Privacy notice
This notice explains how AQUATIQUE collects and uses your personal data when you visit this website or place an order, as required by the Personal Data Protection Act B.E. 2562 (PDPA).
Effective date: [TODO-MATT: date this notice takes effect]
Who is responsible for your data
The controller of your personal data is [TODO-MATT: confirm legal seller: บริษัท พี แอนด์ เอ (กรุงเทพ) จำกัด / English name, registered address, tax ID], which sells AQUATIQUE hats on this website ("we", "us").
Privacy contact: [TODO-MATT: privacy contact email and LINE]. We have not appointed a data protection officer. [TODO-MATT: confirm with adviser that a DPO is not required]
What we collect and why
| What | Why we use it | Legal basis |
|---|---|---|
| Name, email, phone number, delivery and billing address, the items you order | To process your order, deliver it, send order and shipping emails and answer your questions | Needed to perform our contract with you |
| Payment details: payment status and references. Card details go to Stripe and are not stored by us. For PromptPay or bank transfer, the payment slip image you upload, with the amount, date and reference on it | To confirm that you have paid, issue documents and handle refunds | Needed to perform our contract with you; legal obligation for tax and accounting records |
| Tax and accounting records (orders, invoices, receipts) | To meet tax and accounting law | Legal obligation |
| Account data: email, name, password (stored in hashed form), and, if you choose Google sign-in, your Google name and email | To let you sign in, see your orders and save your details | Needed to perform our contract with you; consent when you choose Google sign-in |
| Reviews and messages you send us (including on LINE, Instagram or email) | To publish your review, answer your question and handle returns or complaints | Consent for reviews; legitimate interest or contract for support messages |
| Technical data: IP address, browser type, pages requested, security and error logs | To keep the website working and secure, prevent fraud and meet record-keeping duties for computer traffic data | Legitimate interest; legal obligation |
If you do not give the data we need for an order (for example a delivery address), we cannot deliver it. Everything else is optional.
Marketing
We do not send marketing emails or messages unless you opt in separately. You can withdraw that choice at any time. Placing an order never requires you to agree to marketing. [TODO-MATT: confirm no marketing is planned at launch]
Cookies
This website uses cookies that are needed for it to work: keeping your cart, keeping you signed in, and security. [TODO-MATT: list any analytics, advertising pixel or other optional cookie that is added later. If none, keep this sentence: "We do not use advertising or analytics cookies."]
Who we share your data with
We use service providers who process data on our instructions. We share only what each one needs.
- Stripe: card payments.
- SlipOK: checking PromptPay payment slips.
- Resend: sending order and shipping emails.
- Cloudflare: website delivery, security and DNS. Traffic to this website passes through Cloudflare.
- Google: sign-in with Google, only if you choose it.
- Couriers and Thailand Post: your name, phone number and delivery address, so they can deliver your parcel.
- Our website platform and hosting provider (1% EVO): runs and secures this store. [TODO-MATT: confirm processor agreement with the platform operator and the hosting location]
- Our accountant and, where the law requires it, government authorities. [TODO-MATT: name the accountant if one is used]
We do not sell your personal data.
Sending data abroad
Some of these providers (for example Stripe, Resend, Cloudflare and Google) may process data outside Thailand. When data is sent abroad, we use providers that apply appropriate protection and we follow the PDPA rules for international transfers.
How long we keep your data
- Order and tax records: at least five years, as the law requires.
- PromptPay slip images: deleted automatically 90 days after the payment request is settled, expired or cancelled. The amount, reference and decision are kept with the order record.
- Account data: until you ask us to close the account. Records we must keep by law stay until the legal period ends.
- Support messages, reviews and technical logs: [TODO-MATT: retention periods for support messages, reviews and logs]
Your rights
Under the PDPA you may ask us to:
- give you access to your data and a copy;
- correct data that is wrong or out of date;
- delete your data or stop using it, where the law allows;
- object to our use of your data, including for marketing;
- move your data to another service, where it applies;
- withdraw a consent you gave, at any time.
Write to us through the contact page. We may ask you to confirm who you are. We reply without delay and, for access requests, generally within 30 days. If you are not satisfied, you may complain to the Personal Data Protection Committee (PDPC).
Security
We protect your data with access controls, encrypted connections (HTTPS) and limited staff access. If a data breach is likely to affect your rights, we will tell the authority and, where required, you.
Children
This website is not aimed at children, and we do not knowingly collect data from them.
Changes to this notice
If we change how we use your data, we will update this page and its effective date.