Privacy Policy

1. Who This Policy Applies To

This policy applies to anyone who visits our website, places an order,
or contacts us directly. It is written for people, not for compliance
departments. If something is unclear, write to us.

Data controller: [Registered company name], company registration number [13-digit number], registered address [full address].
Contact: remylaurethailand@gmail.com, [phone number]
Data Protection Officer: [name and email, or delete this line if you have not appointed one]

2. What We Collect

2.1 Information You Give Us

When you place an order or contact us, we collect:

• Your name

• Your email address

• Your delivery address

• Your payment details (processed and held securely by our payment provider. We do not store card data)

• The content of any message you send us

2.2 Information Collected Automatically

When you visit our website, we collect:

• Your IP address

• Browser type and device information

• Pages visited and time spent on the site

• Referring URL

This data is collected through cookies and similar technologies.
See Section 6 for details.

2.3 Information We Do Not Collect

We do not collect:

• Sensitive personal data such as health information, unless you volunteer it in a message to us

• Data from third-party social platforms unless you contact us through them

• Any information beyond what is necessary for the purposes described below

3. Why We Collect It

We use your information only for the following purposes:

• Processing and fulfilling your order (legal basis: performance of a contract)

• Communicating with you about your order (legal basis: performance of a contract)

• Responding to enquiries (legal basis: legitimate interest)

• Improving the website experience (legal basis: legitimate interest)

• Complying with legal obligations (legal basis: legal obligation)

• Sending order confirmation and dispatch notifications (legal basis: performance of a contract)

• Sending marketing emails (only if you have opted in) (legal basis: consent)

We do not use your data for automated decision-making or profiling.

4. What We Do Not Do With Your Data

We do not sell your personal information. To any party. Under any circumstance.

We do not share your information with third parties except:

• Delivery partners [names], who require your name and address to fulfil your order

• Payment processors [names, for example Omise or 2C2P], who handle your transaction securely

• Legal authorities, where we are required to by law

We do not sell or share your information with advertisers or data brokers. Marketing cookies are only used if you agree to them (see Section 6).

Service providers. We also use service providers to run this website and our online store, including Shopify (online store and checkout) and Framer (website hosting) [add any others, for example email or analytics providers]. They process your data only on our instructions.

Data stored outside Thailand. Some of these providers store data on servers outside Thailand. When this happens, we take steps to make sure your data stays protected to the standard required by the PDPA.

5. How Long We Keep It

• Order and transaction records: 7 years (legal and tax obligation)

• Customer correspondence: 2 years from last contact

• Website analytics: 13 months

• Marketing preferences: Until you withdraw consent

When data is no longer needed, it is deleted or anonymised.

6. Cookies

We use necessary cookies to make the website work and, only if you agree, analytics and marketing cookies. You can change your choice at any time in Cookie settings at the bottom of every page. Full details, including the tools we use, are in our Cookie Policy.

7. Your Rights

Depending on where you are located, you may have the right to:

• Access the personal data we hold about you

• Correct inaccurate or incomplete information

• Delete your data, subject to our legal obligations

• Restrict or object to how we process your data

• Withdraw consent for marketing communications at any time

• Data portability: receive a copy of your data in a structured format

To exercise any of these rights, write to us at remylaurethailand@gmail.com.
We will respond within 30 days. We will not ask you to justify the request.

8. Data Security

We take reasonable technical and organisational measures to protect
your data from unauthorised access, loss, or disclosure.
Payment data is handled exclusively by our payment processor and
is never stored on our servers.

No method of transmission over the internet is completely secure.
We cannot guarantee absolute security, but we will notify you
promptly in the event of a breach that affects your personal data.

9. Third-Party Links

Our website may contain links to other sites. This policy does not
apply to those sites. We are not responsible for their privacy practices
and recommend you read their policies separately.

10. Children

Our website and products are not directed at children under the age of 16.
We do not knowingly collect data from children. If you believe a child
has provided us with personal information, please contact us and
we will delete it promptly.

11. Changes to This Policy

We may update this policy when our practices change or when required
by law. Material changes will be communicated by email or prominently
on the website. The date at the top of this page reflects the most
recent update.

12. Contact & Complaints

For any question about this policy or how we handle your data:
remylaurethailand@gmail.com

If you believe we have not handled your data appropriately, you have the
right to lodge a complaint with the Personal Data Protection Committee
of Thailand (PDPC, www.pdpc.or.th), or with your local data protection authority if you are
located outside Thailand.

We wrote this to be read. If something is unclear, ask us.