Privacy Policy

Last updated 10 August 2026

1. What This Policy Covers

 KOH KERD: The Living Legacy of Thai Craftsmanship(“the Project”) operates a free shuttle service for visitors between the Grand Palace in Bangkok and The Arts of the Kingdom Museum in Ayutthaya.

 This policy applies to the Project’s seat reservation website at https://artofthekingdomfreebus.com. It explains what personal data the system collects, what it is used for, how long it is kept, who can access it, and what rights you have under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA).

 The data controller is the Tourism Authority of Thailand (TAT), which determines the purposes and means of the processing described here.

2. Data We Collect

2.1 Data you enter in the form

 For every passenger on a booking, we ask for:

• First and last name — to produce the passenger manifest and verify boarding
• Email address — to send your booking details and ticket, and to prevent duplicate bookings on the same departure
• Phone number — to contact you if a departure changes
• Date of birth — to verify passenger identity and complete the manifest for each departure
• Nationality — to compile aggregate counts of how many travellers of each nationality joined each departure and the project as a whole, for the project’s summary report and to improve the website and future projects. These figures are totals only and do not identify individual passengers
• Special assistance needs (optional) — to prepare assistance at the vehicle; see section 4
• Emergency contact name, phone number and relationship (relationship optional) — used only to make contact in an emergency during the journey

2.2 Data the system generates from your booking

• Your booking reference, and the reference embedded in the QR code on your ticket
• The departure selected, seat number, booking status, confirmation time, booking channel (website or on-site registration by staff), and the language you booked in
• A ticket image file, which shows passenger names and seat numbers
• On boarding: the check-in time and the email address of the staff member who checked the ticket, along with a record of every scan, successful or not

2.3 Technical data

• The bus_session cookie, a random identifier for your browser. There is no passenger account or login, so this cookie is the only thing that identifies which held seats and pending booking are yours.
• Your IP address, which is passed to Cloudflare Turnstile to help screen out automated bookings
• Your IP address is also passed to jsDelivr, a content delivery network, when your browser loads the country flag images in the nationality field. Those images are decorative only; no booking or passenger data is sent with the request
• Server logs, which may contain passenger names on check-in entries, booking references, and staff email addresses
• Google Analytics usage statistics, only if you accept analytics cookies

 Every cookie, with its lifetime and purpose, is listed in our Cookie Policy.

2.4 Data that stays on your device

 While you fill in the form, a draft is kept in your browser’s Local Storage so your input is not lost if the page closes unexpectedly. That draft stays on your device and is not sent to us until you submit, and you can remove it by clearing this site’s data in your browser. If you book from a shared device, we recommend clearing site data afterwards.

2.5 If you choose not to provide your data

• Name, email address, phone number, date of birth and emergency contact details are required to reserve a seat. Without them we cannot allocate a seat or issue a ticket, and the booking cannot be completed.
• Nationalitymust be chosen before the form lets you continue, because we report passenger totals by nationality as part of the project’s summary report. It has no bearing on your right to travel or on how seats are allocated.
• Special assistance needs and the emergency contact’s relationship are optional. Leaving them blank does not affect your travel in any way — we simply will not know in advance what assistance to prepare for you.
• Analytics cookies may be declined and the booking system will still work in full. Blocking the strictly necessary cookies, however, makes reservation impossible, because the system would not know whose held seats are whose.

3. When You Enter Data on Behalf of Others

 A single booking may include up to 10 passengers, each with an emergency contact, so one booking often contains the personal data of people who are not the person filling in the form.

 Before entering their details, you must have their permission and must have told them that their data will be handled as described in this policy. By giving consent and submitting the form, you confirm that you have done so.

 If you find that your name or phone number was entered by someone else without your knowledge, you may ask us to delete it directly under section 10, without going through the person who entered it.

4. Special Assistance Information

 This field is optional and leaving it blank does not affect your travel. If you do complete it, what you write may constitute health or disability data, which is sensitive personal data under section 26 of the PDPA. We therefore collect it only where you have given separate, explicit consent.

• It is used solely to arrange assistance when boarding and alighting and to allocate a suitable seat. It is not used for any other purpose, and never for decisions affecting your rights.
• It is visible to the onboard staff for your departure and to Project administrators.
• Please give only what is needed to help you — for example “wheelchair user” or “front seat preferred” — without naming conditions, treatments or other medical detail.
• You may withdraw consent for this field alone at any time, and the rest of your booking will remain intact.

5. Minors

 Where a passenger is a minor, a parent or legal guardian must complete the form and give consent on their behalf, in accordance with section 20 of the PDPA. We do not knowingly collect data directly from minors.

 Our staff also check again at the boarding point: passengers who are minors must travel with a parent or guardian. If we find that a minor’s data was provided without valid consent, we will delete it on notification.

6. Purposes and Legal Bases

• Allocating seats, issuing tickets and sending you your booking details — consent, and to carry out the service you requested
• Producing the passenger manifest for onboard staff and verifying boarding — consent, and our legitimate interest in operating the service safely and accountably
• Contacting you if a departure is changed or cancelled — consent
• Contacting your emergency contact where life, body or health is at risk during the journey — vital interests, section 24(2) of the PDPA
• Preventing automated and abusive bookings that block seats — our legitimate interest in the security of the system
• Aggregate passenger totals by nationality, per departure and across the project, for the project’s summary report and to improve the service in future — consent, and the performance of a public-interest task by the data controller
• Aggregate website usage statistics to improve the booking flow — consent, via the cookie banner

 We do not use this data for marketing or advertising, do not send promotional email unrelated to your booked journey, do not profile individuals, and never sell, trade or rent your data to anyone.

7. Who Can Access Your Data

• Onboard staff — see the name, phone number, seat number, special assistance note and check-in status of passengers on their own departure only
• Project administrators — have access to all booking data and can download per-departure passenger lists as a document
• Technical administrators — access only as needed to maintain the system and resolve issues

 Every staff sign-in and every passenger list download is recorded together with the email address of the person who performed it. Beyond this, we do not disclose your data to third parties except where required by law or by a competent authority.

8. Service Providers and International Transfers

 We use the following providers, some of which process data outside Thailand:

• Cloudflare Turnstile — receives your IP address and technical browser signals to screen out automated bookings. It does not receive the passenger details you enter.
• jsDelivr — the content delivery network the site loads country flag images from in the nationality field. It receives your IP address as part of those image requests. It does not receive the passenger details you enter.
• Google Analytics — receives website usage data only if you accept analytics cookies; processed in the United States. It does not receive the passenger details you enter.
• DigitalOcean Spaces — stores the ticket image files, which show passenger names and seat numbers. Servers are located in Singapore.
• Our own error-tracking system— records details of failed requests so we can fix problems. It runs on the Project’s own servers and is not a third-party analytics service.

 Transfers to providers outside Thailand are made under appropriate safeguards in accordance with sections 28 and 29 of the PDPA, and are limited to the data each provider needs.

9. How Long We Keep Your Data

• Passenger details and confirmed bookings — kept until the Project has ended and its final report is complete, and in any case no more than 30 days after the last departure. This period covers reconciliation of passenger numbers, complaints and reporting. All data is then deleted from our systems.
• Bookings left incomplete — expire after 60 minutes and are then deleted along with any passenger details entered. The deletion runs when the next booking is started, so during quiet periods an expired booking may remain a little longer.
• Seats held but not confirmed — released back to general availability within 5 minutes
• Ticket image files — deleted together with the booking data above, both the record in our system and the underlying file in storage
• Server logs — kept for 14 days (error logs 7 days), then deleted automatically
• Cookies — for the lifetimes stated in the Cookie Policy

 When the Project closes, all data is removed from our systems — the database, the ticket image files and the server logs. No copies are retained, and the data is never carried over to any other project or activity.

 Where the law requires a longer retention period, we keep the data only for that period and only for that purpose.

10. Your Rights and How to Exercise Them

 As a data subject you have the right to:

• Access your personal data and obtain a copy of it
• Have inaccurate or outdated data corrected
• Have your data erased, including cancelling your booking
• Restrict the use of your data
• Object to the collection, use or disclosure of your data
• Have your data transferred to another controller in a machine-readable format
• Withdraw consent at any time — either in full, or for the special assistance field alone — without affecting the lawfulness of processing carried out before withdrawal
• Lodge a complaint with the Personal Data Protection Committee

 To exercise any of these rights, contact [email protected] and include your booking reference, or the name and phone number used to book, so that we can verify your identity first. We will respond within 30 days of receiving your request, free of charge.

 Withdrawing consent or requesting erasure before the travel date means we can no longer allocate a seat to you, and will be treated as a cancellation of that booking.

11. How We Protect Your Data

• All traffic is encrypted in transit (HTTPS)
• The booking cookie is httpOnly and cannot be read by scripts on the page, and staff cookies carry a digital signature that prevents tampering
• Access is limited by role: onboard staff see only their own departure, and administrator access is logged
• We do not collect national ID, credit card or any payment data, because the service is free of charge

 In the event of a personal data breach likely to affect your rights and freedoms, we will notify the Personal Data Protection Committee within 72 hours and inform you without undue delay, as required by law.

12. Visitors from the European Economic Area

 If you are in the EEA or the United Kingdom, we process your data on the bases of consent, performance of the service you requested, and legitimate interests as set out in section 6 — corresponding to Articles 6(1)(a), (b) and (f) of the GDPR. Data under section 4 is processed on the basis of explicit consent under Article 9(2)(a). All rights in section 10 apply to you, and you may also lodge a complaint with your local supervisory authority.

13. Changes to This Policy

 We may update this policy when the way we collect or use data changes. The current version, with its update date, will always appear on this page. Where a change is significant, we will ask for your consent again.

14. Contact Us

 Data controller: Tourism Authority of Thailand (TAT)
Website: https://artofthekingdomfreebus.com
Data protection contact: [email protected]