PRIVACY POLICY

Privacy Policydandycosmo.com

Last updated: 26 August 2026

1. Introduction

DANDY COSMO (“we”, “us”, “our”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use dandycosmo.com or any of our sales channels.This policy is designed to comply with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) and internationally recognised data protection standards.

2. Data Controller

DANDY COSMO Website: dandycosmo.com

3. Personal Data We Collect

3.1 Data you provide directlyFull nameDelivery addressPhone numberEmail addressAccount credentials (username / encrypted password)Payment information (processed via secure payment providers; we do not store raw card data)Purchase history

3.2 Data collected automaticallyIP addressBrowser type and deviceOperating systemPages visited and time on siteReferral sourceCookie and pixel data

3.3 Data from third-party platformsWhen you purchase through partner platforms (e.g. Shopee, Lazada, LINE Shopping, TikTok Shop), those platforms share the minimum necessary data with us to fulfil your order.

4. Purpose and Legal Basis for ProcessingPurposeLegal BasisProcessing orders and delivering goodsPerformance of a contractOrder-related communicationPerformance of a contractCustomer supportPerformance of a contractMarketing, promotions and newsletters Consent Analytics and service improvementLegitimate interestLegal and regulatory complianceLegal obligation

5. Disclosure of Personal DataWe may share your data with the following parties only to the extent necessary:Logistics partners — Kerry Express, Flash Express, J&T Express, Thailand Post — for deliveryPayment processors — Stripe, Omise, PromptPay — for payment processingE-commerce platforms — the marketplace through which you placed your orderAnalytics providers — Google Analytics, Meta Pixel — to improve user experienceGovernment authorities — when required by law or court orderWe do not sell, rent, or transfer your personal data to third parties for commercial purposes without your explicit consent.

6. Cookies and Tracking Technologies

6.1 Types of cookies we useEssential cookies — required for core site functions (login, shopping cart)Analytics cookies — track usage patterns to help us improve the siteMarketing cookies — serve relevant advertisements (Meta Pixel, Google Ads)Third-party cookies — Firebase for OTP-based identity verification

6.2 Managing cookiesYou can control cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

7. Data Retention

Data Type Retention Period Account data and purchase history Duration of account + 3 years after closure Payment records 5 years (accounting and tax obligations)Analytics cookiesUp to 26 monthsCustomer interaction records2 years

8. Your Rights

Under the PDPA, you have the following rights:RightDescriptionAccessRequest a copy of the personal data we hold about youRectificationCorrect inaccurate or incomplete dataErasureRequest deletion of your data (“right to be forgotten”)RestrictionTemporarily suspend processing of your dataData portabilityReceive your data in a portable digital formatObjectionObject to certain types of processingWithdraw consentWithdraw consent at any time without retroactive effectTo exercise your rights, please contact: [contact email]We will respond within 30 days of receiving your request.

9. Data Security

We implement appropriate technical and organisational security measures, including:SSL/TLS encryption for all data in transitRole-based access controlsRegular data backupsRoutine security updates and patches.

10. Third-Party

LinksOur website may contain links to external websites with their own privacy policies. We are not responsible for the privacy practices of those sites and encourage you to review their policies before use.

11. Changes to This Policy.

We may update this policy periodically to reflect changes in law or our operations. Material changes will be communicated via our website or by email at least 30 days in advance.

12. Contact Us

If you have questions about this policy or wish to exercise your data rights:

DANDY COSMO Email: info@dandycosmo.com.

LINE Official: @dandycosmo Website: dandycosmo.com