Cookie Policy
Effective 15 January 2026 · PDPA-compliant consent
This Cookie Policy explains what cookies and similar technologies ThaiHotelMinder Co., Ltd. uses on thaihotelminder.org and inside the advisory workspace, why we use them, and how you can control them. The Policy is aligned with the Personal Data Protection Act B.E. 2562 (PDPA) and with the guidance issued by the Personal Data Protection Committee (PDPC) of Thailand.
1. What is a cookie?
A cookie is a small text file that a website places on your browser or device when you visit it. Cookies allow the website to remember your actions and preferences (such as language, session, workspace token) over a period of time, so that you don't need to re-enter them every time you return. Similar technologies include local storage, session storage, pixels, tags and SDK identifiers — this Policy treats them all as "cookies" for readability.
2. How we categorise cookies
We categorise cookies into three groups, following the PDPC's guidance:
- Strictly necessary — required for the workspace and website to function; cannot be switched off. Includes the session cookie, the CSRF-protection cookie, and the login state.
- Analytics — help us understand how visitors interact with the website (page views, time on page, aggregated funnel). Set only if you accept.
- Marketing — support our Bangkok-based sales team in measuring the effectiveness of our editorial content and in reaching hoteliers on LinkedIn. Set only if you accept.
3. Cookies we set — details
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| thm_session | ThaiHotelMinder | Workspace session identifier | Session | Strictly necessary |
| thm_csrf | ThaiHotelMinder | CSRF protection | Session | Strictly necessary |
| thm_cart_v1 | ThaiHotelMinder | Advisory cart persistence | 30 days | Strictly necessary |
| rw_cookie_choice | ThaiHotelMinder | Records your cookie preference | 12 months | Strictly necessary |
| _ga, _ga_* | Google Analytics 4 | Aggregated audience analytics | 14 months | Analytics |
| li_at | Marketing attribution — B2B campaigns | 12 months | Marketing |
4. How you control cookies
The banner shown on your first visit lets you accept or decline analytics and marketing cookies. You can change your choice at any time by clearing the cookie rw_cookie_choice and reloading the page — the banner will reappear. Most browsers also allow you to block cookies globally or per site. Blocking strictly-necessary cookies will prevent the workspace from functioning.
5. Third-party cookies
We do not embed third-party marketing pixels from ad networks or programmatic buyers. The only third-party cookies we set are those listed in the table above (Google Analytics 4 for analytics, LinkedIn for B2B attribution). We use these providers because they support server-side event ingestion, which minimises the personal data crossing the wire.
6. Consent under the PDPA
The setting of analytics and marketing cookies constitutes processing of Personal Data under the PDPA. We rely on the "consent" lawful basis (PDPA s.19), collected via the cookie banner. Consent can be withdrawn at any time, as easily as it was given. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
7. Changes to this policy
We may update this Cookie Policy from time to time. The version at the top of this page always reflects the currently applicable text. Material changes are announced in the workspace at least 30 days in advance.
8. Local storage and session storage
In addition to cookies, we use browser localStorage to persist the advisory cart across sessions (thm_cart_v1, 30 days) and to remember your dark-mode preference (thm_theme, indefinite). These local-storage entries are strictly necessary for the workspace to function and cannot be disabled without also disabling the corresponding feature.
9. Cookies and PDPA data-subject rights
As with any Personal Data processing under the PDPA, you enjoy the full spectrum of data-subject rights in respect of the analytics and marketing cookie data collected under your consent. Specifically: right of access (s.30), right of rectification (s.35), right of erasure (s.33), right to restrict processing (s.34), right to data portability (s.31), right to object (s.32), right to withdraw consent (s.19). To exercise any of these rights in respect of cookie-derived Personal Data, write to dpo@thaihotelminder.org with your workspace ID or the IP address of the browser from which the cookies were set.
10. Analytics — configuration detail
Our Google Analytics 4 configuration is calibrated for privacy: (a) IP addresses are anonymised to /24 blocks before ingestion; (b) advertising features are disabled; (c) data-retention is set to 14 months, not the default 26; (d) data-sharing with Google services is disabled; (e) cross-device tracking is disabled; (f) the entire configuration runs server-side through a Bangkok-hosted tag manager, minimising the personal data crossing the wire in the first place.
11. LinkedIn attribution — configuration detail
The LinkedIn Insight Tag is set only if you accept the marketing category. It measures the effectiveness of our Bangkok-based sales team's B2B campaigns aimed at hoteliers. We do not run retargeting audiences off this cookie. The cookie's data is deleted from our LinkedIn Campaign Manager account after 90 days.
12. Cookies and child users
The Services are provided on a business-to-business basis and are not intended for use by children under the age of 20 (the age of majority in Thailand). We do not knowingly set any cookie on a device operated by a child. If you believe a child has interacted with our workspace or website, please contact us so that we can delete any associated data.
13. Cookies during PDPA data-subject requests
When you initiate a data-subject request through our public portal, we do not set any additional cookie beyond the strictly-necessary session and CSRF cookies. The processing of your request is logged in our internal system for 3 years from closure, in line with our retention schedule described in the Privacy Policy.
14. Do-Not-Track and Global Privacy Control
We honour the browser Global Privacy Control (GPC) signal where it is present: if your browser sends GPC, we treat that as a valid withdrawal of consent to analytics and marketing cookies, regardless of the state of the cookie banner. GPC does not override strictly-necessary cookies, which are essential to running the workspace.
15. Cookies and cross-border transfers
Google Analytics and LinkedIn are US-headquartered organisations. Where we transfer cookie-derived Personal Data outside Thailand for the purpose of these analytics and marketing services, we rely on the mechanisms permitted by the PDPA (Standard Contractual Clauses in force with each provider). The list of authorised transfers is maintained in the Security Whitepaper.
16. Cookies during workspace impersonation for support
Where a workspace user has explicitly requested support that requires an internal ThaiHotelMinder operator to log into their workspace with a limited-scope impersonation token, an additional strictly-necessary cookie (thm_impersonate_note) is set for the duration of the session to display a persistent banner reminding the operator that they are acting on behalf of the customer. This cookie carries no Personal Data and is deleted at logout.
17. Contact
For cookie-related questions, write to our Data-Protection Officer at dpo@thaihotelminder.org. For strictly-necessary cookie complaints, our billing office at +66 2 664 7500 extension 4 can also help.