Privacy Policy

SECTION 1 — INTRODUCTION AND SCOPE

Zmootz Vive Co., Ltd. (“Company” or “Zmootz”) places importance on protecting the personal data of users, members, customers, service users under bookings, service providers, business partners, contacts, and other persons involved in the use of the Zmootz platform. This Privacy Policy (“Policy”) is issued to inform you of how we collect, use, disclose, transfer, retain and protect your personal data, and of your rights as a data subject, in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and related law.

SECTION 2 — DATA CONTROLLER

Company name: Zmootz Vive Co., Ltd.

Company registration number: 0115564005545

Address: 343/4-5 Khlong Lam Chiak Road, Nuan Chan Subdistrict, Bueng Kum District, Bangkok 10230, Thailand

Website: www.zmootz.com

Contact email for personal data matters: support@zmootz.com

In general, Zmootz acts as the data controller for personal data that Zmootz collects, uses or discloses for the purposes of operating the Platform, administering user accounts, bookings, payment, coordination, marketing, system analytics, fraud prevention, and legal compliance. In certain cases, a Service Provider (such as a hospital, clinic, or wellness centre) may be an independent data controller for data it collects for the purpose of the actual provision of its service.

SECTION 3 — DEFINITIONS

“Personal Data” means information relating to a natural person which enables the identification of that person, whether directly or indirectly, but excludes information relating to a deceased person specifically.

“Sensitive Personal Data” means personal data under Section 26 of the PDPA, which includes health data, medical history, biometric data, and other categories specified by law.

“Health Data” means information relating to physical or mental health, symptoms, underlying conditions, medical history, test results, and health-related limitations.

SECTION 4 — PERSONAL DATA ZMOOTZ MAY COLLECT

4.1 Data you provide to Zmootz directly: identity data (name, date of birth), contact data (address, telephone number, email), account data, booking data, payment data (we do not store full card numbers), communication data, and membership data.

4.2 Health data and other sensitive personal data you may provide in connection with a booking (such as symptoms, underlying conditions, or medical certificates). This category is treated as Sensitive Personal Data and is addressed separately in Section 5 below.

4.3 Data collected automatically by the system: IP address, browser type, website usage behaviour, cookies and similar tracking technologies, approximate location data, and data from connected external systems (such as LINE Login). Details on cookies are set out in Section 11 below and in our separate Cookie Policy.

4.4 Data from third parties: payment service providers, analytics and marketing service providers (such as Google Analytics), and service providers you choose to book with.

SECTION 5 — HEALTH DATA AND SENSITIVE PERSONAL DATA

5.1 What we mean by this category: Sensitive Personal Data under Section 26 of the PDPA includes health data, medical history, disability data, and other categories the law specifies as sensitive. In the context of the Platform, this most commonly consists of symptoms or health conditions, underlying conditions, allergies, or medical certificates that you or a Service Provider submit in connection with a spa, clinic, or wellness booking.

5.2 Lawful basis for processing: Zmootz will collect, use, or disclose Health Data and other Sensitive Personal Data only where (a) you have given explicit consent, or (b) another exemption under Section 26 of the PDPA applies, such as processing necessary for preventing or suppressing a danger to life, body, or health where you are unable to give consent, or processing necessary for medical treatment purposes carried out by a Service Provider bound by professional confidentiality obligations.

5.3 Minimisation and access restriction: Zmootz collects only the Health Data reasonably necessary to facilitate your booking with the relevant Service Provider. Access to Health Data within Zmootz is restricted to authorised personnel on a need-to-know basis, and such data is not used for general marketing or profiling purposes.

5.4 Sharing with Service Providers: Health Data you submit as part of a booking will be shared with the specific Service Provider you have chosen, to the extent necessary for that provider to assess suitability and safely deliver the service. Once shared, the Service Provider generally acts as an independent data controller for that data, as described in Section 2.

5.5 Right to refuse: You are not obliged to provide Health Data. However, where a Service Provider reasonably requires certain health information to safely provide a service (for example, to screen for contraindications), declining to provide it may mean that Zmootz or the Service Provider cannot proceed with that particular booking.

SECTION 6 — LAWFUL BASIS FOR PROCESSING PERSONAL DATA

Zmootz will process personal data on the appropriate lawful basis, including: (1) performance of a contract; (2) consent; (3) legitimate interest; (4) compliance with law; and (5) prevention or suppression of a danger to life, body or health. Where Sensitive Personal Data is involved, the specific bases described in Section 5.2 apply.

SECTION 7 — PURPOSES OF COLLECTION, USE AND DISCLOSURE OF DATA

7.1 Provision of the Platform: creating user accounts, receiving and confirming bookings, coordinating with service providers, and providing booking status notifications.

7.2 Payment and transaction management: verifying transaction status, preparing payment confirmation documents, and processing refunds.

7.3 Customer service: responding to enquiries and handling complaints.

7.4 Membership programme: administering membership tiers and accumulated points.

7.5 Marketing and behavioural analytics: this purpose is addressed separately in Section 17 (Direct Marketing) below.

7.6 Security and legal compliance: preventing fraud and deception, and complying with applicable law.

SECTION 8 — AI ASSISTANT AND AUTOMATED ITINERARY PLANNING

Zmootz provides an AI-powered chat assistant that helps you describe your wellness needs in natural language, discover suitable wellness destinations and activities, and receive a proposed multi-stop travel itinerary and schedule. To do this, the AI Assistant processes the information you type or speak during the conversation (such as your stated preferences, budget, travel dates, location, and wellness goals), together with your account, booking and usage data described in Section 4, in order to generate recommendations and a draft itinerary for you.

Where you voluntarily disclose health-related information to the AI Assistant (for example, a health condition or physical limitation you mention so that the itinerary can be tailored to you), that information is treated as Sensitive Personal Data under Section 5 of this Policy, and Zmootz will process it only on the basis of your explicit consent given through your interaction with the AI Assistant, or another lawful basis available under the PDPA.

The AI Assistant's outputs (such as a suggested destination, activity, or itinerary) are recommendations only. Zmootz uses reasonable technical and organisational measures to keep your conversation data secure and does not use your conversation data to train publicly released third-party AI models without your consent. You may choose not to use the AI Assistant and to browse or book through the standard marketplace features instead; declining to use the AI Assistant does not affect your ability to use the rest of the Platform.

SECTION 9 — DISCLOSURE OF PERSONAL DATA

Zmootz may disclose your personal data to the service provider you choose to book with, payment service providers, IT and cloud service providers, data analytics providers, legal/accounting advisers, and government authorities with lawful power. Zmootz will not sell your personal data to third parties.

SECTION 10 — INTERNATIONAL DATA TRANSFERS

Zmootz may send or transfer personal data abroad, for example to cloud hosting, analytics, or payment service providers located outside Thailand. Such transfers will only be made on a recognised route under Sections 28 and 29 of the PDPA and the PDPC's notifications on cross-border transfer, namely: (1) transfer to a destination country or international organisation with an adequate standard of personal data protection, as recognised by the Personal Data Protection Committee; (2) transfer subject to appropriate safeguards that enable enforceable data subject rights and effective remedies, such as binding contractual clauses (including Standard Contractual Clauses based on the ASEAN Model Contractual Clauses) or intra-group binding corporate rules; or (3) another exemption under Section 28 of the PDPA, such as where the transfer is necessary for the performance of a contract with you, including making a booking on your behalf with an overseas Service Provider.

SECTION 11 — COOKIES AND TRACKING TECHNOLOGIES

Zmootz uses cookies and similar tracking technologies (such as pixel tags, local storage, and device identifiers) on the Platform to enable core functions, remember your preferences, analyse usage, and, where you have given consent, support marketing and retargeting. The full details of the types of cookies used, retention periods, and how you can manage or withdraw your consent to non-essential cookies are set out in our separate Cookie Policy, which forms part of, and should be read together with, this Privacy Policy.

SECTION 12 — DATA RETENTION PERIOD

Zmootz will retain user account data for as long as the account remains active. Booking and transaction data will be retained for the period required under tax and accounting law. Health data will be subject to restricted access and retained only as necessary for the purposes described in Section 5. Upon expiry of the retention period, Zmootz will delete, destroy, or render the data unable to identify the individual.

SECTION 13 — SECURITY MEASURES

Zmootz maintains appropriate technical and organisational security measures, such as restricting access rights to data on a need-to-know basis, using passwords or encryption, maintaining audit logs, and regularly reviewing and testing security measures, in accordance with the standards prescribed under the PDPA.

SECTION 14 — PERSONAL DATA BREACH

In the event that Zmootz becomes aware of a personal data breach, Zmootz will assess the risk to the rights and freedoms of affected individuals. Where the breach is likely to result in a risk to such rights and freedoms, Zmootz will notify the Office of the Personal Data Protection Committee without undue delay, and where feasible, within 72 hours of becoming aware of the breach, as required under the PDPA. Where the breach is likely to result in a high risk to affected individuals, Zmootz will also notify the affected individuals, together with the remedial measures taken, without undue delay.

SECTION 15 — RIGHTS OF THE DATA SUBJECT

Subject to the conditions and exceptions under the PDPA, you have the right to: (1) request access to and obtain a copy of your personal data; (2) request correction of inaccurate or incomplete data; (3) request deletion, destruction, or anonymisation of your data; (4) request restriction of use of your data; (5) request data portability; (6) object to the processing of your data; and (7) withdraw consent, as described in Section 16. You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee if you believe Zmootz has failed to comply with the PDPA. You may exercise these rights through the channels set out in Section 20 (Contact and Complaints).

SECTION 16 — WITHDRAWAL OF CONSENT

Where Zmootz relies on your consent as the lawful basis for processing (including for Health Data under Section 5, and for marketing under Section 17), you have the right to withdraw that consent at any time, in the same manner in which it was given, unless doing so is restricted by law or a contract that benefits you. You may withdraw consent through the contact channels set out in Section 20, or, for cookie-related consent, through the consent management tool referred to in our Cookie Policy.

Withdrawal of consent does not affect the lawfulness of any processing carried out based on your consent before its withdrawal. Depending on the purpose, withdrawing consent may mean that Zmootz or a Service Provider is unable to continue providing certain features of the Platform or certain services to you, and Zmootz will inform you of any such consequences at the time of withdrawal where relevant.

SECTION 17 — DIRECT MARKETING

Zmootz may send you news, promotions, product or service recommendations, and other marketing communications by email, SMS, LINE, push notification, or other channels, and may carry out remarketing or retargeting based on your usage behaviour. Where required by law, Zmootz will only send such marketing communications, or use your data for retargeting, after obtaining your consent.

This is separate from transactional or service communications (such as booking confirmations, payment receipts, or service-related notices), which Zmootz will continue to send as necessary to operate your account and bookings, regardless of your marketing preferences.

You may opt out of, or unsubscribe from, marketing communications at any time by using the unsubscribe link included in marketing emails, adjusting your notification settings within the Platform, or contacting Zmootz through the channels set out in Section 20. Opting out of marketing does not affect your receipt of transactional communications related to your account or bookings.

SECTION 18 — MINORS

The Platform is intended for use by persons who are at least twenty (20) years of age and have full legal capacity to enter into a contract under Thai law. Where a user is a minor and the PDPA requires the consent of a parent or legal guardian for the collection, use, or disclosure of that minor's personal data (including where consent is the relevant lawful basis), Zmootz will obtain such consent from the parent or legal guardian before processing the minor's personal data, or will rely on another lawful basis available under the PDPA. If Zmootz becomes aware that it has collected personal data from a minor without the required consent, Zmootz will take reasonable steps to delete such data or to obtain the necessary consent, as appropriate. A parent or legal guardian who believes their child has provided personal data to Zmootz without appropriate consent may contact Zmootz through the channels set out in Section 20.

SECTION 19 — THIRD-PARTY LINKS AND PLATFORMS

The Platform may contain links to, or integrate with, third-party websites, applications, or services that are not operated by Zmootz, such as LINE Login and other social or single sign-on services, payment gateways and card-processing providers, and third-party review or rating platforms. This Privacy Policy does not apply to the personal data practices of such third parties, and Zmootz is not responsible for their content or privacy practices. Zmootz encourages you to review the privacy policy of any third-party service before providing your personal data to it or connecting your account with it.

SECTION 20 — CONTACT AND COMPLAINTS

If you have any questions, requests, or complaints regarding this Privacy Policy, or wish to exercise any of your rights described in Section 15, you may contact Zmootz as follows:

Zmootz Vive Co., Ltd.

343/4-5 Khlong Lam Chiak Road, Nuan Chan Subdistrict, Bueng Kum District, Bangkok 10230, Thailand

Email: support@zmootz.com | Website: www.zmootz.com | LINE Official Account: @zmootz

If you are not satisfied with Zmootz's handling of your request or complaint, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC), Ministry of Digital Economy and Society, Thailand.