Last updated: 9 October 2026

This policy explains what personal data Elephant Sanctuary | Est. 2007 (“we”, “us”) collects when you use elephant-sanctuary.org, book a program, support our Elephant Guardians program or contact us. It also explains why we collect it, who we share it with and what your rights are. We follow Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and, for visitors in the European Union and the United Kingdom, the main principles of the GDPR.

1. Who we are and how to contact us

Elephant Sanctuary | Est. 2007 runs ethical elephant programs in Chiang Mai, Bangkok, Pattaya and Phuket, Thailand. The website and our programs are operated by Happy Day With Elephant Limited Partnership (registration no. 0503567002631), 246/109 Moo 6, Nong Chom, San Sai, Chiang Mai 50210, Thailand, which is the data controller for this website. For any privacy question or request, contact us:

• Email: booking@elephant-sanctuary.org
• WhatsApp: +66 98 145 5500

2. What we collect

• Booking details: your name, email, phone or WhatsApp number, country, hotel or pickup location, program, date, number of guests, children’s ages (to price and plan the visit), and anything you tell us (for example dietary or mobility needs).
• Payment details: payments are handled by Stripe. We see your name, email, the amount, the payment status and the last four digits of your card. We never see or store full card numbers.
• Elephant Guardians and donations: your name, email, the name you want on your certificate, the elephant you chose, your support level, and (for gifts) the recipient’s name, email and your message.
• Messages: what you send us on WhatsApp, email, chat or our contact and booking forms.
• Photos: our guides may take photos during your visit and send them to you. If you can be identified, we use a photo publicly only with your permission.
• Website data: your IP address, device and browser type, pages visited, and how you arrived, collected through cookies and similar tools (see section 7).

3. Why we use it, and our legal basis

• To provide your booking or support (taking payment, arranging pickup, sending confirmations, certificates and updates you signed up for): necessary for our contract with you.
• To answer your questions and give support: contract or our legitimate interests.
• To keep accounting and tax records: legal obligation.
• To prevent fraud and keep the site secure: legitimate interests.
• To understand and improve our website and advertising (analytics and marketing cookies): your consent.
• To send you news, offers or Elephant Guardians invitations by email or WhatsApp: your consent. You can withdraw it at any time, using the unsubscribe link or by replying “STOP”. A phone number you give us for a booking is used for that booking only, unless you agree to more.

4. Who we share it with

We don’t sell your personal data. We share it only as needed with:

• Our partner sanctuaries and transport providers that operate your program: the names, number of guests, children’s ages, pickup location and contact number needed to run your day.
• Stripe: payments, receipts and monthly support plans.
• Pabbly Connect and Airtable: moving booking form data into our booking records.
• Google: email (Gmail), Google Tag Manager, Google Analytics and Google Ads measurement.
• Meta: WhatsApp (messages) and the Meta Pixel (advertising measurement on Facebook and Instagram).
• Brevo: email and messaging tools.
• OpenAI: an advertising measurement tag.
• Kinsta and Cloudflare: website hosting, security and caching.
• Our email-sending service: website emails such as booking confirmations.
• Professional advisers and authorities (such as accountants, or the police or courts) where the law requires it.

These providers process data on our behalf or under their own privacy policies.

5. International transfers

Some of these providers store data outside Thailand, for example in the United States or the European Union. Where required, we rely on the providers’ contractual safeguards, such as standard contractual clauses, to protect your data.

6. How long we keep it

• Booking and payment records: for as long as needed to provide the service, then for up to 5 years for accounting and tax purposes.
• Elephant Guardians records: while your support is active, then for up to 5 years for accounting purposes.
• Messages: up to 24 months after your last contact, unless we need them longer for a dispute.
• Marketing consent: until you withdraw it.
• Analytics data: as set in those tools (for example, up to 14 months in Google Analytics).

7. Cookies and similar tools

Our website uses:

• Essential cookies that make the site, booking forms and security work. These are always on.
• Analytics cookies (Google Analytics via Google Tag Manager) that show us how the site is used.
• Marketing cookies and pixels (Meta Pixel, Google Ads, OpenAI) that measure our advertising.

Where required, analytics and marketing cookies are used only after you accept them in our cookie banner. You can change your choice at any time through the cookie banner or your browser settings. Blocking some cookies may affect how the site works.

8. Children

We collect children’s names and ages only from the parent or guardian who makes the booking, to price and plan the visit. Elephant Guardians and donations are for adults; a parent or guardian should pay on a child’s behalf.

9. How we protect your data

Our website uses encrypted connections (HTTPS). Card payments are processed by Stripe, which is certified to PCI DSS. Access to booking records is limited to staff who need it.

10. Your rights

Under the PDPA (and the GDPR, where it applies), you can ask us to:

• give you access to your data, or a copy of it;
• correct it;
• delete it;
• restrict how we use it, or object to it being used;
• transfer it to you or to another organisation.

You can also withdraw your consent at any time. Contact us using the details in section 1. We reply within 30 days. We may need to keep some data where the law requires it, for example accounting records.

If you’re not happy with how we handled your data, you can complain to Thailand’s Personal Data Protection Committee (PDPC). If you’re in the EU or UK, you can complain to your local data protection authority.

For how cancellations and refunds work, see our Refund & Cancellation Policy.

11. Changes to this policy

We may update this policy from time to time. The latest version is always on this page, with the date it was last updated at the top.