Privacy Policy

1. Personal Data We Collect

When you place an order through this website or contact us via chat, we collect only the data necessary to fulfil your order:

• Recipient's full name, to identify the parcel recipient and prepare the shipping label
• Phone number, to confirm your order and allow the courier to contact you
• Delivery address, to deliver the goods to their destination
• Order items and payment amount, to prepare your order and confirm payment
• Messages you send us, to handle your enquiry continuously

We do not store your national ID number, credit card number, or any other financial information in our systems.

If you do not provide the data listed above, we may be unable to process your order or deliver the goods to you.

2. Purposes and Legal Bases for Processing

We process your personal data on the following legal bases under the PDPA:

• Performance of a contract (Section 24(3)) — to process and deliver your order, confirm your address, provide tracking numbers, and handle exchanges or returns
• Compliance with a legal obligation (Section 24(6)) — to retain accounting and tax records as required by law
• Legitimate interests (Section 24(5)) — to provide after-sales support, verify order accuracy, and prevent fraud
• Consent (Section 19) — for marketing communications and publication of your review, which you may withdraw at any time

Where processing is based on consent, withdrawing your consent will not affect the lawfulness of processing already carried out, nor will it affect order fulfilment carried out on the basis of contract.

3. Sensitive Data and Health Information

Health information is sensitive personal data under Section 26 of the PDPA. We do not request, and do not intend to collect, such data from you.

Please do not send us information about medical conditions, symptoms, test results, or any other sensitive data. If you have health-related concerns, please consult a physician or pharmacist directly.

If you nevertheless provide such information voluntarily, we will use it solely to answer your enquiry on that occasion. We will not use it to build a customer profile, will not use it for marketing, and will remove it from the conversation once the matter is concluded.

4. Disclosure to Third Parties

We do not sell, trade or rent your personal data to third parties for marketing purposes. Disclosure occurs only where necessary, as follows:

• Our courier (Flash Express) receives only the recipient's name, phone number and address, as required to deliver the parcel
• Website and communication service providers, acting as data processors under confidentiality obligations
• Government authorities or officials, where required by a lawful order or warrant

5. International Transfers

This website relies on technology infrastructure and communication services whose providers may operate servers outside Thailand. Your data may therefore be transferred to or stored in another country.

Where this occurs, we act in accordance with Sections 28 and 29 of the PDPA by selecting providers with adequate personal data protection measures, and by limiting transfers to what is necessary to provide the service.

6. Data Retention

• Order records and accounting documents: retained for 5 years, as required by accounting and tax legislation
• Chat conversation history: retained for 1 year from the date of last contact
• Data processed on the basis of your consent: retained until you withdraw that consent

Once these periods expire, or once the data is no longer necessary for its purpose, we will delete, destroy, or anonymise it.

7. Cookies and Website Analytics

This website uses cookies necessary for basic system functionality, and may use analytics tools that measure visits on an aggregate, non-identifying basis in order to improve our content.

You may refuse or delete cookies through your browser settings. Please note that disabling certain cookies may cause parts of the website to function incompletely.

8. Security Measures

We maintain appropriate security measures in accordance with Section 37 of the PDPA, including restricting access to personnel who require it and transmitting data over encrypted channels.

In the event of a personal data breach, we will notify the Personal Data Protection Committee within the period prescribed by law, and will notify you where the breach presents a high risk to your rights and freedoms.

9. Children's Data

This website and product are intended for adults. We do not intend to collect personal data from minors. In accordance with the product label warning, children and pregnant women should not consume this product.

If you become aware that a minor has provided personal data to us without the consent of a person exercising parental authority, please notify us and we will delete such data without undue delay.