Legal
Last updated 17 September 2026
In short. This site is a brochure. It sets no cookies of its own, runs no analytics, carries no advertising and no tracking of any kind, and hosts its own fonts. Nothing is stored on your device unless you choose to load a map. If you only read, the sole personal information involved is the connection record our hosting provider keeps for every website. If you submit the enquiry form, we use what you tell us to reply and to assess whether a long-term lease is a sensible conversation, and we keep it for three years after we last hear from you. The one third party that can appear on a page is Google Maps, and it loads only if you ask it to.
This notice is written to meet the EU and UK General Data Protection Regulation (Articles 13 and 14) and Thailand's Personal Data Protection Act B.E. 2562 (section 23). Where the two regimes differ we set out both positions rather than blurring them.
This website is operated by the Thai companies that own the two properties described on it. They are the controllers of the personal information collected through this site and they are established in Thailand.
We do not publish their names, addresses, telephone numbers or email addresses on this site. That is a deliberate decision about how these properties are brought to market, not an attempt to be hard to reach. We give the full legal name and registered office of the controlling company in our first reply to any enquiry, and to anyone who asks for it through the privacy request form below, whether or not they have ever sent an enquiry. European, United Kingdom and Thai data protection law each expect a controller to be identifiable at the point information is collected, and we would rather state our position plainly here than leave it unsaid. If you would prefer not to give information to a party you cannot yet identify, please do not use the enquiry form.
We are not required to appoint a Data Protection Officer under Article 37 GDPR or section 41 of the Thai PDPA, and we have not appointed one.
It is more useful to tell you what is absent than to describe machinery we do not have.
If any of that ever changes, this notice changes with it and the date at the top moves.
This site is delivered by Netlify, Inc., which operates the servers and content delivery network that serve the pages. Like every web server, Netlify's systems record the technical details of each request: your IP address, the page requested, the date and time, and your browser's user-agent and language headers.
Under European law an IP address is personal information in our hands, so we say this plainly rather than leave it out: reading this site does put a connection record into a United States provider's logs, even if you never contact us. We do not see those logs in the ordinary course, we do not analyse them, and we do not use them to identify or profile visitors.
The enquiry form is the only place on this site where we deliberately collect information about you, and the only way to contact us.
Required: your name, work email address, country of residence, your role, the property you are interested in, your intended use, a description of your project, and your acknowledgement that you have read this notice.
Optional, and genuinely optional: company, telephone number, preferred lease term, your experience of Thailand, investment capacity band, funding status, timeline, whether you would like to visit, any message you wish to add, and whether you would like a non-disclosure agreement.
Recorded automatically with the submission: the language version of the site you were reading, and your IP address and browser user-agent, which our form provider captures and uses for spam filtering.
You are under no obligation to provide any of this. It is neither a statutory nor a contractual requirement. If you leave the optional fields empty we will still reply. If you do not complete the required fields we simply will not be able to reply, and nothing else follows (Article 13(2)(e) GDPR; section 23(2) PDPA).
Please do not include sensitive information in the free-text fields. We have no need for and do not want details of your health, race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, criminal record, or biometric or genetic data. If you send such information anyway, we will delete it.
| Purpose | Basis — EU / UK GDPR | Basis — Thai PDPA |
|---|---|---|
| Reading your enquiry, replying, and the discussions that follow about a possible lease | Article 6(1)(b), steps taken at your request before entering a contract | Section 24(3) |
| Assessing whether a long-term lease is realistic for both sides, prioritising replies, keeping a record of our dealings | Article 6(1)(f), legitimate interests | Section 24(5) |
| Preparing a non-disclosure agreement, if you ask for one | Article 6(1)(b) | Section 24(3) |
| Loading a Google map, if you choose to | Article 6(1)(a), your consent | Section 24(1) |
| Establishing, exercising or defending legal claims, and meeting legal and tax obligations | Articles 6(1)(c) and 6(1)(f) | Sections 24(6) and 24(5) |
We rely on your consent only for the map. The tick box on the form is an acknowledgement that you have read this notice. It is not the legal basis on which we handle your enquiry, and ticking it does not sign you up to anything.
No automated decisions. A person reads every enquiry. We use the answers you give to prioritise replies, but no decision producing legal or similarly significant effects is taken by automated means.
No marketing. We do not send newsletters, mailing lists or unrelated opportunities. We reply to your enquiry and continue that conversation. If we ever want to do more we will ask separately, by an unticked box, and a refusal will cost you nothing.
Each property page, and the location section of the home page, offers a map of where the land is. The map does not load until you choose to load it. Until then nothing on the page contacts Google, and Google has no way of knowing you are reading this site.
If you choose to load a map:
For visitors in the EEA, the United Kingdom and Switzerland the recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Elsewhere it is Google LLC, United States. Google acts as an independent controller of that information, not on our behalf, and we have no contract with it covering your data. What it does with the information is set out at policies.google.com/privacy.
Choosing to load a map is your consent to that transfer and to whatever Google then stores on your device. The button says so, in the language of the page you are reading. The map is an optional convenience: every page is complete and readable without it, and the coordinates are printed on the page, so nothing useful is hidden behind the choice. If you would rather not use it, decline. There is nothing else to decline, and we will not nag.
To withdraw that consent, see section 11.
This site is published in English, Russian, Chinese, German, Japanese and French. The button that loads a map is written in the language of the page you are reading. This notice is currently published in English only; the English text is the original, and if a translation and the English ever differ in meaning, the English governs.
Almost everything we hold comes directly from you. Occasionally it does not, and Article 14 GDPR requires us to explain that case too.
We use this for the same purposes and on the same bases as section 4, and keep it for the same periods. If someone gives us your details and we then contact you, we will tell you where we got them when we first write, and in any event within one month.
We do not sell information, we do not share it for anyone else's marketing, and we have no advertising partners. The complete list of who else may see it is this.
| Recipient | Role and place | Why |
|---|---|---|
| Netlify, Inc. | Our processor. United States | Hosts the site, and receives, stores and forwards form submissions |
| Automattic Inc. (Akismet) | Sub-processor engaged by Netlify. United States | Every submission is checked for spam. Your IP address, user-agent, name, email address and the text you wrote are sent for that check and held for between two weeks and ninety days |
| Our email and business-systems provider | Our processor | Enquiries are emailed to us and answered from there |
| The Thai companies that own the properties | Controllers. Thailand | Your enquiry is about their land |
| Our lawyers, accountants and other professional advisers | Controllers in their own right, bound by professional confidentiality | Advice on a transaction or a legal claim |
| Courts, regulators and public authorities | As applicable | Only where we are legally required, or need to establish or defend a legal claim |
| Google Ireland Limited / Google LLC | Independent controller. Ireland / United States | Only if you load a map (section 5). Nothing you type into the form ever goes to Google |
To the United States. Form submissions are handled for us by Netlify, Inc. and checked for spam by Automattic Inc., both in the United States. Those transfers rely on the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework and, for UK enquirers, on the UK Extension to it, under which each company self-certifies. Certification can be checked at dataprivacyframework.gov.
To Thailand. We are established in Thailand, which has no EU or UK adequacy decision. When you send us an enquiry you deal with us directly, so this is not a transfer by someone else to a third country: it is you giving information to a controller outside Europe, to whom the GDPR and UK GDPR nonetheless apply under Article 3(2) because we offer services to people in your country. You can complain to your own supervisory authority in the ordinary way.
To Google. If you load a map, your browser contacts Google directly. We are not the party transferring anything; the contact is between you and Google, on terms Google sets.
Personal information collected through the form is sent to the United States, where it is processed by Netlify, Inc. and Automattic Inc. The Personal Data Protection Committee has not issued an adequacy determination for the United States, so the transfer is made under standard contractual clauses forming part of our agreement with our provider, a suitable protection measure under section 29 of the PDPA. The Data Privacy Framework certification mentioned above is a European mechanism with no standing in Thai law; we mention it because it is the basis for the European leg, not the Thai one.
You have the right to access the information we hold about you and receive a copy (Article 15); have inaccurate information corrected (Article 16); have information erased (Article 17); have our use of it restricted (Article 18); receive what you gave us in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible (Article 20); object to processing based on our legitimate interests (Article 21); and withdraw consent where we rely on it (Article 7(3)). We respond within one month, extendable by up to two further months for complex requests, and we will tell you why within the first month. Responses are free.
You have the right to withdraw consent (section 19 paragraph 5); access your data, obtain a copy, or ask where we obtained it (section 30); receive it in a machine-readable format and have it transmitted to another controller (section 31); object to our collection, use or disclosure (section 32); have it erased, destroyed or anonymised (section 33); have its use restricted (section 34); have it corrected (section 36); and complain to the Personal Data Protection Committee (section 73). We respond to an access request within 30 days. Where we refuse a request we tell you why, and we record the refusal and our reasons.
Your right to object. Where we rely on our legitimate interests, which is how we assess enquiries, prioritise replies and keep a record of our dealings with you, you have the right to object to that use at any time on grounds relating to your particular situation. If you object we will stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or that we need the information to establish, exercise or defend a legal claim.
We are required to bring this to your attention explicitly and separately from everything else, which is why it sits on its own.
Use the privacy request form below. It asks for three things only: an email address to reply to, which right you are exercising, and anything you want to add. It does not ask for your company, your role, your budget or your interest in a property, and it is deliberately separate from the enquiry form so that asking us to delete your data never means giving us more of it.
Proving who you are. We normally verify a request by matching it against the email address already in our records and nothing more. Please do not send passports, identity cards or other documents unless we specifically ask, and we will only ask if we have real doubt about who is making the request.
For the map. Use the Map settings link in the footer of any page. That clears your stored choice immediately and maps stop loading until you choose again. If a map is showing, the control beside it turns maps off. Once you have loaded a map, anything Google has stored in your browser can be cleared through your browser's settings or through Google's privacy controls at myaccount.google.com/privacy; we cannot reach it.
For anything else we do on consent. Tell us through the privacy request form, or reply to any message from us saying so.
Withdrawing consent is as easy as giving it, and it does not affect the lawfulness of anything done before you withdrew. The only consequence of withdrawing consent to the map is that the map will not load; the page works exactly as before. Withdrawing consent does not stop us handling your enquiry, because we do not rely on consent for that. To stop that, use the objection or erasure rights in section 10.
This site sets no cookies. Not one, on any page, in any language, including the enquiry form. There is no cookie banner because, apart from the map, there is nothing to consent to.
This is the complete list of everything that may be stored on your device.
| Item | What it does and who sets it | How long | Essential |
|---|---|---|---|
| en89.maps | Local storage set by this site (eightnine.one). Records whether you chose to load maps, so you are not asked again on every page and every visit. It holds a single yes or no value and a timestamp. It contains no identifier and nothing about you, and is used for nothing else. | 180 days, or until you clear it with the Map settings link | Yes. It exists only to carry out your own expressed choice, which is exempt from the consent requirement under Article 5(3) of the ePrivacy Directive and the equivalent UK rule |
| Google Maps cookies and storage | Cookies and storage under google.com, set by Google Ireland Limited (EEA, UK, Switzerland) or Google LLC (elsewhere) when a map loads, for Google's own purposes | As set by Google, see Google's cookie policy | No. Nothing is set unless you load a map |
Nothing else. No analytics cookies, no advertising or remarketing identifiers, no social media pixels, no fingerprinting, no consent management platform, no chat widget, and no fonts or scripts loaded from anyone else's servers.
We would rather hear from you first, through the privacy request form, and we take any complaint seriously. You do not have to come to us before going to a regulator, and doing so does not affect any other remedy.
You may also bring a claim in the courts.
If what this site does ever changes, this notice changes with it and the date at the top moves. We review it at least once a year. We will not quietly add analytics, advertising or tracking and leave this page saying otherwise. If it ever says something this site does not do, that is a mistake and we would like to be told.
Privacy request
Three fields, nothing more. This goes to a different place from our enquiry form and puts you on no list. Use it to ask for access, correction, deletion, restriction, portability, to object, to withdraw consent, or simply to be told the legal name and registered office of the company behind this site.
We reply within one month under the GDPR and within 30 days under the Thai PDPA, free of charge.