How we handle your personal data.
This notice explains what we collect when you book a week at Claude Camps, why we hold it, who else sees it, and the rights you have over it. It is written to meet Thailand's Personal Data Protection Act B.E. 2562 (2019) — the PDPA — because the camp operates in Thailand and the booking is processed here.
Who is responsible
Claude Camps, Haad Yao, Koh Phangan, Surat Thani, Thailand, is the data controller for everything described below. Questions, requests and complaints go to hello@claudecamps.com or the WhatsApp number on the booking page, and a person answers them.
What we collect, and why
| Data | Why we hold it | Lawful basis |
|---|---|---|
| Your name | To know who is arriving and to put you on the right week | Performance of a contract |
| Email address | Booking confirmation, joining instructions, and changes to your cohort | Performance of a contract |
| Track and tier chosen | To place you in the right group and charge the right amount | Performance of a contract |
| Payment reference from Stripe | To match your payment to your booking and process refunds | Performance of a contract · legal obligation |
| Dietary needs and allergies, if you tell us | So the kitchen can cook for you safely | Explicit consent — this is sensitive data under Section 26 PDPA |
| Server logs and IP address | Security, fraud prevention, keeping the site up | Legitimate interest |
We do not store your card details. Card data is entered on Stripe's own checkout page and never reaches our servers or our database.
Who else sees it
Only the processors that make the booking work, and only the fields they need:
- Stripe — payment processing
- Supabase — the database holding your booking
- Vercel — hosting and server logs
We do not sell your data, we do not share it with advertisers, and we do not add you to a marketing list you did not ask for.
Data leaving Thailand
Stripe, Supabase and Vercel operate servers outside Thailand, so your data is transferred abroad. Under Sections 28–29 PDPA we rely on those providers' standard contractual protections and their own compliance frameworks. If you would rather your data not leave the country, we cannot take an online booking from you — tell us and we will arrange it another way.
How long we keep it
Booking records are kept for five years after your cohort finishes, because Thai accounting and tax law requires it. Dietary and allergy information is deleted once your week has ended. Server logs are kept for ninety days.
Your rights under the PDPA
You can ask us, at any time and without giving a reason, to:
- tell you what we hold about you, and give you a copy (Sections 30, 31)
- correct anything that is wrong or out of date (Section 35)
- delete your data, where we are not required to keep it (Section 33)
- pause our use of it while a dispute is sorted out (Section 34)
- send your data to you or someone else in a portable form (Section 31)
- object to a particular use (Section 32)
- withdraw consent you previously gave — for allergy data, for example (Section 19)
Email hello@claudecamps.com. We reply within thirty days, which is the limit the PDPA sets.
If you are not satisfied
Tell us first and we will try to fix it. If that does not work, you have the right to complain to Thailand's Personal Data Protection Committee (PDPC), the regulator that enforces the PDPA.
Security
Bookings sit behind row-level security in the database, which means the public key used by this website cannot read them at all. Payment confirmation happens only through Stripe's signed webhook. The site is served over HTTPS. No system is perfect, and if we ever suffer a breach affecting your rights we will notify the PDPC within 72 hours as Section 37 requires, and tell you directly where the risk to you is high.
Last updated 1 August 2026.