Privacy Notice

Privacy Notice

Effective: 2 September 2026 Last updated: 8 September 2026

This notice is given under Section 23 of the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). It tells you what personal data we collect, why we collect it, the lawful basis we rely on, how long we keep it, who we share it with, and what rights you have.

1. Who controls your data

How to reach us about your data

• Email: bummiras@gmail.com
• Telephone: +66 85 120 2053
• LINE Official Account: https://lin.ee/zrMS30A
• Post: the registered office above, marked for the attention of the person responsible for personal data

We are not required to appoint a Data Protection Officer under Section 41 of the PDPA, because our core activity is not large-scale data processing as defined there. A named person inside the company handles these matters and receives requests through the channels above.

2. What we collect

2.1 Data you give us

2.2 Data created when you use the service

2.3 Data from third parties

If you sign in with Google, Facebook or LINE, we receive your name, email address and profile picture from that provider, limited to what you permit. We never receive your password for those accounts.

2.4 Sensitive data

We do not collect sensitive personal data as defined in Section 26 of the PDPA (such as race, religion, health data or biometric data). If you send such data to us through a free-text field, we delete it when we find it.

2.5 Minors

This service is not intended for people under 20 to contract on their own. If you are under 20, a purchase requires the consent of the person with parental authority under Section 20 of the PDPA. If we learn that we hold a minor's data without valid consent, we delete it.

3. Why we process your data and on what basis

We do not use automated decision-making or profiling that produces legal effects for you within the meaning of Section 32(1).

We currently email you only about your orders and your account — identity verification, order confirmation and delivery updates. We do not send marketing email. If we start, we will ask for your consent separately first and include an unsubscribe link in every message.

If we ever want to use your data for a purpose not listed above, we will tell you and obtain fresh consent first.

4. Who we share your data with

We share only what is necessary, and we bind each recipient to use the data only on our instructions.

We do not sell, rent or trade your personal data for marketing purposes.

5. Transfers outside Thailand

Using this service involves storing or processing data outside Thailand, under Sections 28 and 29 of the PDPA.

Some destination countries may not have data protection standards equivalent to Thailand's. We therefore protect these transfers through data protection terms agreed with each provider, in line with the criteria issued by the Personal Data Protection Committee for transfers abroad. You may ask to see details of these safeguards using the contacts in Section 1.

6. How long we keep data

After these periods we delete the data or render it non-identifiable.

7. Your rights

You may exercise these rights free of charge.

How to exercise them

1. Things you can do yourself, right now — sign in and go to My Account - Correct your data (right 6): change your display name, gender and telephone number on the account page; change addresses on the addresses page - Delete your account (right 4): the "Delete account" button at the bottom of the account page - Withdraw push notification consent (right 7): turn off notification permission for this site in your browser settings - Withdraw cookie consent (right 7): the "Cookie settings" button at the end of the Cookie Policy page 2. Things that need a request — for access and copies (right 1), portability (right 2), objection (right 3) and restriction (right 5), email bummiras@gmail.com with your name, the email address on your account, and which right you wish to exercise. We will provide the data in a machine-readable file.

We may ask you to verify your identity to prevent someone else exercising your rights. We will complete your request within 30 days of receiving it, as required by Section 30. If we refuse, we will record our reasons and tell you.

One limitation you should know about: if you have an order in production or in transit, we cannot delete your delivery address until delivery is complete, because neither you nor we would be able to track the shipment. Data held in accounting documents must also be kept for the periods in Section 6.

Complaining to the regulator Office of the Personal Data Protection Committee (PDPC), 7th Floor, Ratthaprasasanabhakti Building, Government Complex, Chaeng Watthana Road, Thung Song Hong, Lak Si, Bangkok 10210, Thailand — https://www.pdpc.or.th

8. If you are in the EEA or the United Kingdom

This service is aimed at customers in Thailand and we deliver only within Thailand. If you browse the site from the EEA or the UK, the GDPR or UK GDPR may apply to that processing. Where it does:

• Our lawful bases map to Article 6 GDPR as follows: contract (Article 6(1)(b)), legal obligation (Article 6(1)(c)), legitimate interests (Article 6(1)(f)), and consent (Article 6(1)(a)).
• Your rights under Articles 15 to 22 GDPR correspond to the rights in Section 7 above, and we handle them through the same channels.
• Transfers to countries outside the EEA are covered by the contractual safeguards described in Section 5.
• You also have the right to lodge a complaint with your local supervisory authority.

We have not appointed an EU or UK representative under Article 27 GDPR, because we do not offer goods or services to, or monitor the behaviour of, people in those territories.

9. Security

We apply technical and organisational measures under Section 37(1) of the PDPA:

• HTTPS/TLS encryption in transit and encryption of stored data
• Row-level and column-level access control in the database
• Mandatory two-factor authentication for every administrator, and a second identity check before any action that touches money or personal data
• Profile pictures and tax invoices held in non-public storage, reachable only through time-limited links
• Logging and monitoring of unusual events, with alerts to administrators
• Regular backups with a tested restore procedure

If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and notify you without delay where the breach is likely to result in a high risk to your rights and freedoms, as required by Section 37(4).

10. Cookies

The full list of cookies this service uses, their purpose, lifetime and how to manage them is in the Cookie Policy.

11. Changes to this notice

We will update this notice whenever our processing changes or the law changes, and we will always show the effective date at the top. If a change materially affects your rights, we will tell you in advance by email or by a notice on the site.

12. Governing law

This notice is governed by Thai law, in particular the Personal Data Protection Act B.E. 2562 (2019), and is to be read together with the Terms of Service.