Privacy Policy

Phteah Yeay ("we", "us", "our", "the Hotel") respects the privacy of every guest, visitor, vendor, applicant, and user of our services. This Privacy Policy explains what personal data we collect, how we use it, the legal grounds we rely on, who we share it with, how long we keep it, and the rights you have. It applies to our hotel operations in the Kingdom of Cambodia, our website, our booking systems, and all marketing.

This Policy is written to comply with applicable Cambodian law (including the Civil Code 2007, the Criminal Code provisions on personal information, the Law on Tourism, the Law on E-Commerce 2019, and Ministry of Tourism regulations) and, for guests resident in the European Economic Area or the United Kingdom, with the General Data Protection Regulation (GDPR). For California residents, certain rights under the CCPA also apply.

1. Who we are — Data Controller

The data controller responsible for your personal data is Phteah Yeay, Thlok Andoung Village, Sangkat Slakram, Siem Reap City, Siem Reap, Cambodia. Ministry of Tourism Licence #[INSERT]. VAT TIN [INSERT]. Privacy inquiries: privacy@phteahyeay.com.

2. Personal data we collect

2.1 Identity & registration data

• Full name, date of birth, gender, nationality, marital status, occupation
• Passport, national ID, or other government-issued ID; visa type and number; entry/exit data
• Photograph (for security/identification at check-in if requested)
• Signature (on registration, waivers, and event agreements)

2.2 Contact data

• Permanent home address, country of residence, telephone number(s), email address
• Emergency contact (name, relationship, phone, email)

2.3 Reservation & financial data

• Booking dates, room type, guests in your party, dietary preferences, special requests
• Card type and last 4 digits (full card details are tokenised by our payment processor — we do not store full card numbers); receipts and invoices

2.4 Health & safety data

On a strictly voluntary basis, we collect: food allergies, dietary restrictions, mobility needs, medical conditions or pregnancy that may affect activity participation, and incident or injury reports during your stay. We treat this information as sensitive personal data and apply additional safeguards.

2.5 CCTV, Wi-Fi & device data

• CCTV footage of public areas (lobby, corridors, restaurant, pool, parking, entrances) — retained for up to 30 days unless required for an investigation
• Wi-Fi connection logs (IP, MAC, session times) — retained for up to 12 months for security and legal compliance
• Website cookies, device identifiers, browser type, IP address — see Section 8 and our Cookie Policy

2.6 Marketing data

• Marketing preferences, language, newsletter sign-ups, photographs and video taken at events with your consent

3. Why we collect — purposes & legal bases

We process your personal data only where we have a lawful basis to do so:

• Contract — to confirm your booking, provide accommodation, and process payment
• Legal obligation — Cambodia Immigration Law (Form A foreigner registration), tax law, and Ministry of Tourism reporting
• Legitimate interest — site security, fraud prevention, service improvement, and limited internal marketing (you can object at any time)
• Consent — newsletter, marketing emails, optional photography use; you may withdraw consent at any time without affecting prior lawful processing

4. Who we share data with

• Cambodian government authorities — General Department of Immigration (Form A), Ministry of Tourism, tax authorities, and law-enforcement agencies, where required by law or in response to a lawful request
• Service providers acting on our behalf — payment processors (e.g., card schemes, ABA Pay), property-management software, booking channels (e.g., Booking.com, Agoda, Expedia), email/CRM platforms, courier/logistics providers, IT and cloud hosting (AWS / Google Cloud), accountants, lawyers, and insurance companies. These providers are bound by confidentiality and data-protection terms.
• Trusted activity partners — only the minimum data needed (e.g., your name and a contact number for a tour pickup)
• Successors in interest — if Phteah Yeay is sold, merged, or restructured, your data may be transferred to the new owner under the same protections

We do NOT sell your personal data.

5. International data transfers

Some of our service providers operate outside Cambodia (e.g., cloud servers and global booking platforms in the EU, US, or Asia-Pacific). When we transfer data internationally we ensure appropriate safeguards: written data-processing agreements, encryption in transit and at rest, and where applicable, EU-approved Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.

6. How long we keep data

7. Security measures

We apply organisational, physical, and technical safeguards proportionate to the risk:

• Access control — data is accessible only to staff with a need-to-know, on the basis of role-based permissions and confidentiality undertakings
• Encryption — TLS for all transmission; AES-256 for stored sensitive data; tokenisation of card data
• Secure storage — paper records in locked cabinets; digital records on access-controlled systems with audit logging
• Backups, antivirus, firewalls, and routine security testing
• Staff training and confidentiality clauses in all employment contracts
• A documented data-breach response procedure. We notify affected individuals and the relevant authorities without undue delay where the law requires.

8. Cookies & website

Our website uses strictly necessary cookies (always on), analytics cookies (only with consent), and functional cookies (preferred language). You can manage cookie preferences from the cookie banner and your browser settings. Refusing non-essential cookies will not affect your ability to make a booking. See our Cookie Policy for a full list.

9. Your rights

Subject to Cambodian law and, where applicable, GDPR / UK GDPR / CCPA, you have the following rights:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data, except where we must keep it by law (e.g., immigration and tax records)
• Restriction — ask us to limit processing in certain cases
• Portability — receive your data in a machine-readable format and have it transferred to another controller
• Object — object to processing based on legitimate interests, including direct marketing
• Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal
• Lodge a complaint — with a competent supervisory authority (in Cambodia, the Ministry of Posts and Telecommunications and/or relevant ministry; in the EU/UK, your local data-protection authority)
• California residents — see also our Do Not Sell or Share My Personal Information page

To exercise any right, submit a request at /privacy/requests or write to privacy@phteahyeay.com. We will respond within 30 days. We may need to verify your identity before acting. There is no fee unless your request is manifestly unfounded or excessive.

10. Children

Our services are intended for adults. We do not knowingly collect personal data from children under 18 except as part of a family booking made by a parent or legal guardian, who consents on behalf of the minor. Special protections apply to any child data we hold.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated by email to recent guests and posted on our website with at least 14 days' notice before taking effect.

12. How to contact us

For any question about this Policy or your data: privacy@phteahyeay.com, or by post to Phteah Yeay, Thlok Andoung Village, Sangkat Slakram, Siem Reap City, Siem Reap, Cambodia.

Khmer-language version available on request. ច្បាប់ភាសាខ្មែរអាចស្នើបាន។

Related: Cookie Policy · Terms of Use · Booking Agreement · Accessibility