PDPA
Privacy Policy
This Privacy Policy explains how PMC SKINCARE CO., LTD., the operator of the pimmycool.com website, collects, uses, discloses and protects personal data, and the rights available to you under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
1. Who we are, and what this policy covers
This Privacy Policy is issued by PMC SKINCARE CO., LTD. ("Pimmycool", "we", "us", "our"), the operator of the pimmycool.com website.
It covers only the pimmycool.com website. It does not cover our storefronts on Shopee, Lazada, TikTok Shop or Facebook — those platforms are governed by their own, separate privacy policies.
2. Information we collect
We collect the following personal data:
- Contact form details — your name, email address, company, destination country, message and the product you are asking about, when you submit our contact form.
- A hashed IP address — we run your IP address through a one-way SHA-256 hash with a secret salt before storing it. The hash cannot be reversed back into an IP address; we use it only to limit contact-form submissions to 3 per 10 minutes, to block spam.
- A language cookie — remembers which language (English, Thai, Chinese or Arabic) you are reading the site in.
- Aggregate product view counts — we record, per product and per day, how many times its page was viewed. This is a daily total, not tied to any individual visitor, cookie or IP address.
3. Purpose and legal basis
- Responding to your enquiry and issuing a quotation — based on taking steps toward a contract with you, and our legitimate interest in running a wholesale/export enquiry service.
- Preventing spam and abuse of the contact form (the hashed-IP rate limit) — based on our legitimate interest in keeping the form usable.
- Measuring which products are viewed (the browser session storage behind our page-view counter) — based on your consent, given through the cookie banner. This is the only processing on this site that needs, and depends on, your consent.
4. How long we keep data
- Contact form submissions: kept for 24 months from your most recent contact with us, then deleted.
- Cookie consent choice: 180 days, after which we ask again.
- Language cookie: 365 days.
5. Disclosure to our service providers
We do not sell your personal data, and we do not share it with anyone for their own marketing purposes. The following service providers process data on our behalf, strictly to run the website:
- Supabase — hosts our database (contact submissions, product data).
- Vercel — hosts the website and serves it through its global network.
- Resend — sends us an email notification when someone submits the contact form; the content you submitted is included in that email.
6. International data transfer
Our database runs on Supabase's Singapore region (AWS ap-southeast-1). The website itself is served through Vercel's global network, which may route requests through servers outside Thailand. The PDPA permits this kind of cross-border transfer where the receiving country or organisation maintains an adequate standard of data protection.
7. Third-party content
Product photos on this site are loaded directly from Shopee's image servers (cf.shopee.co.th), not copied onto our own servers. When you view a product page, your browser connects to Shopee's servers directly to fetch that image.
8. Your rights
Under the PDPA, you have the right to:
- Access the personal data we hold about you
- Request a copy of it, or ask us to transfer it to you or another organisation (data portability)
- Object to our processing of it
- Request that it be erased or destroyed
- Request that we restrict our use of it
- Request that we correct inaccurate data
- Withdraw consent you previously gave (for example, for the product-view measurement cookie)
- Lodge a complaint with Thailand's Personal Data Protection Committee (PDPC)
9. How to exercise your rights
Email us at pimmycoolshop@gmail.com with your request.
To withdraw or change your cookie consent at any time, use the "Cookie settings" link in the site footer.
We will act on a verified request within 30 days of receiving it.
10. Data security
- All traffic to and from the site is encrypted (HTTPS).
- Our admin dashboard is reachable only by staff accounts we have approved.
- Our database enforces row-level security, so even our own application code can't read data it hasn't explicitly been granted access to.
11. Data breach notification
If a personal data breach occurs that is likely to result in a risk to your rights, we will notify Thailand's Personal Data Protection Committee (PDPC) within 72 hours of becoming aware of it, as required by Section 37(4) of the PDPA, and will notify affected individuals directly where the breach poses a high risk.
12. Data controller
PMC SKINCARE CO., LTD.
Tax ID: 0105564002341
26, 28, 30 Chaloem Phrakiat Ratchakan Thi 9 Soi 37, Nong Bon, Prawet, Bangkok 10250, Thailand
Contact for personal data matters: pimmycoolshop@gmail.com. You may also lodge a complaint with Thailand's Personal Data Protection Committee (PDPC).
13. Cookies we use
Below are all the cookies and browser-storage items this site sets, why, and for how long. See also "Information we collect" above.
| Name | Category | Lifetime | Purpose |
|---|---|---|---|
| pc_locale | Necessary | 365 days | Remembers which language (English, Thai, Chinese or Arabic) you are reading the site in. |
| pc_consent | Necessary | 180 days | Remembers your cookie choice (accept all / necessary only), so we don't ask again on every visit. |
| pv:<product-slug> (browser session storage, not a cookie) | Measurement — only set if you choose "Accept all" | Until you close the tab or browser | Marks that you have already viewed a specific product page during this browsing session, so it is not counted twice in our view statistics. |
| sb-* (admin only) | Necessary — staff only, never set for customers | Session-based, managed by our login system | Keeps a logged-in PMC staff member signed in to the internal admin dashboard. Never set while browsing the public site as a customer. |
14. Changes to this policy
We may update this Privacy Policy from time to time — the version number and effective date at the bottom of this page tell you when it last changed. Continuing to use the site after a change means you accept the updated policy.
Version 1.0 — effective 11 September 2026