Privacy Policy

Magic Suites & Villas is operated by บริษัท เคเซม จำกัด (KaSem Co., Ltd.), company registration number 0845558001502, Bo Put Moo 5, 51/140, Ko Samui District, Surat Thani, Thailand. We are the data controller for the information described here.

For any privacy question or request, contact info@magicsamui.com or +66 95 246 6011.

When you make a booking

Your name, email address, phone number, country, stay dates, the room or villa booked, the amount paid, and any requests you make (for example arrival time, airport transfer, or dietary preferences). Bookings are processed through our booking system, Cloudbeds. Card details are handled by Cloudbeds and its payment providers — we never see or store your full card number.

When you contact us

If you use our contact form we receive the name, email address or phone number, and message you provide. If you join the waiting list for our new villas we receive your email address only.

When you message our assistant

We answer guest questions on WhatsApp, Messenger, Instagram, and through the chat window on this website. We receive your phone number or platform account, your name where the platform provides it, and the content of your messages, including any preferences or dietary information you choose to share.

When you check your guest points

Our points page asks for the phone number you booked with, purely to find your balance. The number is used for that lookup and is not stored by the website or added to any marketing list.

Automatically, as you browse

Your IP address, device and browser type, pages viewed, referring site, and how you interact with pages. This includes session recordings and heat maps — the next section explains this in full.

We use cookies and similar technologies that are necessary for the site and booking engine to work, and others that help us understand how the site is used.

Google Analytics tells us how many people visit, which pages they read, and how they arrived.

Microsoft Clarity records how visitors move through the site, including mouse movement, scrolling and clicks, and can replay that as an anonymous session recording. We use it to find pages that are confusing or broken. Clarity masks text entered into form fields by default, and we do not use it to identify individuals.

Cloudbeds sets cookies needed to hold your booking while you complete it.

Some pages embed third-party content, such as a transport booking widget from 12Go, which may set its own cookies.

You can block or delete cookies in your browser settings. Doing so may stop the booking engine working correctly. You can opt out of Google Analytics using Google's browser add-on.

We advertise this website through Google. Google and its partners use cookies to show our ads on other sites you visit, and to measure whether those ads led to a booking. This may include remarketing — showing our ads to people who have already visited magicsamui.com.

We do not upload guest lists, email addresses or phone numbers to advertising platforms, and we do not use booking or conversation content to target ads.

You can control the ads you see through Google My Ad Center, or opt out of personalised advertising from many companies at optout.aboutads.info.

To take and manage your booking; to answer your questions before, during and after a stay; to arrange things you ask for such as airport transfers or breakfast; to run our guest points programme; to keep the website secure and working; to understand how the site is used; to advertise our villas; and to meet our legal and accounting obligations, including guest registration requirements under Thai law.

We rely on the performance of our contract with you for booking and hosting, your consent for optional analytics and advertising cookies, our legitimate interest in running and improving the business, and legal obligation where the law requires us to keep records.

Guest messages are answered by an assistant that uses artificial intelligence provided by Anthropic to draft replies. Your message content is sent to Anthropic for that purpose. A person can and does take over any conversation. We do not make automated decisions that have a legal or similarly significant effect on you.

We do not sell your personal information, and we do not share it for anyone else's marketing. We share only what is needed with the service providers who help us operate:

• Cloudbeds — booking system and payment processing
• Anthropic — drafting replies to guest messages
• Meta — WhatsApp, Messenger and Instagram messaging
• Google — analytics, advertising, and email delivery
• Microsoft — Clarity analytics
• Vercel and DigitalOcean — website and server hosting

If you book through a travel site such as Booking.com, Airbnb, Expedia or Agoda, that company has its own privacy policy covering the information you gave them, and they pass us what we need to host you.

We may also disclose information where we are legally required to, for example to Thai immigration or tax authorities.

We are based in Thailand, and the providers above operate servers outside Thailand, including in the United States, Singapore and the European Union. Where information about visitors from the European Economic Area or the United Kingdom is transferred abroad, our providers rely on standard contractual clauses or equivalent safeguards.

Booking records are kept for as long as needed to run the business and to satisfy Thai accounting and guest-registration requirements. Guest messages are kept so returning guests get continuity of service. Points records are kept for the life of the points, which expire three years after a stay. Analytics data is kept according to each provider's standard retention period.

If you would like your information deleted sooner, email us and we will remove what we are not legally required to keep.

This website and our messaging server are served only over encrypted HTTPS connections. Messages on WhatsApp, Messenger and Instagram are carried over Meta's own encrypted interfaces. Payment card details are handled by Cloudbeds and its payment providers and never reach our own systems.

Access to guest records is limited to the owner and the systems described above. Internal tools that display guest information require a password or secret key and are not publicly listed. Our server is backed up daily.

No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authority where the law requires it.

You can ask us for a copy of the information we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent for analytics or advertising cookies at any time. Guests in Thailand have these rights under the Personal Data Protection Act; visitors in the European Economic Area and the United Kingdom have equivalent rights under the GDPR.

Email info@magicsamui.com and we will respond within 30 days. You also have the right to complain to your local data protection authority.

Our website and services are intended for adults. We do not knowingly collect information from children under 16 other than the names and ages of children included in a family booking, which are provided by the adult making the booking.

We may update this policy as our business or the law changes. The date at the top shows when it was last revised, and the current version is always available at magicsamui.com/privacy.