Privacy Policy

This Policy applies to personal data processed through our corporate website (siamon.cloud), our client platforms, sales and support interactions, newsletter subscriptions, and any other service that links to this Policy. By using our website or services, you acknowledge the practices described here. If you do not agree with this Policy, please do not use our website or services.

Where we process personal data as a data processor on behalf of an enterprise client (for example, booking or passenger data processed through a client’s travel platform), the terms of our service agreement and Data Processing Agreement with that client govern, and this Policy applies primarily to our own website visitors, prospects, and business contacts.

We may collect the following categories of information:

• Contact and identity data — name, job title, company, email address, phone number, and country, submitted through contact forms, demo requests, or the newsletter signup.
• Business and account data — information provided when you engage us as a client or partner, including company details, billing contacts, and communications related to onboarding and support.
• Technical and usage data — IP address, browser type and version, device information, referring pages, pages visited, and timestamps, collected automatically via cookies and similar technologies.
• Communications — records of correspondence when you contact us by email, phone, or Line Official Account.

We use personal data to:

• Respond to inquiries, demo requests, and support tickets.
• Provide, maintain, and improve our website and platforms.
• Send product updates, travel technology insights, and marketing communications you have opted into (with an unsubscribe option in every email).
• Manage contracts, billing, and the business relationship with clients and partners.
• Detect, prevent, and investigate security incidents, fraud, or misuse.
• Comply with applicable legal, regulatory, and contractual obligations.

As a Thailand-based company, we process personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). Depending on the context, our legal basis includes: your consent, the necessity to perform a contract with you or your organization, our legitimate interests in operating and improving our business (balanced against your rights), and compliance with legal obligations. Where we process personal data of individuals in the European Economic Area or United Kingdom, we rely on equivalent bases recognized under the GDPR.

We use cookies and similar technologies to operate our website, remember preferences, understand how visitors use our site, and support marketing analytics. You can control cookies through your browser settings; disabling certain cookies may affect site functionality. Where required by law, we will request your consent before setting non-essential cookies.

We do not sell personal data. We may share information with:

• Service providers — hosting, cloud infrastructure (including AWS and Azure), email delivery, analytics, and CRM vendors who process data on our behalf under appropriate confidentiality and data protection terms.
• Business partners — where necessary to deliver integrated travel technology solutions (for example, GDS or technology partners), and only to the extent required for that purpose.
• Legal and compliance — regulators, law enforcement, or courts where disclosure is required to comply with the law, enforce our agreements, or protect our rights, safety, or property.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality safeguards.

As we support enterprise clients across multiple countries, personal data may be transferred to and processed in countries other than your own, including countries that may have different data protection laws than your jurisdiction. Where such transfers occur, we take reasonable steps to ensure appropriate safeguards are in place, consistent with PDPA requirements and, where applicable, standard contractual clauses recognized under GDPR.

We maintain administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including access controls, encryption in transit, and cloud infrastructure hardening. No system is completely secure, and we cannot guarantee absolute security of information transmitted to us.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including satisfying legal, accounting, or reporting requirements. Retention periods vary depending on the type of data and the nature of our relationship with you; where a specific period applies under a client agreement, that agreement governs.

Subject to applicable law, including the PDPA and, where relevant, the GDPR, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion or anonymization of your data.
• Object to or restrict certain processing activities.
• Withdraw consent at any time, where processing is based on consent.
• Request data portability, where technically feasible.
• Lodge a complaint with the Office of the Personal Data Protection Committee (Thailand) or your local data protection authority.

To exercise any of these rights, contact us using the details in Section 14. We will respond within the timeframe required by applicable law.

Our website and services are directed at business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

Our website may contain links to third-party websites or services, including technology partners referenced on this site. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies before providing any personal data.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated version on this page with a revised “Last updated” date. Material changes will be communicated through reasonable means, such as a notice on our website or by email where appropriate.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: