Privacy Policy
Data controller: SONYBEAR, Bangkok, Thailand. Privacy contact: [email protected]. This policy follows Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) and, for users in the EU/UK, the GDPR.
What we collect
- Account data: username, email, password (stored only as an Argon2id hash).
- Orders, payments and wallet activity. We never see or store your card number.
- Security data: IP address and device/browser type of signed-in devices.
- Support messages and any details you give for staff-delivered products (stored encrypted).
Why we use it
- To provide the service and deliver what you buy (contract).
- To prevent fraud and keep accounts safe (legitimate interest).
- To keep accounting and tax records (legal obligation).
- To send offers, only if you opted in. You can withdraw at any time.
Who processes it for us
Stripe (payments), our hosting provider and our email provider, each bound by contract to protect your data. Data may be transferred abroad under appropriate safeguards such as standard contractual clauses. We never sell personal data.
How long we keep it
Account data while your account is open. Payment and order records for at least 5 years, as accounting and tax law requires. Security logs for up to 12 months.
Cookies
We use only strictly necessary cookies: your sign-in session, request-forgery protection, and your language and currency choice. No advertising or third-party tracking cookies, so no consent banner is needed.
Your rights
You can access, copy, correct, delete, object to or restrict processing of your data, move it elsewhere, and withdraw consent. Download your data or delete your account yourself under Privacy & data, or write to [email protected]. You may also complain to Thailand’s PDPC or your local data protection authority.
Security
HTTPS everywhere, AES-256-GCM encryption for delivered logins, Argon2id password hashing, optional two-step verification, and breach notification within 72 hours where the law requires it.