Privacy Policy

This Privacy Policy (“Policy”) explains how KENS Apothecary Co., Ltd. (“KENS Apothecary”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards your personal data when you access or make purchases through our website at kensapothecary.th.co (“Website”).

We process your personal data in strict compliance with the Thailand Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). Please read this Policy carefully to understand how we handle your personal data.

1. Collection of Personal Data

1.1 We may collect personal data directly from you when you:

• Create an account or make a purchase;
• Subscribe to our newsletters, loyalty programs, or marketing communications;
• Participate in surveys, promotions, scratch-cards, or events;
• Contact our customer service team via email, phone, or LINE Official Account; or
• Use any interactive features of our Website.

1.2 The personal data collected may include, but is not limited to:

• Identity Data: Name, surname, age, date of birth, gender;
• Contact Data: Contact number, email address, billing address, shipping address, and LINE ID;
• Financial & Transaction Data: Purchase history, preferences, and payment details (processed securely via third-party payment gateways; we do not store full credit card numbers); and
• Technical & Usage Data: IP address, browser type, cookies, device information, and how you interact with our Website.

2. Legal Bases and Purposes for Processing Personal Data

Under the PDPA, we must have a lawful basis to process your data. We rely on the following bases:

• Contractual Necessity: To process, fulfill, ship, and deliver your orders, and provide customer support related to your purchases.
• Consent: To send you direct marketing communications, personalized promotional offers, newsletters, and updates, or to deploy non-essential tracking cookies. You may withdraw this consent at any time.
• Legitimate Interests: To improve our Website functionality, optimize our product offerings, conduct internal data analysis, protect our business against fraud, and maintain platform security.
• Legal Obligation: To comply with applicable Thai tax laws (e.g., issuing tax invoices), consumer protection laws, and lawful orders from regulatory or law enforcement authorities.

3. Disclosure and Cross-Border Transfer of Personal Data

3.1 We do not sell, rent, or trade your personal data to third parties. 3.2 We may disclose your personal data to:

• Service Providers: Third parties engaged for payment processing, warehousing, domestic delivery and logistics providers, IT infrastructure, website hosting, and marketing automation tools.
• Affiliated Companies: Our parent company, KENS Avenue Sdn. Bhd. in Malaysia, for centralized data management and business administration.
• Legal Authorities: Regulatory bodies, law enforcement, or government agencies (such as the Revenue Department or the Office of the Consumer Protection Board) where legally required.

3.3 Cross-Border Data Transfers: Because our affiliate entities and certain cloud servers are located in Malaysia and other countries, your personal data may be transferred outside of Thailand. We ensure that any international recipient provides a standard of data protection equivalent to the Thai PDPA, or we will apply strict contractual clauses (such as Standard Contractual Clauses) to protect your data during transfer.

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, misuse, or disclosure. Access to your personal data is restricted to employees and authorized third-party service providers who strictly require it to perform their duties, and who are bound by confidentiality obligations.

5. Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, tax, or reporting requirements. Generally, customer account data is retained for the duration of your active relationship with us, plus an additional period of up to 10 years following your last transaction to comply with Thai statutory limitation periods.

6. Your Rights under the Thai PDPA

As a data subject in Thailand, you possess the following statutory rights under the PDPA:

• Right to Access: Request access to and obtain a copy of your personal data held by us.
• Right to Data Portability: Request that we transfer your personal data directly to another data controller in a machine-readable format, where technically feasible.
• Right to Object: Object to the processing of your personal data at any time, particularly for direct marketing purposes.
• Right to Erasure/Deletion: Request that we delete, destroy, or de-identify your personal data when it is no longer needed or if you withdraw your consent.
• Right to Restrict Processing: Request that we temporarily suspend the use of your personal data (e.g., while validating its accuracy).
• Right to Rectification: Request that we correct or update any inaccurate, incomplete, or misleading personal data.
• Right to Withdraw Consent: Withdraw your consent to data processing that relies on consent at any time. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint: Lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand if you believe we have violated the PDPA.

7. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies to enhance your browsing experience, analyze site traffic, and personalize content/ads. Essential cookies are automatically enabled to make the site work. Non-essential cookies (such as marketing and tracking cookies) will only be deployed if you give explicit consent through our website's cookie consent banner. You may change your cookie settings at any time through your browser or the Website settings.

8. Links to Third-Party Sites

Our Website may contain links to external third-party websites or applications (such as social media platforms). We are not responsible for the privacy practices, tracking technologies, or content of those external parties. We recommend reading their respective privacy policies before providing them with personal data.

9. Amendments to this Policy

We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our operational practices or legal requirements. Any material updates will be clearly announced on our Website along with the "Last Updated" date at the top of this Policy.

10. Contact Us

If you wish to exercise any of your data protection rights, or if you have any questions or complaints regarding this Policy, please contact our Customer Service Team:

• Email: hello@kensapothecary.com.my
• Address: Suite No. 1815, Park Ventures Ecoplex, Level 18, No.57, Wireless Road, Lumpini, Pathumwan, Bangkok 10330