Privacy policy

Data controller

The data controller for this site is [Website owner legal name]

The registered company name, address and official contact details will appear in this section once the site owner has confirmed them. In the meantime you can reach us through the contact form on this site.

What we collect

We collect only what you enter in a contact form, and only the fields relevant to the kind of enquiry you send.

• Your name, and an email address or a phone number, so that we can reply to you
• Company or shop name and province, for business enquiries
• The product concerned, a lot number or production date, and where you bought it, for product feedback and complaints
• Business type, product ranges of interest and approximate volume, for wholesale enquiries
• The message you write to us
• The language you were using, the time you submitted, and a record of your consent
• Technical data used only to stop automated submissions: the browser user agent, and a one-way hash of your IP address. We do not store your IP address in a readable form

We never ask for national ID numbers, financial details, or the sensitive categories of data described in section 26 of the Act, such as health, religion or biometric data. Please do not put them in the message field. If you send them unnecessarily, we will remove them from the record.

Purposes and lawful bases

• Answering questions, feedback and complaints about our products, on the basis of the consent you give when you submit the form, and our legitimate interest in consumer care
• Handling wholesale and media enquiries, on the basis of consent and of steps taken at your request before entering into a contract
• Investigating, tracing and improving product quality when a complaint is received, on the basis of our legal obligations relating to product safety
• Preventing misuse of the forms and automated submissions, on the basis of our legitimate interest in keeping the service secure

We do not use your data for direct marketing, we do not build behavioural profiles, and we make no automated decisions that affect you.

How long we keep it

• General questions and feedback: 12 months from the date the matter is closed
• Product complaints: 24 months from the date the matter is closed, for quality traceability
• Business enquiries: 24 months from the last contact
• Technical anti-spam records: no longer than 30 days

After those periods we delete the data or render it non-identifying, unless a legal obligation requires us to keep it longer.

Who we share it with

• Website and database infrastructure providers, who process the data on our instructions under a data processing agreement
• The manufacturer or distributor concerned with a product you have complained about, and only as far as is needed to investigate
• Government authorities or courts, where we are ordered or obliged by law to disclose

We do not sell, rent or trade your personal data for anyone's marketing purposes.

Transfers outside Thailand

The systems that serve this site may process data on servers located outside Thailand. Where that happens, we require appropriate safeguards in line with sections 28 and 29 of the Personal Data Protection Act.

Your rights as a data subject

• The right of access, and to a copy of your personal data
• The right to have inaccurate, out-of-date or misleading data corrected
• The right to have your data erased or destroyed when it is no longer needed or when you withdraw consent
• The right to ask us to suspend use of your data
• The right to object to our collection, use or disclosure of your data
• The right to data portability, in a machine-readable form, to another controller
• The right to withdraw consent at any time, without affecting processing already carried out lawfully
• The right to complain to the Personal Data Protection Committee if you believe our processing breaks the law

To exercise any of these rights, send a request through the contact form. We will verify your identity before acting, and we will respond within 30 days of receiving the request. Exercising these rights is free, unless a request is excessive or repeated without good reason.

Security

• Every page of the site is served over an encrypted connection
• Form submissions are held in a database with access restricted to the people who need it
• IP addresses are hashed one way before they are stored, so the original address cannot be recovered
• We review access rights and technical measures periodically

No system is perfectly secure. If a breach of personal data occurs that is likely to risk your rights and freedoms, we will notify the Office of the Personal Data Protection Committee within 72 hours and inform you as the law requires.

Cookies and browser storage

This site sets no analytics or advertising cookies, and stores only your consent choice in your own browser. The cookie policy on this site gives the detail.

Children

This site is not aimed at children and we do not intend to collect personal data from minors. Where consent from a minor would be needed, we will seek the consent of the holder of parental responsibility as section 20 requires. If you believe we hold a minor's data without proper consent, tell us and we will delete it.

Changes to this policy

We may update this policy when the law, our services or our practices change. The version shown on this page is the one in force, and the date it was last updated appears at the foot of the page. If a change is significant, we will say so on the site.

Contacting the data protection officer

The data protection officer of [Website owner legal name] is responsible for questions and rights requests under this policy. Direct contact details will be published in this section once the officer has been appointed and confirmed. Until then, please use the contact form on this site and say that your message concerns personal data.