplete, or unsuitable for a particular purpose and must be reviewed by an appropriately authorized person before it is relied upon.
We apply appropriate contractual, organizational, and technical safeguards when using AI service providers. We do not use personal data processed for a customer to train general-purpose AI models unless the customer has expressly authorized that use in writing.
By using AI-enabled features, you confirm that you will not submit personal data or confidential information unless you are authorized to do so and have provided any notices or obtained any consents required by applicable law.
8. Disclosure of personal data and recipients
We may disclose personal data only where necessary for the purposes described in this Notice, including to:
- Hotels or other customers and their authorized users, where LunosLab processes data on their behalf.
- Service providers that support hosting, infrastructure, security, analytics, communications, payment, and customer support.
- Professional advisers, such as auditors, insurers, lawyers, and accountants.
- Government, regulatory, law-enforcement, or other authorities where disclosure is required by law or necessary to protect rights, safety, or security.
- A prospective or actual buyer, seller, investor, or successor in connection with a merger, acquisition, financing, reorganization, or sale of assets.
9. International transfers
Personal data may be transferred to, stored in, or accessed from countries outside Thailand or your country of residence where our service providers, affiliates, or customers operate.
Where required, we will implement appropriate safeguards for international transfers, such as contractual protections, assessments of the recipient’s data protection measures, or another transfer mechanism permitted by applicable law.
10. Retention of personal data
We retain personal data only for as long as necessary for the relevant purpose, to comply with legal obligations, resolve disputes, and enforce agreements. The following periods are subject to any longer period required by law or an applicable customer agreement.
| Category of personal data | Retention period |
|---|---|
| Account and profile data | [For the duration of the account and [X] years after closure] |
| Hotel guest data processed for a customer | [For the period instructed by the hotel customer or as set out in the applicable agreement] |
| Technical, log, and usage data | [For [X] months/years, unless a longer period is needed for security or legal purposes] |
| Support and communications data | [For [X] years after the matter is closed] |
| Billing, tax, and legal records | [For the period required by applicable law] |
11. Security of personal data
We use appropriate administrative, technical, and physical safeguards designed to protect personal data against accidental or unlawful loss, alteration, unauthorized disclosure, access, or use. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Your rights
Subject to applicable law and any relevant exceptions, you may have the following rights in relation to your personal data:
- To request access to and obtain a copy of your personal data.
- To request correction of inaccurate or incomplete personal data.
- To request deletion, destruction, or anonymization of personal data.
- To request restriction of processing in certain circumstances.
- To request personal data portability where applicable.
- To object to processing based on legitimate interests or for direct marketing.
- To withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
- To lodge a complaint with the relevant data protection authority.
13. Contact us
To exercise your rights, ask a question about this Notice, or raise a privacy concern, please contact LunosLab using the following details:
Email: [privacy email]
If you are not satisfied with our response, you may contact the Personal Data Protection Committee or another competent data protection authority.
14. Changes to this Notice
We may update this Notice from time to time. We will publish the updated Notice and revise its effective date. Where required by law, we will provide additional notice or obtain consent for material changes.
15. Notice to hotel customers and hotel guests
If you are a hotel customer, you are responsible for providing an appropriate privacy notice to your guests, staff, and other individuals whose personal data you provide to LunosLab, and for ensuring that you have a valid legal basis to instruct us to process that data. If you are a hotel guest, the hotel is generally responsible for responding to your privacy requests because it determines the purposes and means of processing your personal data.
Hotel guests should first contact the relevant hotel to exercise privacy rights. LunosLab will assist its hotel customers with requests as required by the applicable data processing agreement and law.