Privacy Policy

This Privacy Policy explains how Tong Garden Co., Ltd. ("Tong Garden", "we", "us") collects and uses your personal data when you use shop.tonggarden.co.th, our mobile pages, customer support and membership programme (the "Platform"). 

This Privacy Policy is a companion to, and should be read together with, our Terms and Conditions. Our company’s legal name, registration number, registered office and general customer-service/complaint contact are set out in the Terms and Conditions and are not repeated here. 

We are the Data Controller for your personal data under the Personal Data Protection Act, B.E. 2562 (2019) ("PDPA"). 

• Privacy contact: onlinethailand@tonggarden.com · phone 029601166 #360
• Data Protection Officer (if appointed): email: onlinethailand@tonggarden.com

1. LAWS WE FOLLOW 

We process personal data in line with the Personal Data Protection Act, B.E. 2562 (2019); the Electronic Transactions Act, B.E. 2544 (2001); and the Consumer Protection Act, B.E. 2522 (1979). This policy applies to personal data we collect in digital form, or collect offline and later digitize. 

2. WHAT WE COLLECT AND WHY 

We collect only what we need for the purposes below. 

We do not collect more data than needed for these purposes and will ask for fresh consent before using your data for any new purpose. 

3. YOUR CONSENT 

We process your personal data on the basis of your consent, given by a clear action such as ticking a box or tapping "I agree", or because processing is necessary to perform your order contract or to comply with Thai law. Marketing communications and non-essential cookies have their own separate opt-ins, and you can use the Platform without agreeing to them. 

You can withdraw consent at any time, as easily as you gave it, from [My Account > Privacy settings] or by writing to [onlinethailand@tonggarden.com]. Withdrawal does not affect processing already done. If you withdraw consent needed for an order, we may be unable to complete it. 

4. WHO WE SHARE DATA WITH 

We do not sell your personal data. We share it only with: 

• Service providers (Data Processors) acting on our instructions under a written contract: payment gateways, courier and logistics partners, SMS/email/Line providers and analytics providers. 
• Government agencies and courts, when required by Thai law. 

Each processor may use your data only to provide its service to us. 

5. COOKIES AND SIMILAR TECHNOLOGIES 

We use cookies to run the Platform. 

• Essential cookies keep you logged in and remember your cart. These are always on. 
• Analytics cookies help us understand how the Platform is used. These are on only with your consent. 

You can change your choice at any time through [Cookie settings] at the bottom of every page, or through your browser. 

6. HOW LONG WE KEEP YOUR DATA 

We keep personal data only while it is needed for its purpose, then erase or anonymize it unless the law requires us to keep it. 

7. HOW WE PROTECT YOUR DATA 

We use reasonable security safeguards, including encryption in transit (HTTPS/TLS), encryption or masking of stored data where appropriate, role-based access controls, access logging and monitoring, and regular backups. Our processors must maintain equivalent safeguards. 

If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the Office of the Personal Data Protection Committee (PDPC) without undue delay, and where feasible within 72 hours of becoming aware. Where the breach carries a high risk to you, we will also notify you and explain what happened, the likely impact, and what you can do. 

8. YOUR RIGHTS 

Under the PDPA you can: 

1. Access a copy of the personal data we hold about you and how we process it. 
2. Correct inaccurate or incomplete data. 
3. Erase or anonymize your data when it is no longer needed, or consent is withdrawn. 
4. Restrict how we use your data while a request is being verified. 
5. Object to processing for direct marketing or based on legitimate interest. 
6. Receive or transfer your data in a portable format, where technically possible. 
7. Withdraw consent at any time. 
8. Complain to the Office of the Personal Data Protection Committee (PDPC) if you believe we have not complied with the PDPA. 

To use these rights, go to [My Account > Privacy] or email [onlinethailand@tonggarden.com]. We may ask you to verify your identity. We aim to respond within 30 days. 

9. MINORS 

Where you are under 10 years of age, we require the consent of your parent or legal guardian before processing your data. Where you are between 10 and 19 years of age, we require your guardian’s consent as well as yours, unless the specific action (such as browsing, or a purchase suited to your everyday living) is one you may lawfully do on your own under the Civil and Commercial Code. Who may place an order on the Platform is set out in our Terms and Conditions. If you believe a minor’s data reached us without the required consent, contact us and we will delete it. 

10. DATA STORED OUTSIDE THAILAND 

Some service providers may store or process data outside Thailand. Where we transfer personal data abroad, we use a destination country or organization with adequate data protection standards, or put contractual or other safeguards recognized under the PDPA in place first. 

11. CHANGES TO THIS POLICY 

We may update this policy when our practices or the law change. We will post the new version here with a new "Last updated" date. For material changes, we will notify you by email or on the Platform and ask for fresh consent where required. 

12. CONTACT US 

For any complaint or question about your personal data, please contact the privacy contact above, or the Complaints Contact published in our Terms and Conditions. You may also complain to the Office of the Personal Data Protection Committee (PDPC).