Privacy Policy

This policy explains what personal data Elephant Pride Sanctuary collects when you use this website and book an elephant experience with us, how we use it, who we share it with, and what rights you have.

1. Data Controller

The data controller responsible for your personal data is:

2. Data we collect when you book

name, email, phone number, country of residence.

tour selected, date, number of guests (adults, children, infants), hotel / pickup location, special requests.

Stripe-provided payment identifiers and the last 4 digits of the card used. We do <em>not</em> store full card numbers or CVV. Payment processing is handled entirely by Stripe.

emails you send us and our replies, WhatsApp messages.

3. Cookies and similar technologies

This site uses only the following client-side storage:

<code>epride_lang</code> (localStorage + cookie) remembers your chosen language. No personal data, no tracking.

Cloudflare Turnstile, a privacy-preserving CAPTCHA. It may set a short-lived cookie to verify you are not a bot when you submit a booking form. See <a>Cloudflare's privacy policy</a>.

Stripe payment session cookies, set only on the Stripe-hosted checkout page, not on this site. See <a>Stripe's privacy policy</a>.

We do not use Google Analytics, Facebook Pixel, or any cross-site tracking cookies.

4. Third parties we share data with

<strong>Stripe</strong> (Stripe Payments Europe, Limited) processes your booking payment. Receives your name, email, and payment details.

<strong>Resend</strong> (Resend, Inc.) sends booking confirmation, reminder, and cancellation emails. Receives your name, email, and booking summary.

<strong>Cloudflare Turnstile</strong> (Cloudflare, Inc.) verifies booking submissions are made by a human. Receives minimal request metadata to render the challenge.

We do not sell your data and do not share it with third parties for advertising.

5. Legal basis for processing (GDPR Art. 6)

processing your booking and sending related emails (Art. 6(1)(b)).

retaining transaction records for tax and accounting (Art. 6(1)(c)).

preventing fraud and abuse via Turnstile (Art. 6(1)(f)).

6. How long we keep your data

5 years (Thai accounting requirement).

we do not currently send marketing emails. If you opt into newsletters in the future, you may unsubscribe at any time.

retained for 30 days for security and debugging.

7. Your rights (GDPR / similar regimes)

If you are in the EU, UK, or another jurisdiction with similar privacy law, you have the right to:

access the personal data we hold about you

request correction of inaccurate data

request deletion (subject to legal retention obligations)

object to processing based on legitimate interest

request a copy of your data in machine-readable form

lodge a complaint with your local supervisory authority (e.g. your national data protection authority in the EU)

To exercise any of these rights, email us at <a>hello@elephantpride.com</a>. We will respond within 30 days.

8. International transfers

Because the sanctuary operates from Thailand, your data is processed in Thailand and in the regions where our service providers (Stripe, Resend, Cloudflare) operate. Where personal data is transferred outside the EEA, we rely on the service provider's Standard Contractual Clauses or equivalent safeguards.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes affecting how we process your data will be communicated to existing customers by email where possible.

10. Contact

Questions about this policy or your data: <a>hello@elephantpride.com</a>.