This policy explains what personal data Sahatavesin Import Export Co., Ltd., the company behind Hawaiian Style, collects when you use this website, why we collect it, who we share it with, how long we keep it, and the rights you have over it under Thailand's Personal Data Protection Act B.E. 2562 (2019).
1 · Who we are
Sahatavesin Import Export Co., Ltd. ("we", "us", "our") is the data controller for the personal data described in this policy. We are the company behind the Hawaiian Style brand, making sun care in Bangkok, Thailand since 1995, and we sell it through this website and through marketplace partners.
- Registered company: Sahatavesin Import Export Co., Ltd.
- Registration number: 0105538103021
- Registered address: 1046/4-5 Charoenkrung Road, Bangrak, Bangkok 10500, Thailand
- Email: contact@sahatavesin.co.th
This policy is written to meet the requirements of the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), which is the law that governs personal data in Thailand.
2 · What personal data we collect
We collect only what we need to sell you a product and get it to your door. We do not buy personal data from third parties, and we do not build advertising profiles.
| Category | What it includes | When we collect it |
|---|---|---|
| Identity | First name, last name | When you place an order or request a shipping quote |
| Contact | Email address, telephone number | When you place an order, request a quote, or subscribe to our newsletter |
| Delivery address | Street address, sub-district, district, province and postcode (Thailand); or street address, city, postcode and country (international) | At checkout |
| Order data | The products, quantities and prices in your order, your order number, shipping fee, order status and tracking number | When you order |
| Payment data | Payment status, payment method and the reference number returned by our payment provider | When you pay |
| Technical data | IP address, browser type and basic request logs held by our hosting provider | Automatically when you visit |
3 · Why we use your data, and our lawful basis
The PDPA requires us to have a lawful basis for every purpose. Ours are set out below.
| Purpose | Lawful basis |
|---|---|
| To process and deliver your order, and to contact you about it | Performance of a contract — we cannot fulfil an order without it |
| To prepare and send you an international shipping quotation on request | Performance of a contract / steps taken at your request before entering one |
| To take payment and confirm it with our payment provider | Performance of a contract |
| To keep accounting, tax and transaction records | Legal obligation under Thai tax and commercial law |
| To answer your questions and handle returns, refunds or complaints | Performance of a contract and our legitimate interest in supporting customers |
| To protect the website against fraud and abuse, and keep it running | Legitimate interest in the security of our service |
| To send you marketing emails and newsletters | Consent — which you may withdraw at any time |
We do not use your personal data for automated decision-making that produces legal effects for you, and we do not sell your personal data to anyone.
4 · Who we share it with
We share personal data only with the service providers we need to run the shop. Each acts as our data processor under contract, uses the data only on our instructions, and may not use it for their own purposes.
- Payment processing — a licensed Thai payment service provider receives the order amount and reference so it can take your payment and confirm it to us.
- Database hosting — stores your order and quotation records.
- Website and application hosting — serves this website and processes requests to it.
- Transactional email — sends your order confirmations, shipping notices and quotations.
- Website analytics — receives visit data such as pages viewed, time on page, general location and device type, to help us understand how the site is used. See section 8 for detail and how to opt out.
- Delivery companies — receive your name, address and telephone number so they can deliver your parcel.
We may also disclose personal data where we are legally required to — for example to a court, a regulator or a government agency acting within its powers — or where it is necessary to establish, exercise or defend a legal claim.
5 · Transfers outside Thailand
Some of the providers listed above operate infrastructure outside Thailand, which means your personal data may be processed abroad. Where that happens we rely on the transfer conditions permitted by the PDPA, including contractual safeguards with the receiving provider and, where relevant, your consent. We select providers that offer recognised security and data-protection commitments.
6 · How long we keep it
- Order and transaction records — retained for as long as required by Thai tax and accounting law, which is generally a minimum of five years from the end of the relevant accounting period.
- Quotation requests that do not become orders — retained for up to 12 months, then deleted.
- Newsletter subscriptions — retained until you unsubscribe or ask us to delete them.
- Server and security logs — retained for a short period as set by our hosting provider, then rotated automatically.
When a retention period ends we delete the data or render it non-identifiable.
7 · Your rights under the PDPA
The PDPA gives you the following rights over your personal data. You may exercise any of them free of charge by contacting us using the details in section 12.
- Right to be informed — to know how your personal data is collected, used and disclosed. This policy is part of how we meet it.
- Right of access — to obtain a copy of the personal data we hold about you, and to know how we obtained it.
- Right to rectification — to have inaccurate, out-of-date or incomplete data corrected or completed.
- Right to erasure or de-identification — to have your data deleted or anonymised, subject to records we must keep by law or to defend a legal claim.
- Right to restrict processing — to ask us to suspend use of your data in certain circumstances.
- Right to object — to object at any time to processing based on legitimate interest, public interest, or direct marketing.
- Right to withdraw consent — where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully before it.
- Right to data portability — to receive your data in a structured, commonly used, machine-readable electronic format, or have it sent to another controller where technically feasible.
- Right to lodge a complaint — with the Personal Data Protection Committee (PDPC) in Thailand if you believe we have breached the PDPA.
We will respond to any request within 30 days. We may need to verify your identity before acting, so that we do not disclose your data to somebody else.
8 · Cookies and local storage
Cookie policies commonly describe five categories — strictly necessary, functional, performance/analytics, advertising, and social media. We currently use the first three.
| Category | Do we use it? | What for |
|---|---|---|
| Strictly necessary | Yes | Keeping the site working and keeping an administrator signed in to our internal dashboard |
| Functional | Yes | Remembering your shopping bag on your own device |
| Performance / analytics | Yes | Google Analytics (GA4) — pages viewed, time on page, general location and device type, so we can understand traffic and improve the site |
| Advertising | No | We do not run advertising or cross-site tracking cookies, and we do not build advertising profiles |
| Social media | No | Our social links are plain links — no embedded tracking pixels or widgets |
Google Analytics does not tell us your name. You can opt out of it without changing any other setting on this site, using Google's own Analytics opt-out browser add-on, or by blocking analytics cookies in your browser. If we ever introduce advertising cookies, we will ask for your consent first and update this policy before doing so.
- Your shopping bag is stored in your own browser using
localStorage, under the keyhws-cart-v1. It stays on your device, is not transmitted to us until you place an order, and you can clear it at any time by emptying your bag or clearing your browser's site data. - Strictly necessary storage may be used to keep the site working — for example to keep an administrator signed in to our internal dashboard.
- Hosting logs are generated automatically by our provider for security and reliability, and include IP addresses.
9 · Security
We take appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS across the whole site), access control on our database and administrative dashboard, server-side validation of every order, and keeping payment processing entirely with our licensed payment provider so that card data never reaches our systems. No system is perfectly secure, but we treat customer data as something to hold as little of, and as carefully as, we can.
10 · Children
Our shop is intended for adults. We do not knowingly collect personal data from children under the age of 20 without the consent of a parent or legal guardian, as required by the PDPA. If you believe a child has given us personal data, please contact us and we will delete it.
11 · Changes to this policy
We may update this policy as our business or the law changes. The date at the top of this page always shows when it was last revised. If a change materially affects how we use your personal data, we will take reasonable steps to tell you — by email where we hold your address, or by a notice on this site.
12 · How to contact us
For any privacy question, or to exercise any of the rights in section 7:
- Email: contact@sahatavesin.co.th
- Company: Sahatavesin Import Export Co., Ltd. (the Hawaiian Style brand)
- Registered address: 1046/4-5 Charoenkrung Road, Bangrak, Bangkok 10500, Thailand
- Company registration number: 0105538103021
Given the limited scale and nature of our processing, we have not appointed a Data Protection Officer. Privacy requests are handled directly by our team at the address above.
If you are not satisfied with our response, you may complain to the Personal Data Protection Committee (PDPC), the supervisory authority for personal data in Thailand.