Privacy Policy

Last updated: 8 October 2026

1. Who is responsible

The data controller for this website and for bookings at LUNA LIFE Spa is:

CHRISTOPHER JEN GROUP CO., LTD. (บริษัท คริสโตเฟอร์ เจน กรุ๊ป จำกัด)
86/82 Moo 2, Wiset Road, Rawai, Mueang Phuket, Phuket 83130, Thailand
Tax ID: 0835567009502
E-mail: Show e-mail address
Phone: +66 61 529 8898

This policy follows the Thai Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). Where the EU General Data Protection Regulation ("GDPR") applies to you, for example because you are in the European Union when you use our services, we also respect the rights it gives you.

2. What data we collect

• Booking and contact data: your name, phone number, e-mail address, LINE or WhatsApp name, the treatment, date, time and number of guests, and any message you send us.
• Information you choose to tell us for your treatment: for example pregnancy, allergies or health conditions that are relevant for sauna, onsen, ice bath or massage. This can be sensitive data under the PDPA; we only use it with your explicit consent and only to keep your treatment safe.
• Payment data: the amount, date and method of payment. We do not store full card numbers; card payments are processed by the payment provider.
• Website data: when you visit this website, our hosting provider processes technical data (such as IP address, browser type, pages visited and time) to deliver the website securely. We use a privacy-friendly analytics service that does not set cookies and does not identify you personally.

3. Why we use your data, and on what basis

• To take, confirm, change and carry out your booking, and to contact you about it (performance of a contract).
• To keep your treatment safe when you tell us about relevant health information (your explicit consent).
• To keep accounting and tax records required by Thai law (legal obligation).
• To run, secure and improve our website (our legitimate interest).
• To send you news or offers, only if you have asked for them (consent, which you can withdraw at any time).

4. Who receives your data

We share personal data only where necessary, with service providers that process it on our behalf or as independent providers of their own service:

• Booking system: At the moment we take bookings via LINE, phone and WhatsApp. When we introduce an online booking system, its provider will be named here.
• Messaging: LINE and WhatsApp, if you contact us there. Their own privacy policies apply.
• Website hosting and analytics: Cloudflare, Inc.
• Maps: Google, only if you click "Show map" or "Get directions".
• Accounting and legal advisers, and authorities where the law requires it.

Some of these providers process data outside Thailand (for example in the United States, Japan or the European Union). Where this happens, we rely on the safeguards permitted by the PDPA and, where applicable, the GDPR.

5. How long we keep your data

• Booking and contact data: up to 2 years after your last visit, unless you ask us to delete it earlier.
• Health-related information you gave for a treatment: deleted when it is no longer needed for your treatments, and at the latest 2 years after your last visit.
• Accounting records: as long as Thai tax and accounting law requires (generally 5 years).

6. Your rights

You have the right to access your data and receive a copy, to correct it, to have it deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw your consent at any time (this does not affect processing before the withdrawal). To use these rights, write to us at the e-mail address above. We reply within 30 days.

You can also complain to the Thai Personal Data Protection Committee (PDPC). If the GDPR applies, you can complain to the data protection authority in your EU country of residence.

7. Security

We protect your data with reasonable technical and organisational measures, and we only give our team access to the data they need for their work.

8. Children

Our services are intended for adults. Guests under 18 need the consent of a parent or guardian.

9. Changes

We may update this policy. The current version is always published on this page.