PRIVACY POLICY
KIMI | JJP Enterprise Co., Ltd.
JJP Enterprise Co., Ltd.
JJP Enterprise Co., Ltd. ("KIMI", "we", "us" or "our") is the data controller for personal data processed through [KIMI website URL] and related website reservation, enquiry and customer communication services that we operate. This policy explains our handling of that data under Thailand’s Personal Data Protection Act B.E. 2562 (2019). It does not cover another organisation’s independently operated websites or services.
Collection of the Information
Depending on your interaction, we collect your name, email address, telephone number and messaging contact details; reservation date, time, party size, venue and special requests; enquiry and feedback content; and records of communications and consent choices. Where payments or invoices are offered, we collect the transaction reference, amount, payment status and billing information needed for that service. Any payment provider may collect payment details under its own notice.
When you visit the website, technical records may include your IP address, browser and device information, access times, visited pages and security logs. Cookies and similar technologies are explained in our Cookie Policy. We collect only information relevant to the stated purposes.
Information comes directly from you, automatically through website systems, or from booking platforms and people making a reservation on your behalf. Where another source provides your data, we give any additional notice required by law. Please avoid sending identity documents or other sensitive information unless specifically requested and necessary.
Purposes and legal bases
Reservations and requested services: we use contact and booking details to arrange, confirm, change or cancel reservations, communicate service updates and manage requested payments or refunds. The basis is performance of a contract or steps taken at your request before entering a contract.
Customer enquiries and service protection: we use relevant communications and technical logs to answer general questions, resolve complaints, prevent misuse, secure systems and establish or defend legal claims. We rely on legitimate interests where necessary and proportionate, after considering the impact on your rights. Contract or legal obligation grounds may apply to specific matters.
Legal compliance: we use necessary invoice, transaction and related records to comply with applicable tax, accounting and lawful authority requirements. The basis is compliance with legal obligations.
Optional marketing: with your consent, we use the contact details and preferences you choose to share to send news, events and offers through the channels you select. You may unsubscribe or contact us to withdraw consent at any time. We keep reservation and service messages separate from optional marketing.
Optional analytics, personalisation and advertising: where enabled, we use the information described in our Cookie Policy for the purposes you consent to through Cookie Settings. Essential website operations and security use an appropriate contract or legitimate interests basis; optional tracking is subject to your consent.
Allergies and other sensitive information
Allergy and health information can be sensitive personal data. We ask you to provide only what is necessary for your dietary request and seek explicit consent before processing it, unless a specific legal exception applies. We limit its use to assessing and arranging that request and restrict access to people who need it. We do not use it for marketing. We will explain any additional sensitive-data processing separately.
Required and optional information
We identify required fields when collecting data. Missing information needed for a reservation, requested service or legal obligation may prevent us from completing that service. Optional fields and marketing consent are voluntary. Declining optional consent does not prevent you from making a reservation, although declining dietary information may limit our ability to accommodate the relevant request.
Who receives your information
We disclose relevant information only as needed to authorised staff; reservation and customer communication providers; hosting, IT support and security providers; payment and accounting providers where applicable; professional advisers; and public authorities where disclosure is legally required or otherwise lawful. Optional analytics and advertising providers receive information only as described in our Cookie Policy and your choices.
Providers processing on our behalf are subject to appropriate processing agreements and safeguards. Some providers act as independent controllers for their own services; their notices explain that processing. We do not disclose guest data to a separately controlled venue or event partner for its own marketing without an appropriate legal basis and notice.
International processing
Some service providers may store or process information outside Thailand. Where we transfer personal data internationally, we use a lawful transfer mechanism and protections required by the PDPA and applicable rules, such as recognised adequate protection or legally enforceable appropriate safeguards. Contact us for information about the safeguards relevant to your data. [Confirm actual providers, destinations and mechanisms before publication.]
How long we retain information
We retain data for the purpose for which it was collected and any necessary legal, dispute or security period. Our retention schedule is: reservations and enquiries [period and starting event]; transaction and tax records [applicable statutory period and starting event]; technical security logs [period]; marketing records [period or objective expiry criteria]; allergy and health notes [short period linked to the relevant reservation]; and consent and rights-request records [period and justification]. Cookie lifetimes appear in the Cookie Policy.
Where a legal hold or unresolved claim requires longer retention, we limit access and use to that need. When retention is no longer justified, we delete the data or anonymise it irreversibly, including through our scheduled backup lifecycle.
Security
We maintain appropriate organisational and technical measures to protect personal data, including access controls and safeguards appropriate to the risks. No internet service is completely secure. Where a personal data breach occurs, we assess it and notify the competent authority and affected individuals when required by law.
Your rights and choices
Subject to the conditions and exceptions under Thai law, you may request access and a copy of your data and information about its source where collected without consent; correction; erasure or anonymisation; restriction of use; and portability where applicable. You may object to processing in circumstances provided by law, including direct marketing, and withdraw consent without affecting lawful processing carried out before withdrawal. You may complain to the Office of the Personal Data Protection Committee or the competent expert committee.
Send requests to [privacy email] or the postal address below. We may ask for proportionate information to verify your identity or authority. We respond within applicable legal time limits and explain any lawful refusal or restriction. Withdrawing consent may affect only a service that needs the relevant consent-based processing; we explain any such effect.
Minors and third party services
Where we rely on consent for a minor, we obtain consent from the holder of parental responsibility when required under Thai law. If you believe a child’s information has been provided without the necessary authority, contact us. External booking services, maps, payment pages and social platforms may apply their own policies. We remain responsible for our own processing and integrations.
Updates and contact
We may update this policy to reflect changes in services or legal requirements and show the effective date above. Where required, we provide further notice or obtain fresh consent before new consent-based processing.
JJP Enterprise Co., Ltd.
Address: 16 Soi Charoenmitr, Sukhumvit 63 Road, Phra Kanong Nuea sub-district, Watthana district, Bangkok Thailand
Privacy email: jjp.jjpenterprise@jjpen.com
Personal Data Protection Notice
KIMI | JJP Enterprise Co., Ltd.
How we handle your personal data
JJP Enterprise Co., Ltd. operates this KIMI website and is the controller of the personal data we collect through it. Depending on your interaction with us, we use your name, contact details, reservation or enquiry details and related communications to respond to you and arrange the services you request. We process necessary information to take steps at your request or perform our contract with you, meet legal duties, and pursue legitimate interests such as handling enquiries and protecting our services, subject to your rights.
Where we collect information through a form, required fields are identified. If you do not provide information necessary for your request, we may be unable to confirm a reservation or respond to your enquiry. Optional marketing is based on separate consent. If we request allergy or health information, we seek explicit consent unless another lawful exception applies. Please read our Privacy Policy for recipients, retention, international transfers, your rights and contact details.
Marketing communications
With your consent, we may use your contact details to send KIMI news, events and offers through the offered channels. Marketing consent is voluntary and separate from a reservation. You may withdraw it at any time using the unsubscribe option or contacting us via email provided in this website. Declining or withdrawing marketing consent does not affect your reservation or access to services.
Allergy and health information
If you provide allergy or health information, we seek your explicit consent to collect and use it to assess and arrange your dietary requirements for the relevant reservation, unless another lawful exception applies. Relevant reservation, service and kitchen staff and necessary service providers described in the Privacy Policy may receive this information only as needed for that purpose. You may withdraw consent by contacting via email provided in this website. Without this information or if consent is withdrawn, KIMI may be unable to assess or accommodate the relevant dietary requirement. We do not use this information for marketing.
Providing information for another guest
If you give us another guest’s details, please ensure you are authorised to share them and make this Privacy Policy available to that guest. Do not submit another guest’s allergy or health information unless we have arranged a valid way to obtain that guest’s explicit consent or another lawful basis applies.