Privacy Policy
GDPR (EU 2016/679), Portuguese Law 58/2019 and Thailand's PDPA (B.E. 2562)
1. Who we are
Buachompoo Thaifood Restaurant is the controller ("data controller" under the PDPA) of the personal data collected through this website and in our restaurants. This policy explains what data we collect, why, who we share it with, how long we keep it and what your rights are.
- Restaurant: R.alves Correia 100, Albufeira, Portugal
- Branch: Rua D. João II - Edifício Vilamar II, 8365-130 Armação de Pêra, Portugal
- Phone: +351 912269210
- E-mail: somporntun1978@gmail.com
2. Data we collect
| Source | Data |
|---|---|
| Booking form (Google Forms) | Name, phone, e-mail (optional), date, time, branch and number of guests. |
| Contact by phone, e-mail, Facebook/Messenger or WhatsApp | The data you send us (name, contact details, message content). |
| Visit statistics | IP address and date of the visit, used only to count daily visits. The IP is deleted the next day; only totals are kept. |
| Cookie consent record | Random consent ID, choices made, date/time, policy version, anonymised IP and browser type. |
| Hosting server logs | IP address, date/time, requested page and browser, logged automatically by the server for security. |
We do not ask for special categories of data (for example, health data) through the website. If you tell us about an allergy when booking or at the restaurant, we use it only to prepare your meal safely.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR / PDPA) |
|---|---|
| Managing and confirming bookings | Performance of a contract — GDPR art. 6(1)(b) / PDPA s.24(3) |
| Answering enquiries and messages | Legitimate interest — art. 6(1)(f) / s.24(5) |
| Statistics, security and running the website | Legitimate interest — art. 6(1)(f) / s.24(5) |
| Functional and marketing cookies | Consent — art. 6(1)(a) and Law 41/2004 / PDPA s.19 |
| Keeping proof of consent | Legal obligation — GDPR art. 7(1) / PDPA s.19 |
| Invoicing and tax obligations | Legal obligation — art. 6(1)(c) / s.24(6) |
We do not sell your data, we do not profile you and we do not make automated decisions about you.
4. Who we share data with
- Google — Google Forms (bookings), Google Maps (map) and Google Fonts (typeface). Google's policy
- Meta (Facebook) — Facebook page, Messenger and Like button. Meta's policy
- Cloudflare (cdnjs) — delivers the website icons; receives your IP when the page loads.
- Our web hosting provider, which stores the website and technical logs.
- Our accountant and public authorities, where the law requires it.
5. International transfers
Google, Meta and Cloudflare may process data outside the European Economic Area (for example, in the USA). These transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission, which also serve as appropriate safeguards for PDPA sections 28–29.
6. How long we keep data
| Data | Period |
|---|---|
| Bookings | Up to 12 months after the booking date |
| Messages and enquiries | Up to 24 months |
| Visit statistics IP | Deleted the next day |
| Cookie consent record | 36 months |
| Tax records | 10 years (Portuguese law) |
7. Your rights
Under the GDPR (arts. 15–22) and the PDPA (sections 30–36) you have the right to:
Withdrawing consent does not affect processing carried out before. We answer requests within 30 days. We may ask you to confirm your identity.
8. Complaints
- Portugal / EU: CNPD — Comissão Nacional de Proteção de Dados, www.cnpd.pt
- Thailand: Office of the Personal Data Protection Committee (PDPC), www.pdpc.or.th
9. Children
This website is not aimed at children under 13. Optional cookies for children under 13 (GDPR/Law 58/2019) or under 20 (PDPA) require permission from a parent or guardian.
10. Security
We use an encrypted connection (HTTPS), restricted access to the admin area and IP anonymisation in consent records. If a data breach happens, we notify the authority within 72 hours and inform affected people where the law requires it.