Privacy policy
Draft under legal review. Not approved for publication yet.
This policy explains what personal data we collect through theastrasamui.com, why, who we share it with, how long we keep it and how you stay in control of it. The site is run by Varsovia Estate, sales agent for The Astra Samui. Every visitor gets the same standard, whichever country they’re in: the EU GDPR, plus the UK GDPR for visitors in the United Kingdom.
At a glance
- Who’s responsible Red Jasper Studio LLC, trading as Varsovia Estate →
- What we collect what you type into a form or the chat, plus the technical data the site needs to run →
- Why to answer you and prepare your offer. Marketing only if you tick a box →
- Analytics and ads off until you agree in the cookie panel. No Google or Meta tags load before that →
- How long enquiries up to 12 months after our last contact if you don’t buy; personal offer links expire after 60 days →
- Your control access, correction, deletion, objection, withdrawing consent, a complaint to a regulator →
Who we are and how to reach us
The controller of your personal data, and the company that provides this site, is Red Jasper Studio LLC, trading as Varsovia Estate, 651 North Broad Street, Middletown, Delaware, USA. We act as sales agent for The Astra Samui. We are not the developer of the project.
For anything about your data, write to info@varsoviaestate.com. You can also use any channel on our contact page and mention that your message is about personal data.
Our company is registered in the United States, and our team works in South-East Asia. Whatever country you are in, we apply the same standard to everyone: the EU GDPR, plus the UK GDPR for visitors in the United Kingdom.
What we collect
Only what you give us and what the site needs to work.
- Enquiry and offer forms (prices and floor plans, personal offer, reservation request, contact): first name, e-mail, phone number, preferred contact channel, your message and any preferences you pick (apartment type, budget, timing, the apartments you ask about). We also record which consents you ticked, the version of the consent wording, the page language and when you sent the form.
- Brochure in exchange for a phone number: first name, phone, an optional e-mail and your consents. Your browser remembers for 90 days that you’ve already sent the form, so you won’t be asked twice. That note stays on your device and contains no name, e-mail or phone number.
- Call-back request: first name, phone and consent.
- Chat with Lilka, our AI assistant: your messages, plus the name, e-mail and phone you give before or during the chat.
- Booking a call or a visit: what you enter in the calendar and the slot you choose.
- Your personal offer page and PDF: built from your enquiry and opened through a private link. We record when the link is opened.
- WhatsApp, phone and e-mail: if you contact us this way, we keep the conversation and your number or address. WhatsApp itself is run by Meta under its own terms.
- How you found us: the page you landed on, the referring site and campaign tags (UTM parameters and click IDs), sent along with a form. We don’t store them in your browser.
- Technical and security data: your IP address in a hashed form, browser type and timestamps, used to stop spam and abuse and to keep proof of consent. When a form uses the Cloudflare Turnstile check, Cloudflare receives technical data about your browser for that check.
- Analytics and advertising data: only with your consent, see Cookies and similar technologies.
We don’t ask for passport numbers, financial details or any sensitive data through the site. If documents are needed later to buy a unit, your advisor will explain separately which ones and why.
Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR and UK GDPR) |
|---|---|
| Replying to your enquiry; sending prices, floor plans and the brochure; preparing your personal offer; arranging calls and visits; answering you in the chat | Steps taken at your request before entering into a contract, Article 6(1)(b) |
| Handling a reservation and passing your details to the developer and its sales agent when you reserve a unit | Steps taken at your request before entering into a contract, Article 6(1)(b) |
| E-mails about other Varsovia Estate offers; calls, texts and WhatsApp messages about other offers | Your consent, Article 6(1)(a); in the EU also national rules on electronic marketing (in Poland Article 398 of the Electronic Communications Law), in the UK PECR regulations 21–22 |
| Analytics and advertising cookies and pixels | Your consent, Article 6(1)(a), and the cookie rules (in Poland Article 399 of the Electronic Communications Law, in the UK PECR regulation 6) |
| Passing your contact details to Livo / Thailand Kitchens for a furnishing proposal | Your separate consent, Article 6(1)(a) |
| Protecting the site and forms from spam and abuse; keeping the site secure | Our legitimate interest in a safe service, Article 6(1)(f) |
| Keeping proof of consent; establishing, exercising or defending legal claims | Our legitimate interests, Article 6(1)(f) |
| Keeping records the law requires | Legal obligation, Article 6(1)(c) |
Giving us your contact details is voluntary, but without them we can’t reply or send an offer. Where we rely on legitimate interests, you can object, see Your rights.
Who receives your data
We don’t sell personal data. We share it with providers who help us run the service, under data processing agreements, and with the parties you’d expect to be involved when you buy:
- HighLevel (GoHighLevel): our CRM and chat platform. Enquiries, notes, chat history with Lilka and bookings live there, and we send messages from it.
- LH.pl: hosting for the website, the form server, personal offer pages and PDF files, on servers in Poland.
- Cloudflare: the Turnstile anti-spam check on forms.
- Google: Google Analytics 4, only after you accept analytics. YouTube, only when you press play on a video.
- Meta: the Facebook and Instagram pixel, only after you accept marketing and only if we switch it on (it is not active today); WhatsApp, when you message us there.
- The developer of The Astra Samui and its sales agent: only when you reserve a unit, and only what’s needed to prepare and sign the contract.
- Livo / Thailand Kitchens (thailandkitchens.com): only if you tick the separate consent when asking for a furnishing proposal. Without it, your details stay with us and your advisor passes the quote on to you.
- Public authorities and professional advisers: where the law requires it, or to establish, exercise or defend legal claims.
Inside our company, only the Varsovia Estate team handling your enquiry can see it.
Transfers outside the EEA and the UK
Our company is in the United States and our team works in Thailand and Cambodia, so your data is processed outside the European Economic Area and the UK. Some of our providers (HighLevel, Cloudflare, Google, Meta) also process data in the United States or other countries.
We protect these transfers with the EU standard contractual clauses (SCCs), with the UK Addendum for data from the UK. Where a US provider is certified under the EU–US Data Privacy Framework and its UK extension, that certification also applies. When you reserve a unit and we pass your details to the developer in Thailand, the transfer is needed for the contract you asked for (Article 49(1)(b)). You can ask for a copy of these safeguards at info@varsoviaestate.com.
How long we keep your data
- Enquiries that don’t lead to a purchase: up to 12 months after our last contact.
- Marketing: until you withdraw consent or ask us to stop.
- Personal offer pages: the link expires after 60 days; the files are deleted after 180 days at the latest.
- The brochure note in your browser: 90 days, on your device only.
- Analytics (Google Analytics 4): 14 months.
- Security records (hashed IP address): only as long as needed to stop spam and abuse.
- Proof of consent and data needed for legal claims: until the limitation period ends.
- If you buy: as long as the contract and the law require.
Your rights
You can ask us to:
- give you access to your data and a copy of it;
- correct it;
- delete it;
- restrict how we use it;
- send it to you or another provider (portability);
- stop using it where we rely on legitimate interests (objection), and stop marketing at any time.
Where we rely on your consent, you can withdraw it whenever you like; this doesn’t affect anything we did before. Write to info@varsoviaestate.com. We reply within one month and may ask you to confirm who you are first.
You can also complain to a supervisory authority: in the EU, in the country where you live or work or where you believe the breach happened (in Poland, the President of the Personal Data Protection Office, UODO); in the UK, the Information Commissioner’s Office (ICO). We’d appreciate the chance to put things right first, so do tell us.
Lilka, our AI assistant
Lilka is an AI assistant, not a person, and she says so when the chat opens. She replies in English or Polish from our checked project data, answers questions, can send floor plans and help you book a call. She runs on HighLevel’s chat platform. Someone from our team can read the chat and take over, and you can ask for a person at any time. Lilka makes no decisions that have legal effects on you.
We also suggest apartments that match the preferences you share (type, budget, timing). That’s a simple form of profiling: it has no legal effect on you, and an advisor always checks the suggestions.
Marketing messages
We only send you other offers if you ticked the optional consent. Every marketing e-mail has an unsubscribe link, and on WhatsApp you can reply “STOP” or just tell your advisor. Opting out of marketing doesn’t stop replies about your own enquiry.
Security
The site runs over HTTPS. The keys to our CRM stay on the server and never reach your browser. Personal offer pages sit behind long random links that search engines don’t index. Only the team handling your enquiry can see it in the CRM.
Children
The site is meant for adults buying property. We don’t knowingly collect data from anyone under 18.
Changes to this policy
This is version 2026-10-23 of the policy. When it changes, we update the version and date at the top of this page. If the change affects cookies, the consent panel will ask you again.
