Privacy policy

Who is responsible

Reef & Key is the brand of a property agency in Phuket. The controller identified in the Contact section is responsible for processing personal data. This policy covers our website and enquiries sent through it. A property transaction may require additional information and separate notices.

What we receive

When you submit an enquiry, you provide your name and a contact method: phone number, email address, Telegram username or WeChat ID. The form also sends the page language, your device’s time zone and technical spam prevention signals, including completion time. The host may infer a country from your IP address; where available, it accompanies your enquiry.

When you visit, the host processes your IP address and technical request information needed to deliver the page and keep it secure. In correspondence, we receive information you choose to share, such as property preferences. Please do not send passport details, payment credentials or sensitive personal information through the form.

Why we use it

To answer your enquiry, discuss property options and continue the conversation through your chosen channel. Technical information helps deliver your enquiry, consider your local time and protect the site against spam and repeated submissions.

We ask for your consent to process an enquiry submitted through the form. If it leads to arranging or providing a service, necessary data is processed to take steps you request before entering a contract and to perform that contract. Preventing misuse relies on our legitimate interest in keeping the site secure where applicable law permits. Mandatory records are retained to meet legal obligations.

Submitting an enquiry does not subscribe you to advertising or give consent to advertising tracking. We request those permissions separately.

Providing form data is voluntary. Without a name and contact method, we cannot process the enquiry; you can choose another published contact channel.

Cookies and browser settings

Advertising and analytics tools depend on the integrations enabled and are described below. Local browser storage (localStorage) remembers your response to a language suggestion until you clear it. When the Google integration is enabled, it also stores your selected purposes and the date of your choice for up to 180 days. Tab storage (sessionStorage) is used for repeat visits to the entrance animation, recovering page loading and technical layout previews; those records expire with the tab session. These settings do not store your name or form contact details. You can clear them in your browser; the language suggestion, entrance and cookie choices may then appear again.

Fonts and images are served from our site. Hosting and security services may process technical data as part of their operation.

Advertising and analytics from Meta and Google

The site is prepared to use Advanced Consent Mode v2 for Google Ads and Google Analytics 4. If the Google integration is enabled, its tags load when you open a page, including before you make a choice and after refusal. Meta Pixel for Facebook and Instagram, if connected, runs only with separate advertising consent. Refusing does not prevent you from using the site or submitting an enquiry.

Advertising and analytics storage, use of data for advertising and ad personalisation are denied by default. Before you allow the relevant purposes and after refusal, Google may receive limited measurements without cookies (cookieless pings), including a successful enquiry signal. The corresponding advertising and analytics cookies are neither read nor written. These signals support basic measurement, aggregate statistics and modelling of visits and conversions. Ad personalisation is disabled after refusal.

Limited signals may include consent state, event time and type, browser and referral information, and a random value for the current page load. Sending a network request also involves processing an IP address. The absence of cookies does not by itself make all technical data fully anonymous; some of this information may constitute personal data.

If you allow the relevant purposes, Google and Meta may use cookies and receive the page address, referral source, IP address, browser and device information, event time and type, cookie identifiers and advertising identifiers. This information may be used to measure advertising, record enquiries, analyse visits and, with separate personalisation permission, tailor advertising. Providers may match it with other data under their own policies. Your name and enquiry text are not sent to these services.

The following sharing takes place only after a successful enquiry and with your separate permission for advertising cookies and the use of data for ad measurement. To measure advertising effectiveness and prevent ads from being shown repeatedly, we may share de-identified cryptographic identifiers with Google and Meta (SHA-256 hashes of an email address or phone number). The original personal data is not sent to advertising systems in plain text.

When integrations are enabled, cookie settings let you accept or reject purposes and change your choice later using the Cookie settings button. Closing a notice or continuing to browse does not count as consent. Withdrawal prevents further reading and writing of the corresponding cookies; standard Google cookies accessible to the site are removed. Meta Pixel also receives a withdrawal signal; accessible _fbp and _fbc cookies are removed. Limited cookieless Google pings may continue. Details of the actual cookies and their retention periods are provided before they are enabled. See the Meta privacy policy, Google privacy policy and Consent Mode explanation.

Who receives it

Agency staff receive enquiries in a work chat through the Telegram Bot API. Cloudflare hosts the site and processes page and form requests. Access is needed by people who respond to your enquiry, maintain the site or protect its security.

Sharing with a developer, lawyer or another party to a transaction is possible where necessary for a service agreed with you and supported by a lawful basis. We do not sell your personal data. Disclosure may also be required by law.

Processing in other countries

The agency operates in Thailand. Cloudflare, Telegram and your chosen communication services may use infrastructure in other countries with different data protection rules. Where applicable law requires safeguards or separate consent for a transfer, these must be in place before it takes place. Ask the controller for information about recipients and applicable safeguards. The form checkbox alone does not replace safeguards required for international transfers.

If advertising and analytics services are enabled, Meta and Google will also receive data and may process it in other countries. Information about the relevant recipients and transfer safeguards will be provided before launch.

How long it is kept

We keep enquiries and correspondence for as long as needed to respond and carry out the work agreed with you. If a contract is entered into, retention also depends on mandatory document retention periods and the need to handle possible claims. Once the purpose is complete and no other lawful retention basis remains, data must be deleted or anonymised, including from the work chat. Technical log retention depends on the record’s purpose and the provider’s rules; ask the controller for details.

Your rights

Subject to applicable law, you may request access and a copy, correction, deletion, restriction or portability of your data, and object to processing. Where processing relies on consent, you may withdraw it at any time using the contacts below. Withdrawal does not affect the lawfulness of earlier processing.

We may need to verify your identity to fulfil a request and will ask only for necessary information. We respond within the deadlines set by applicable law. You may also complain to a competent data protection authority, including in Thailand or your own country where the law allows. We do not make solely automated decisions about you with legal or similarly significant effects.

Security and external links

We limit access to enquiries and use safeguards appropriate to the processing. No storage or transmission method guarantees absolute security. If you open a messenger or another website, that service’s own privacy policy governs its processing.

Changes to this policy

The current version appears on this page with its update date. For material changes to processing purposes, we will provide the necessary information and seek fresh consent where required. This policy is available in six languages; your rights depend on applicable law regardless of the language you choose.