Privacy and cookies

The data controller is Matalay Company Limited, a company incorporated in the Kingdom of Thailand and the master developer of Matalay, Khao Lak, Phang Nga. You can reach the privacy contact through the enquiry form on this site or by replying to any email we send you.

Dunk Duck Dive Co., Ltd. builds and hosts this website and the virtual tour, and operates the enquiry dashboard on Matalay’s behalf as a data processor under a written agreement.

Enquiries. When you send an enquiry we collect your name, email address, and, if you give them, your phone or messaging number, company, the parcels or topics you are interested in, and your message. We record the date, a reference number, the version of this notice you consented to, and any campaign tag in the link you arrived by.

Investor access. When you request the Investment Memorandum we collect your name, work email, company and role, and we record when you sign in and download the document.

The concierge. Questions you type into “Ask Matalay” are sent to an AI service to generate an answer and are not stored by us. Please do not include personal data in a question. We count the number of questions asked per day, without content.

Technical logs. Our server keeps standard request logs (a hashed form of your IP address, time, page and browser type) for security and rate limiting, for up to 30 days.

We use enquiry and investor data to reply to you, to arrange calls or guided tour sessions, to send you the information you asked for and to follow up about Matalay. The legal basis is your consent, given by ticking the box on the form (PDPA section 19), together with our legitimate interest in responding to requests you make. You may withdraw consent at any time; doing so does not affect what happened before you withdrew it.

We use technical logs on the basis of our legitimate interest in keeping the site secure (PDPA section 24(5)).

This site sets no cookies for marketing. It uses one optional analytics service, Google Analytics 4, and only after you accept it in the banner. Until then no request is made to Google. If you decline, the site remembers that choice in your browser’s local storage and nothing else is set. You can change your mind by clearing site data in your browser, after which the banner appears again.

Analytics tells us which pages and parts of the tour people explore; IP addresses are anonymised. If you sign in to investor access, a strictly necessary session cookie is set so the site knows it is you. It expires after 30 days or when you sign out.

The virtual tour at dunkduckdive.com is a separate site with its own consent banner and notice.

Your enquiry is stored in Matalay’s sales dashboard, operated by Dunk Duck Dive Co., Ltd., and is seen by the Matalay sales team. We use the following service providers, each bound to process data only on our instructions: our hosting provider (server in the United States), our email provider (to send confirmations and notifications), Google (analytics, only with your consent) and Anthropic (to generate concierge answers; question text only, not stored by us). Where data leaves Thailand it goes to providers with adequate safeguards, as required by PDPA section 28.

We do not sell personal data and we do not share it with other developers or agents without asking you first.

Enquiry and investor records are kept for as long as the conversation about Matalay is active and for two years after the last contact, then deleted, unless a longer period is required by law or by a transaction you enter into. Technical logs are kept for up to 30 days. Analytics data is retained by Google for 14 months.

Under the PDPA you may ask us to: access and receive a copy of your data (section 30); correct it (section 35); delete or anonymise it (section 33); restrict its use (section 34); object to processing (section 32); receive it in a portable form (section 31); and withdraw consent (section 19). Write to the contact below; we respond within 30 days. You also have the right to lodge a complaint with the Personal Data Protection Committee of Thailand.

Data travels encrypted (HTTPS), is stored on access-controlled servers, and sign-in links are single-use and expire after 30 minutes. Access to enquiry data is limited to the sales team and audited. If a breach affecting you were to occur we would notify the Committee within 72 hours and inform you where the law requires it (section 37(4)).

Matalay Company Limited, Khao Lak, Phang Nga, Thailand. Use the enquiry form and mark your message “privacy”. We may update this notice; the version and date at the top change when we do, and forms always show the version you are agreeing to.