Privacy Policy

Last updated: 31 August 2026
Effective: 31 August 2026
This policy applies to giftsofthailand.com and is governed by the laws of the Kingdom of Thailand.

This policy explains what personal data we collect, why, how long we keep it and what you can make us do about it. It is written to satisfy Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) and the EU GDPR for visitors in Europe.

1. Who is the data controller

Gifts of Thailand Co., Ltd., registration [COMPANY REGISTRATION NUMBER], [REGISTERED ADDRESS], Bangkok 10110, Thailand.
Privacy contact: [email protected].

2. What we collect

We do not knowingly collect data from anyone under 20, and we do not collect sensitive personal data as defined by section 26 of the PDPA.

3. Why we use it, and our lawful basis

4. Gift recipients

When you send a gift you give us someone else’s name, address and sometimes phone number. We use it only to deliver that order and we delete it on the same schedule as the order record. We never add a recipient to a marketing list. You are responsible for having a legitimate reason to give us their details — under the PDPA that is your obligation as the person disclosing them, not ours.

5. Who we share it with

We do not sell personal data. Ever. We share the minimum necessary with:

• Delivery couriers — recipient name, address, phone, so the parcel arrives.
• Payment providers — to take payment and handle refunds and chargebacks.
• Hosting and infrastructure — our servers are in Thailand; our CDN and DNS provider operates globally.
• Professional advisers and authorities — where legally required.

Each processor is bound by contract to use the data only on our instructions.

6. International transfers

Our infrastructure sits in Thailand, but content delivery and DNS are handled by a global network, so data may transit servers outside Thailand and outside the EEA. Where that happens we rely on the recipient’s adequacy status, standard contractual clauses, or your explicit consent, as required by PDPA section 28 and GDPR Chapter V.

7. Your rights

Under the PDPA and, where it applies, the GDPR, you may:

• Access — get a copy of the personal data we hold about you.
• Rectify — have inaccurate data corrected.
• Erase — have data deleted, where we have no overriding legal duty to keep it.
• Restrict — have us pause processing while a dispute is resolved.
• Object — to processing based on legitimate interest, and to direct marketing at any time.
• Port — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, without affecting what was lawful beforehand.

Email [email protected]. We respond within 30 days. There is no charge unless a request is manifestly excessive.

8. Complaints

If we have not resolved something, you can complain to Thailand’s Personal Data Protection Committee (PDPC), or — if you are in the EEA — to your national supervisory authority. We would much rather you came to us first.

9. Security

The site runs over TLS end to end. Our infrastructure is containerised with no service running as root, no publicly reachable database or cache, and administrative and API surfaces restricted to the host itself. Credentials are stored as files with restricted permissions, never in environment variables or source control. Access to personal data is limited to staff who need it.

No system is perfectly secure. If we ever suffer a breach likely to result in risk to your rights, we will notify the PDPC within 72 hours and tell you directly where the risk is high.

10. Cookies

Set out separately in our Cookie Policy. Nothing non-essential is set before you choose.

11. Changes

We will update this page when our processing changes and revise the date at the top. Material changes will be notified directly where we hold your contact details.