Privacy Policy

The data administrator is Lao Derm Group (legal-entity details are shown at the top of this page). The unit that serves you sees only the bookings made with that unit.

• Account: name, mobile number or email, language, PIN/password (stored only as a hash — we cannot read it)
• Bookings: contact name, phone, email, dates and times, party size, special requests, pick-up/drop-off and flight number (for cars)
• Payments: method, amount, reference — never card numbers
• Queue tickets, in-stay requests (including room number), reviews, reward points, notification preferences
• Proof of consent: document, version, date and time
• Technical: session and language cookies, a delivery log of messages (recipients partly masked)

We do not collect data the law prohibits (race, ethnicity, political opinion, religion, sexual behaviour, criminal record) and we do not accept passport copies through the app. Please do not put such information in "special requests"; if you tell us about an allergy or health need, you consent to its use for that service only.

• To create and secure your account (including one-time codes and lockouts)
• To handle bookings, queue tickets, requests and payments and issue confirmations and receipts
• To update you, and to alert the unit that has to serve you
• To run the rewards programme and verified reviews
• To meet legal duties (accounting, tax, lawful requests from authorities) and prevent fraud
• To send news and offers — only if you opt in

Data is used only for the purpose it was collected for.

We process your data on the consent you give when registering or booking, and to perform our contract with you. You can withdraw marketing consent at any time in the Account screen. Withdrawing consent to processing that is necessary means we can no longer serve you — you can delete your account in the Account screen.

• The group unit or brand delivering your booking
• Payment providers (bank / card acquirer) for online payments
• Technical providers: hosting, Cloudflare (security and network), Google (email delivery), One Desk and WhatsApp/Meta (messaging)
• Authorities, where the law requires

We do not sell your personal data.

Some providers in section 5 (email, WhatsApp, the security network) run servers abroad. By accepting this policy you consent to the transfer of the data they need (such as your number, email address and message content) for the purposes in section 3 only.

• Account: while it is active; on deletion, personal fields are erased or made unidentifiable immediately
• Bookings and payments: for the period accounting and tax law require (generally 10 years)
• One-time codes: 5 minutes (hashed); message delivery log and queue tickets: no more than 12 months

Encrypted connections (HTTPS); PINs, passwords and one-time codes stored as hashes; lockout after wrong attempts; staff see only their own unit's data; every status change is logged. We assess risks at least yearly.

If a data breach occurs we will notify LaoCERT and the people affected without delay.

• To be informed and to access: download your data from the Account screen
• To have inaccurate data corrected
• To deletion: delete your account yourself in the Account screen (records the law requires are kept in unidentifiable form)
• To object to or stop marketing, and to withdraw consent
• To complain to us or to the Ministry of Technology and Communications

We answer requests within 30 days. Guests who booked without an account can contact us with their booking code.

We use only essential cookies: a sign-in session (30 days) and your language, plus Cloudflare's security cookies. No advertising or behavioural tracking cookies.

The service is not designed for people under 18. If we learn we hold a child's data without a guardian's consent, we will delete it.

If this policy changes materially we will ask for your acceptance again. For privacy matters, see the email and phone at the top of this page.