Privacy Policy

1. Who we are, and what this policy covers

2. Information we collect

• ∞Contact form details — your name, email address, company, destination country, message and the product you are asking about, when you submit our contact form.
• ∞A hashed IP address — we run your IP address through a one-way SHA-256 hash with a secret salt before storing it. The hash cannot be reversed back into an IP address; we use it only to limit contact-form submissions to 3 per 10 minutes, to block spam.
• ∞A language cookie — remembers which language (English, Thai, Chinese or Arabic) you are reading the site in.
• ∞Aggregate product view counts — we record, per product and per day, how many times its page was viewed. This is a daily total, not tied to any individual visitor, cookie or IP address.
• ∞Aggregate daily visitor counts — we record how many visits came from each country on each day, and alongside that country, three coarse groupings of the same visit: which site sent you (a short list such as Google, Facebook, TikTok, or "direct"), whether you opened it on a phone or a computer, and which kind of page you arrived on (home page, catalogue, a product page, an article). The country is derived from your IP address by our network provider at the moment you open a page; we do not store your IP address, the address of the page that sent you, or your browser’s identification string — only which group each of them falls into. What we keep is a per-day total for each combination of those groups — not tied to any individual, cookie or account — and only if you chose "Accept all" in the cookie banner.
• ∞Catalogue search terms — when you use the search box on our catalogue or our Thai online shop, we record the words you typed, how many times that wording was searched that day, and how many products it matched. This is not linked to you, your browser or your country; we keep it to learn which products buyers look for and we do not have. Do not type personal information into the search box.
• ∞Shop account details — you sign in to our online shop with LINE, with Google, or with your email address and a password you choose. From LINE or Google we receive a unique account number, your display name and, if you allow it, your email address; we never see your LINE or Google password. If you sign up with email, we keep your email address, the name you type (optional) and your password in scrambled form only (a one-way hash — nobody, including us, can read it back). To slow down password guessing we keep each sign-in attempt's email address and a scrambled form of the IP address for 15 minutes, then delete them.
• ∞Delivery addresses — the recipient name, phone number, house number and street, subdistrict, district, province and postcode you save for delivery.
• ∞Orders — the products, quantities and prices you buy, the shipping fee, the total, the delivery address used for that order, the order status, the parcel tracking number, any discount code you used, and — only if you chose "Accept all" in the cookie banner — which kind of site brought you to the shop (a short list such as Facebook, Google, TikTok or "direct"; never the address of that site). You pay on a page run by Stripe, our payment provider: your card number or PromptPay details go to Stripe, not to us. We receive only Stripe's payment reference and whether the payment succeeded.
• ∞A hashed IP address when a new shop account is created or a discount code is tried at checkout — the same one-way hash described above, used only to limit new accounts to 10 per IP address per hour and discount-code attempts to 20 per IP address per hour, and kept for about one hour.
• ∞Quote request details — if you put products in the quote cart and send a request for pricing, we collect your name, email address, phone number, country, street address and city, together with the products and quantities you chose, so that we can price the goods and the freight and prepare a quotation. There is no account and no password: the cart itself lives only in your own browser until you press send.

3. Purpose and legal basis

• ∞Responding to your enquiry and issuing a quotation — based on taking steps toward a contract with you, and our legitimate interest in running a wholesale/export enquiry service.
• ∞Preventing spam and abuse of the contact form (the hashed-IP rate limit) — based on our legitimate interest in keeping the form usable.
• ∞Measuring which products are viewed (the browser session storage behind our page-view counter) — based on your consent, given through the cookie banner. This is the only processing on this site that needs, and depends on, your consent.
• ∞Running your shop account, taking payment for your order and delivering it — based on performing the contract of sale you make with us when you place an order (and the steps you ask for before it, such as signing in and saving an address).
• ∞Keeping order and payment records — based on our legal obligation under Thai accounting and tax law.
• ∞Limiting how many new shop accounts can be created, and how many discount codes can be tried, from one IP address — based on our legitimate interest in preventing fake accounts and code guessing.
• ∞Holding the contact and address details from a quote request, and using them to prepare a quotation and the export paperwork — based on taking steps at your request before entering into a contract, and on performing that contract. This does not rest on consent: you give us these details by choosing to send the request.

4. How long we keep data

• ∞Contact form submissions: kept for 24 months from your most recent contact with us, then deleted.
• ∞Quote request details: kept for 24 months from your last contact with us, the same as a contact-form enquiry, because a quotation and the shipping documents made from it are commercial records. Email us at pimmycoolshop@gmail.com to have them deleted sooner.
• ∞Shop account and saved addresses: for as long as your account exists. Delete your account yourself with "ลบบัญชี" (Delete account) on the My Account page, or email us at pimmycoolshop@gmail.com; your name, email, phone and saved addresses are then deleted, except the order records below.
• ∞Orders, including the delivery address used for each: 5 years from the end of the accounting period in which the order was made, the period Thai accounting law requires us to keep sales records.
• ∞The hashed IP address from creating a shop account or trying a discount code: about 1 hour.
• ∞Shop sign-in cookie: 30 days, or until you sign out.
• ∞Cookie consent choice: 180 days, after which we ask again.
• ∞Language cookie: 365 days.

5. Disclosure to our service providers

• ∞Cloudflare — hosts the website, its database and its image storage, and serves it through its global network.
• ∞Stripe — processes payments for shop orders (card and PromptPay). Stripe handles your card or PromptPay details under its own privacy policy.
• ∞LINE and Google — confirm your identity when you choose to sign in with them, and send us the account details listed above.
• ∞The delivery company that carries your parcel — receives the recipient name, phone number and address printed on the parcel label.
• ∞Resend — sends us an email notification when someone submits the contact form or a quote request; it tells us that a request arrived, and we read the details in our admin system.

6. International data transfer

7. Third-party content

8. Your rights

• ∞Access the personal data we hold about you
• ∞Request a copy of it, or ask us to transfer it to you or another organisation (data portability)
• ∞Object to our processing of it
• ∞Request that it be erased or destroyed
• ∞Request that we restrict our use of it
• ∞Request that we correct inaccurate data
• ∞Close your shop account and have its details deleted (order records are kept for the period the law requires)
• ∞Withdraw consent you previously gave (for example, for the product-view measurement cookie)
• ∞Lodge a complaint with Thailand's Personal Data Protection Committee (PDPC)

9. How to exercise your rights

10. Data security

• ∞All traffic to and from the site is encrypted (HTTPS).
• ∞Our admin dashboard is reachable only by staff accounts we have approved.
• ∞Our database cannot be reached from the internet directly; every read and write goes through our own server code, which checks who is asking first.
• ∞We never receive or store your card number — payment details are entered on Stripe's page.

11. Data breach notification

12. Data controller

13. Cookies we use

14. Changes to this policy