Privacy Policy

Legal · Personal data only

Privacy Policy

Effective date: 22 October 2026. This version replaces all earlier privacy notices published by GateZip.

Scope note: This page covers personal data only. It is not the booking, payment, cancellation, or refund policy. Those rules are in the separate Terms & Conditions and Cancellation & Refund Policy.

This Privacy Policy explains how GateZip collects, uses, discloses, stores, and protects personal data when you visit our website, contact us, request a quotation, make a booking, or use our services. It is issued in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the “PDPA”) and other applicable laws.

By using the GateZip website, submitting an enquiry, or booking a service, you acknowledge that you have read this Privacy Policy. Where the PDPA requires consent, we will ask for it separately and will not treat mere use of the website as that consent.

What this Policy explains

This page is GateZip’s privacy policy. It describes the personal data we collect, how we use it, the parties who receive it, how we disclose it, and the security practices we use to protect it. Each point is summarised here and set out in full in the sections that follow.

• Data we collect (ข้อมูลที่เก็บรวบรวม). Identity and contact details, booking and flight details, passport and other travel documents when the arrangement needs them, the payment amount, currency, and transaction reference, messages you send us, and technical data such as IP address, device, and cookies. GateZip does not store your full card number or card security code. See section 3.
• How we use it (การใช้งาน). To prepare a quotation, confirm the price, take payment, arrange an independent supplier, identify the travellers, provide support, keep records the law requires, protect our systems, and, where permitted, send a newsletter. We do not sell personal data. See section 6.
• Parties who receive disclosed data (ฝ่ายที่ได้รับข้อมูลที่เปิดเผย). GateZip staff and contractors who arrange the booking; the independent supplier that performs the service, such as a driver, fast-track operator, airline, hotel, or guide; payment processors and banks; hosting, email, and analytics providers, including Google; and a court or regulator when a lawful request requires it. See section 8.
• How we disclose it (วิธีการเปิดเผย). We disclose only the minimum data the recipient needs. Disclosure is made over HTTPS on this website, by GateZip business email, telephone, or messaging to the supplier booked for that service, on the payment partner’s own checkout page, or in a written response to a lawful request. We do not publish personal data on public pages of this website, and we do not sell or rent it. See section 8.
• Security practices (แนวทางปฏิบัติด้านการรักษาความปลอดภัย). We protect personal data with HTTPS, access limits, a duty of confidentiality, disclosure of only the data a supplier needs, card details collected on the payment partner’s page and not stored by GateZip, deletion when the retention period ends, and notice of a qualifying breach. See section 11.

1. Data controller

The data controller responsible for your personal data is:

Business operator: GateZip
Address: 999 Moo 1, Nong Prue, Bang Phli District, Samut Prakan 10540, Thailand
Country: Thailand
Phone: +66 96 056 9500
Email: hello@gatezip.com
Business hours: Open 24 Hours, Monday – Sunday
Place of business: Suvarnabhumi International Airport (BKK), Thailand

GateZip is an arranging agent. We source and coordinate travel arrangements. We are not the direct provider of the underlying services. Airport Fast Track and Meet & Greet, airport transfers, flights, concierge services, corporate and group travel, air charter, and similar services are performed by independent suppliers, including airlines, drivers, ground handlers, hotels, guides, and other operators. GateZip’s role is to arrange the booking, pass the details needed to the supplier, and coordinate the reservation.

When a supplier needs your personal data to perform the service it has been engaged to provide, that supplier is a separate business. It handles that service, and the personal data required for it, under its own conditions and privacy notice.

2. Scope

This Policy applies to personal data processed by GateZip in connection with:

• the website at gatezip.com and related pages;
• enquiries by telephone, email, WhatsApp, social media, or in person;
• quotations, bookings, payments, and delivery of services and packages;
• customer support, complaints, and records we must keep by law.

It does not govern websites, airlines, hotels, embassies, payment providers, or other third parties that you deal with directly. Those organisations process personal data under their own notices.

3. Personal data we collect

We collect only what is needed for the enquiry or booking. Depending on the service, this may include:

• Identity and contact data: full name, nationality, date of birth, telephone number, email address, messaging-app identifier, company name, and billing address.
• Booking data: flight number, airline, arrival or departure date and time, terminal, number of passengers, luggage, vehicle type, pickup and drop-off locations, package selected, special requests, and the confirmed price in Thai Baht (THB).
• Travel-document data: passport or national identification number, issuing country, expiry date, and a copy of the passport or other identification you send us so we can arrange Fast Track, transfers, or flights.
• Payment and transaction data: amount, currency (THB), payment status, booking reference, and limited payment references from our payment partners. GateZip does not ask you to send a full card number, CVV, or internet-banking password by email or chat.
• Communications: messages, call notes, and files you send to our help desk.
• Technical data: IP address, browser type, device type, pages viewed, referring URL, approximate location derived from IP address, and cookie identifiers, including data collected through Google Analytics.
• Preference data: language preference stored for the website, and marketing choices where you have opted in.

If you book for other travellers, you confirm that you are authorised to give us their personal data and that you have told them about this Policy.

4. Sensitive personal data

Some services require data the PDPA treats as sensitive, or data from which sensitive information can be inferred. Examples include health or mobility information needed for wheelchair or medical assistance, dietary or religious requirements for concierge arrangements, and biometric or identity data appearing on a passport copy.

We collect sensitive data only when it is necessary for the service you asked for, when you have given explicit consent, or when another condition in the PDPA allows it. Please do not send sensitive documents that the booking does not require.

5. How we collect personal data

• directly from you, when you complete a form, call, email, or message us, or pay for a booking;
• from a person booking on your behalf, such as a family member, assistant, or corporate travel manager;
• from our service partners, when they confirm a flight, transfer, permit, or reservation that you asked us to arrange;
• automatically, through cookies and similar technologies when you use the website.

6. Purposes of use

We use personal data to:

• answer enquiries and prepare quotations;
• confirm the final THB price before payment and administer the booking;
• arrange Fast Track, Meet & Greet, buggies, transfers, flights, concierge reservations, charter coordination, and related packages;
• identify you and the travellers named on a booking at the airport or with a partner;
• provide customer support before, during, and after the service;
• send service messages about a booking you have made, including schedule changes;
• prevent fraud, secure our systems, and keep accounting and tax records;
• comply with Thai law, airport and immigration procedures, and lawful requests from authorities;
• understand how the website is used and improve our pages and services;
• send newsletters or offers only where permitted, and stop if you opt out.

We do not sell personal data. We do not use personal data to make solely automated decisions that produce legal effects about you.

7. Legal bases

Under the PDPA we rely on one or more of the following, depending on the activity:

• Contract. Processing is necessary to take steps you request before a booking, or to perform a booking you have made.
• Legal obligation. Processing is necessary to comply with laws that apply to GateZip, including accounting, tax, and lawful orders of a competent authority.
• Legitimate interests. Processing is necessary for our interests in operating a secure travel-assistance business, recovering debts, and improving our services, where those interests are not overridden by your rights.
• Vital interests. Processing is necessary to prevent or suppress a danger to life, body, or health, for example if a traveller needs urgent assistance at the airport.
• Consent. We rely on consent for optional marketing and, where required, for sensitive personal data. You may withdraw consent at any time. Withdrawal does not affect processing that has already taken place, and it does not cancel a booking or create a right to a refund.

8. Parties who receive personal data, and how we disclose it

Because GateZip is an arranging agent and not the direct provider, we pass the booking details the supplier needs in order to perform the service. We disclose personal data only for the purposes in section 6, and only the minimum required for that purpose.

Parties who receive disclosed data (ฝ่ายที่ได้รับข้อมูลที่เปิดเผย) may include:

• GateZip staff and contractors who operate the help desk and administer bookings;
• the independent supplier engaged for that booking, such as a driver, ground handler, fast-track operator, airport personnel, airline, hotel, restaurant, golf club, guide, interpreter, or charter operator;
• payment processors and banks that handle the transaction you authorise;
• information-technology, hosting, email, and analytics providers that support our systems, including Google for website analytics;
• professional advisers and insurers, and competent courts or regulators, when disclosure is required by law or is necessary to establish or defend a legal claim.

How we disclose personal data (วิธีการเปิดเผย):

• Information you submit on this website is transmitted over HTTPS.
• Details needed by a supplier are sent through a GateZip business channel used for that booking: email, telephone, or a messaging account operated by GateZip, or the supplier’s booking system. The usual contents are the traveller’s name, contact number, and flight or pickup details. A passport copy or other document is sent only when that supplier requires it to perform the service.
• Card payments are entered on the payment partner’s checkout page. GateZip receives the result of the payment and a transaction reference. We do not receive the full card number or card security code through that checkout, and we do not ask you to send either of them by email or chat.
• Hosting, email, and analytics providers receive data through the systems we use to run the website and our records. They process it on our instructions, except where, as with Google Analytics, the provider also acts under its own terms.
• A disclosure to a court, regulator, or other authority is limited to what the lawful request covers, and is made in response to that request.
• We do not publish personal data on the public pages of this website. We do not sell or rent personal data.

The supplier that performs the service is the direct service provider. Where that supplier decides its own purposes for the personal data, it is a separate data controller and should provide its own privacy notice. GateZip remains the controller for the personal data we use to arrange and administer the booking.

9. International transfers

GateZip is established in Thailand. Your data is primarily stored and used in Thailand. Because travellers, airlines, and technology providers may be outside Thailand, some personal data may be transferred to another country, including where a flight or hotel is located, or where a cloud or analytics provider hosts data.

Where the PDPA requires it, we transfer personal data only where the destination provides adequate protection, where an exemption applies (including where the transfer is necessary to perform your booking at your request), or where you have consented after being informed of the destination country’s inadequate protection.

10. Retention

We keep personal data only for as long as the purpose requires:

• unsuccessful enquiries: up to 24 months after our last contact, unless you ask us to delete them sooner and we have no duty to retain them;
• booking, operational, and identity records: for the service period and then for up to 5 years, so we can handle complaints, chargebacks, and legal claims;
• accounting and tax records: for the period required by Thai revenue law, commonly at least 5 years;
• passport copies: for as long as the booking requires, then deleted or anonymised unless a longer legal hold applies;
• analytics data: according to the retention settings of our analytics tools, and no longer than we need for website improvement.

When the retention period ends, we delete, destroy, or anonymise the data so that it can no longer identify you, unless we must keep a limited record to show that we met a legal duty.

11. Security practices

We use the following practices to protect the personal data described in this Policy (แนวทางปฏิบัติด้านการรักษาความปลอดภัย):

• Encrypted transmission. The public website is served over HTTPS, so information submitted through the site is encrypted while it is in transit.
• Limited access. Booking and customer records are kept in systems that use access controls. Only GateZip staff and contractors who need the data to arrange or support a booking can open those records.
• Confidentiality. Those staff and contractors are required to keep customer data confidential and to use it only for GateZip’s work.
• Minimum disclosure. A supplier receives only the personal data that supplier needs to perform the booked service, sent through a GateZip business channel or that supplier’s booking system.
• Payment data. GateZip does not store full payment-card numbers or card security codes. Card data is entered on the payment partner’s checkout. We require that partner to handle card data under payment-card security standards applicable to its service.
• Retention and deletion. We keep personal data only for the periods in section 10. When a period ends, we delete, destroy, or anonymise the data.
• Breach notice. If we become aware of a personal-data breach that creates a risk to your rights, we will notify the Personal Data Protection Committee and, where the PDPA requires it, the affected people without undue delay.

No method of transmission or storage is completely secure. These practices reduce the risk. They do not remove it.

12. Cookies and analytics

The website uses cookies and similar technologies:

• Preference cookie. We store your language choice in a cookie named gz_ui_lang and in local storage so the site can remember it. This cookie is not used for advertising.
• Analytics. We use Google Analytics (measurement ID G-HCXSNMZYS3) to understand visits, including pages viewed, approximate location, device, and browser. Google may set cookies such as _ga and process data as an independent controller under Google’s own terms. You can refuse analytics cookies through your browser settings or Google’s opt-out tools.

You can block or delete cookies in your browser. Blocking the preference cookie only means the site will not remember your language. Blocking analytics cookies does not prevent you from requesting a booking.

13. Marketing

Service messages about a booking you have made, including confirmation, operational changes, and safety information, are part of the service and are not marketing.

We send newsletters and promotional messages only where the PDPA allows, including where you have given consent through the newsletter form. You may opt out at any time by using the unsubscribe link or by emailing hello@gatezip.com. Opting out of marketing does not cancel a booking and does not entitle you to a refund.

14. Your rights

Subject to the conditions and exceptions in the PDPA, you have the right to:

• access personal data we hold about you and ask for a copy;
• ask us to correct data that is inaccurate or incomplete;
• ask us to erase or destroy data, or to anonymise it, where the PDPA gives you that right;
• ask us to restrict the use of your data in the circumstances set out in the PDPA;
• receive personal data you provided to us in a structured, commonly used format where processing is based on consent or contract and is carried out by automated means, and to ask us to send it to another controller where technically feasible;
• object to processing based on legitimate interests, and object to direct marketing at any time;
• withdraw consent, where processing is based on consent;
• lodge a complaint with the Personal Data Protection Committee of Thailand.

To exercise a right, email hello@gatezip.com or call +66 96 056 9500. Please include your full name, booking reference if you have one, and the right you wish to use. We may ask for information to confirm your identity before we act. We will respond within the period required by the PDPA, generally within 30 days.

We may decline a request where the law allows us to do so, for example where disclosure would adversely affect the rights of another person, or where we must retain the data for a legal claim or a statutory record. A request to delete data does not, by itself, cancel a confirmed booking or require GateZip to refund any payment.

15. Children

Our services may be booked for families, including children travelling with a parent or guardian. We do not knowingly market to children or open an account for a child. A parent or legal guardian must provide any child’s data that a booking requires and is responsible for that disclosure. If you believe we have collected a child’s data without proper authority, contact us and we will delete it unless we must keep it to complete or record a booking made by the guardian.

16. Changes to this Policy

GateZip may update this Privacy Policy to reflect a change in our services, partners, or legal duties. When we do, we will publish the updated Policy on this page at least 48 hours before the update takes effect, together with the new effective date.

Where a change materially affects processing that is based on your consent, we will ask for consent again where the PDPA requires it. The continued use of our services after the effective date is subject to the updated Policy.

17. Contact and complaints

Questions about this Policy, or requests to exercise your rights, may be sent to the data controller:

Email: hello@gatezip.com
Phone: +66 96 056 9500
Address: 999 Moo 1, Nong Prue, Bang Phli District, Samut Prakan 10540, Thailand

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Committee of Thailand. You may also contact us first so that we can try to resolve the matter.

18. Related documents

This page covers personal data only. Booking rules, payment, cancellation, and refunds are not part of this Privacy Policy. See the separate Terms & Conditions and Cancellation & Refund Policy. If those documents and this Policy differ on a privacy question, this Policy prevails for the processing of personal data.