Privacy Policy

Socitti Samui · Effective date: 23 October 2026 · Last updated: 23 October 2026

1. Who we are

GLIA HONG KONG HOLDINGS CO., LIMITED ("Glia", "we", "us") operates the Socitti Samui app ("the App"), made in partnership with Samui Beach Club. Glia is the data user (controller) of personal data handled through the App.

Room 5003, 5/F, Yau Lee Centre, 45 Hoi Yuen Road, Kwun Tong, Hong Kong · Company No. 79614428 · Privacy contact: hello@glia.digital

This policy follows Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"). For users in the European Economic Area and the UK it also follows the GDPR and UK GDPR, and for users in Thailand the Personal Data Protection Act B.E. 2562 ("PDPA").

2. No account needed

You don't need an account to use the App. We don't ask for your name or email unless you choose to contact a venue (section 4).

3. Data that stays on your device

The following are stored only on your phone and aren't sent to us:

your trip details and preferences (dates, base area, pace, style);
your saved places and day plans;
checklist progress;
My Stay (accommodation name, address, room or villa, booking reference, Wi-Fi and gate details you enter);
downloaded offline content;
your settings and consents.

"Delete my data" in Profile erases all of it. Deleting the App does too.

4. Contacting a venue (only if you choose to)

When you use Contact on a venue, we process:

Your name and email

Required?: Required to send an enquiry
Why: So the venue can reply to you
Who receives it: Samui Beach Club (our venue-contact service) and the venue you chose

Phone number

Required?: Optional
Why: If you want the venue to call or message you
Who receives it: Same

Your message and answers (for example dates, guests)

Required?: Optional
Why: To explain your enquiry
Who receives it: Same

A record that you opened the form or tapped Book now, Call or Message

Required?: Automatic when you use these
Why: To deliver your request, prevent abuse, and for Samui Beach Club's billing with the venue
Who receives it: Samui Beach Club

When it's sent: only after you tick "Share my name and email with {venue} so they can reply". If you don't provide your name and email, we can't send the enquiry. You can still use the other contact options the venue offers.
After that: the venue replies to you directly. Its own privacy practices then apply. We don't monitor replies, take bookings or handle payments.
Updates from Samui Beach Club: if you also tick "Send me Samui Beach Club updates", we'll use your name and email to send you news and offers about Koh Samui from Samui Beach Club. It's off unless you tick it. You can unsubscribe from any email or by contacting us, free of charge, and we'll stop. We don't sell your data, and we don't pass it to others for their marketing.

5. Verifying the genuine App (Apple App Attest)

To stop fake requests to venues, the App uses Apple's App Attest service. This creates a cryptographic key on your device. Apple confirms the key belongs to a genuine copy of the App, and we store the key's identifier and public key. It doesn't identify you by name and isn't linked to your Apple ID, but it is linked to the enquiries you send.

6. Analytics (off unless you turn it on)

At the end of setup, and any time in Profile → Data & consent, you can choose to "share anonymous usage". If you turn it on, the App sends usage events (for example which screens you open and which features you use) to PostHog, hosted in the EU. They're tied to a random identifier, not your name or email. It's off by default, and nothing is sent until you switch it on.

7. Purchases

Purchases are made and processed by Apple. We never see your card details. We use RevenueCat to confirm which pass you've bought, using an anonymous app user identifier and Apple's purchase records. Restore uses your Apple purchase history.

8. Location (optional)

If you allow location, the App uses it on your device for Near Me and directions. If you tap Share my location (in Emergency), your location goes only to the app or person you choose in the share sheet. We don't collect or store your location.

9. Other services the App connects to

Content: venue, event, offer and guide content is loaded from Samui Beach Club's servers (Supabase, Singapore).
Weather and sea data: requested from third-party weather providers. These requests include your device's internet (IP) address but no personal details.
Maps and accommodation search: when you search for your accommodation, your search text is sent to Google Places; map tiles come from Google Maps. Google's terms and privacy policy apply.
External links: opening a venue's website or booking page takes you to that site, and its own policy applies.

Samui Beach Club and the venue you contact: section 4.
Service providers that host or process data for us: Supabase (Singapore), PostHog (EU, opt-in only), RevenueCat (USA), Apple (App Attest and purchases), Google (Places and Maps), and an email delivery provider used by Samui Beach Club.
Authorities, where the law requires it.
A successor business if the App is sold or transferred, under the same commitments.

11. Transfers outside Hong Kong

Our providers may process data in Singapore, the EU, the USA and other countries. We use providers with recognised safeguards, and contract terms where they're needed.

12. How long we keep data

On your device: until you delete it.
Venue enquiries and contact records held by Samui Beach Club: 24 months, then deleted or anonymised. Billing records may be kept longer where the law requires it.
App Attest key records: while they're in use, then deleted.
Analytics (if enabled): up to 26 months.

13. Security

Data is encrypted in transit (HTTPS). Server access is restricted, and App Attest is used to block automated abuse. No system is perfectly secure.

14. Your rights

Under the PDPO you can ask to access and correct your personal data. You can also ask us to stop using it for direct marketing at any time.
Under the GDPR or the PDPA (where they apply) you can also ask for erasure, restriction or a copy of your data, object to processing, and withdraw consent.

Contact hello@glia.digital, attention "Data Protection Officer", at the address above. We'll reply within 40 days (the PDPO limit), or within 30 days for GDPR requests.

Complaints:

the Office of the Privacy Commissioner for Personal Data, Hong Kong: www.pcpd.org.hk;
your local data protection authority.

15. Children

The App is for adults aged 18 or over. We don't knowingly collect data from anyone under 18.

16. Changes

We'll update this page and its date, and show a notice in the App for important changes.