We take the protection of your personal data seriously — whether you visit us in
person or connect with us online.
Effective from: 31 July 2026 · Last updated: 31 July 2026
Divana Wellness Co., Ltd. and Divana Global Co., Ltd., together with affiliated companies operating under the “Divana” brand (collectively, the “Company”, “we”, or “Divana Wellness”), place great importance on protecting the personal data of our customers, guests, members, website and application visitors, and any other individuals connected with our business (collectively, “you”).
This Privacy Policy explains how we collect, use, and disclose your personal data, whether through our website, application, other online channels, or when you visit us in person at one of our spa locations, in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and other applicable laws.
Please read this Policy carefully so that you understand the purposes for which we collect, use, or disclose your personal data, as well as your rights as a data subject.
We collect your personal data through both online channels (website, application, online booking systems, social media) and in-store/spa channels, as set out below.
| Category | Details | Channel |
|---|---|---|
| Identification data | Full name, date of birth, gender, ID card/passport number (where necessary) | Website, app, spa/store |
| Contact data | Phone number, email address, delivery/billing address | Website, app, spa/store |
| Transaction data | Booking history, service usage, purchases of products/packages, payment data (excluding full card numbers) | Website, app, spa/store, payment service providers |
| Technical data | IP address, cookie ID, device/browser type, website usage behaviour | Website, app (via cookies and similar technologies) |
| Image data | Still images/video footage from CCTV at our premises | Spa/store premises |
| Preference data | Service/product interests, participation in promotions, membership data | Website, app, spa/store |
The Company does not, as a matter of policy, collect health records, medical history, or other sensitive personal data under Section 26 of the PDPA for the purpose of ordinary service delivery, unless you voluntarily provide such information to us. In any such case, we will obtain your explicit consent before collecting it.
| Purpose | Legal basis |
|---|---|
| Booking, confirming, or cancelling services, and delivering the services you request | Performance of a contract |
| Payment processing and issuing receipts/tax invoices | Performance of a contract and legal obligation |
| Managing membership, loyalty points, and benefits | Performance of a contract / consent |
| Marketing, public relations, and sending news or promotions | Consent |
| Maintaining security at our premises via CCTV | Legitimate interest |
| Analysing and improving our website/application (cookies) | Consent / legitimate interest |
| Complying with laws, court orders, or government authorities | Legal obligation |
| Preventing, investigating, and handling disputes or fraud | Legitimate interest / legal obligation |
We may disclose or transfer your personal data to the following categories of recipients, only to the extent necessary and for the purposes set out in this Policy.
We require any third party that receives personal data from us to maintain appropriate data security measures and to process the data only within the scope we have authorised.
Where the Company needs to send or transfer your personal data to a service provider or entity located outside Thailand (for example, an international cloud service provider), we will ensure that the destination country has an adequate standard of data protection as required under the PDPA, or that appropriate safeguards are in place, such as entering into a Data Processing Agreement with the data recipient.
We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, having regard to the following criteria.
Once the retention period has expired, we will delete, destroy, or anonymise your personal data in accordance with appropriate security standards.
We have implemented appropriate technical and organisational security measures to prevent the loss, unauthorised or unlawful access to, destruction, use, alteration, or disclosure of personal data. These measures include, but are not limited to:
Under the PDPA, you have the following rights as a data subject, subject to applicable legal limitations.
You may exercise these rights by contacting us through the channels listed under “Contact Us” below. We will review and respond to your request within the timeframe required by law.
Our website and application use cookies and similar technologies to remember your preferences, improve your experience, analyse usage behaviour, and present content or advertising relevant to your interests. We use the following categories of cookies:
You can manage or decline cookies through your browser settings, or through the cookie consent banner on our website.
To protect the safety of our customers, staff, and visitors, we have installed CCTV cameras in common areas of our premises, such as entrances/exits, reception counters, and other public areas within our branches.
Our services are intended for individuals who have reached the age of majority. We do not intend to collect personal data of minors without the consent of a parent or legal guardian, as required by law. If we become aware that we have collected a minor’s personal data without valid consent, we will delete such data as soon as possible.
If you have any questions, feedback, or wish to exercise your rights as set out in this Policy, you may contact us through the following channels.
We may update or amend this Privacy Policy from time to time to reflect changes in our business practices or applicable laws. We will notify you of any material changes through appropriate channels, such as our website or application. We encourage you to review this Policy periodically to stay informed.
