PRIVACY POLICY

Effective Date: February 17, 2026
Last Updated: February 17, 2026

1. INTRODUCTION AND COMPANY INFORMATION

Welcome to Brut&More. We respect your privacy and are committed to protecting your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand (PDPA) and other applicable laws.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://brutandmore.com/ or use our restaurant services.

1.1 Data Controller

The data controller responsible for your personal data is:

Company Name: Brut&More
Address: 15/1 Lagoon Rd, Choeng Thale, Thalang District, Phuket 83110, Thailand
Phone: +66 95 275 5588

For any questions regarding your personal data or to exercise your rights, you can contact us via the phone number above or visit us in person at the restaurant.

2. WHAT DATA WE COLLECT

Personal data means any information that can directly or indirectly identify you as an individual. We may collect the following categories of data:

• Identity Data: first name, last name, date of birth (if provided for special occasions or events).

• Contact Data: phone number (when making a reservation or providing feedback).

• Technical Data: IP address, browser type and version, time zone, operating system, and device information used to access our website.

• Usage Data: information about how you interact with our website, such as pages visited and time spent on them.

• Reservation Data: number of guests, date and time of visit, and special dietary requirements (e.g., allergies or restrictions, which may reveal health information).

3. SENSITIVE DATA

The PDPA has special requirements for processing sensitive personal data. This includes data about racial or ethnic origin, political opinions, religious or philosophical beliefs, health, biometric data, and criminal records.

We do not intentionally collect such data, except for dietary preferences and allergies you may voluntarily provide when making a reservation. By providing this information, you give us your explicit and voluntary consent to process it solely for the purpose of ensuring your comfort and safety during your visit.

4. HOW WE COLLECT YOUR DATA

We use different methods to collect data about you:

• Direct Interactions: You provide data directly when you call us, fill out a form on our website, or speak with our staff at the restaurant. For example, when making a reservation, subscribing to news, or sending feedback.

• Automated Technologies: When you visit our website, we automatically collect Technical and Usage Data using cookies and similar technologies. This helps us improve our website and understand visitor preferences.

• Third Parties: We may receive data from third parties such as booking platforms (if you book through a partner service) or analytics providers (e.g., Google Analytics).

5. PURPOSES AND LEGAL BASES FOR PROCESSING

Under the PDPA, we only process your data when we have a legal basis. In most cases, we use your data for the following purposes:

6. COOKIES

Our website uses cookies – small text files placed on your device. This allows us to distinguish you from other users and provide a smooth browsing experience. We use:

• Strictly Necessary Cookies: These are required for the website to function properly and cannot be switched off.

• Analytical/Functional Cookies: These help us understand how visitors interact with our website (e.g., which pages are most popular) and remember your choices (e.g., language) to enhance your experience. These cookies are only activated after we obtain your consent.

Upon your first visit, you will see a banner allowing you to customize your cookie preferences. You can accept all cookies, reject non-essential ones, or customize them by category. You can also change your settings at any time through your browser.

7. DISCLOSURE OF DATA TO THIRD PARTIES

We may share your personal data with a limited number of third parties who assist us in operating our business, provided they ensure adequate data protection. These include:

• IT Service and Hosting Providers: companies that maintain our website and databases.

• Payment Processors (if applicable): for processing payments.

• Partner Booking Services: if you made a reservation through their platform.

• Government Authorities: only in cases explicitly required by Thai law.

We require all third parties to respect the confidentiality of your data and process it only for specified purposes.

8. INTERNATIONAL DATA TRANSFERS

To operate our website and services, we may use servers and services (e.g., analytics or cloud platforms) located outside of Thailand. This means your data may be transferred to countries with different data protection levels. In such cases, we commit to applying necessary safeguards to protect your data in accordance with PDPA requirements (e.g., using standard contractual clauses).

9. DATA SECURITY

We implement reasonable technical and organizational measures to protect your personal data from accidental loss, unlawful use, unauthorized access, disclosure, or alteration. Access to your data is limited to employees who need it to perform their duties.

In the event of a personal data breach that is likely to risk your rights and freedoms, we will notify the Thai regulator (PDPC) within 72 hours and contact you directly if required.

10. DATA RETENTION

We retain your personal data only as long as necessary to fulfill the purposes outlined in Section 5 or as required by Thai law (e.g., for tax record purposes). After this period, data will be securely deleted or anonymized.

11. YOUR RIGHTS UNDER PDPA

The Personal Data Protection Act of Thailand grants you the following rights regarding your data:

• Right to Access: request a copy of your data that we hold.

• Right to Rectification: request correction of inaccurate or incomplete data.

• Right to Erasure (Right to be Forgotten): request deletion of your data under certain circumstances (e.g., if data is no longer needed for the purpose collected).

• Right to Restriction of Processing: limit the use of your data while your request is being processed.

• Right to Object: object to the processing of your data based on legitimate interest.

• Right to Data Portability: receive your data in a structured, machine-readable format.

• Right to Withdraw Consent: withdraw your consent at any time for processing based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us by phone at +66 95 275 5588 or visit us in person at our address. We may need to verify your identity before processing your request.

11.1 No Fee Usually Required

You will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

11.2 Response Time

We will respond to all legitimate requests within 30 days. Occasionally, it may take longer if your request is complex, and we will notify you accordingly.

12. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time. The latest version will always be available on our website with the “Last Updated” date at the top. We encourage you to review it periodically.

13. CONTACT AND COMPLAINTS

If you have any questions about this Privacy Policy or our data protection practices, please contact us:

Phone: +66 95 275 5588
In Person: 15/1 Lagoon Rd, Choeng Thale, Thalang District, Phuket 83110, Thailand

You have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) in Thailand if you believe your data protection rights have been violated. However, we encourage you to contact us first so we can try to resolve your concern directly.