Privacy policy

This policy explains what personal data brrr.studio, operated by D.L. MANUFACTURER CO., LTD., collects about you, what it is used for, how long it is kept, and what rights you have under Thailand's Personal Data Protection Act B.E. 2562 (2019).

1. Data controller

Seller

D.L. MANUFACTURER CO., LTD. บริษัท ดี.แอล.แมนูแฟคเจอเรอร์ จำกัด

Company registration no.

0105563156159

Registered address

9/8 ตรอกเพชรพลอย แขวงสี่พระยา เขตบางรัก กรุงเทพมหานคร 10500

Online shop

brrr.studio — https://brrrofficial.com

Contact

• Instagram @brrr.studio
• LINE @brrr.studio

For matters specifically about personal data, write to Brrradmin@gmail.com

2. What we collect, and what for

We collect only what the sale and the delivery actually need. Nothing is kept on the chance it might be useful later.

• Account details — email address, first and last name, and telephone number. Used to sign you in and to reach you about your orders.
• Delivery and billing addresses — recipient name, telephone number, address and postcode. Used to send your parcel and to hand those details to the courier.
• Order history — items, quantities, prices, discounts and delivery status. Used to fulfil the order, as an accounting record, and so you can look your own orders up.
• Proof of payment — the transfer reference and the slip image you upload, which may show an account name, part of an account number and an amount. Used to verify that the money actually arrived. We never store your credit or debit card number anywhere in the system.
• System records — the IP address and browser type of a sign-in, and of any change to important back-office data. Used for security and so that it is always possible to establish afterwards who did what.

3. Our lawful bases

• Performance of a contract — account details, delivery address, orders and payments. Without these we cannot accept your order or send you anything.
• Legal obligation — the accounting and tax records the law requires us to keep.
• Legitimate interests — system security records, and preventing fraudulent claims of payment.

4. Cookies

This site uses only the cookies it needs to work: the one that remembers you are signed in, the one that holds your basket, and the one that protects against cross-site request forgery. There are no advertising cookies, no third-party analytics, and no embedded social media tracking buttons. The site makes no requests to any external domain at all — even the webfonts are served from our own server.

5. Who else sees your data

We do not sell or trade your personal data with anyone. We disclose only what is necessary, and only to:

• The courier — recipient name, telephone number and address, to deliver the parcel.
• Our email provider — your email address and the content of order notifications.
• Our hosting provider — which is where the system and the database run.
• Government authorities — where we are under a legal duty to disclose.

6. How long we keep it

• Account details — for as long as the account is in use.
• Orders, invoices and proof of payment — at least 5 years, as accounting and tax law requires.
• System security records — for as long as they are needed to investigate afterwards.

Financial documents and audit records in this system are designed to be impossible to alter after the fact. A cancellation is recorded as a new, offsetting entry rather than by deleting the old one. That constraint exists for the integrity of the accounts, and it affects erasure requests under section 7.

7. Your rights

Under the Personal Data Protection Act you have the right to:

• Access the personal data we hold about you, and obtain a copy.
• Rectify data that is wrong or out of date — your name, telephone number and addresses you can change yourself, immediately, from your account page.
• Erase data, so far as that does not conflict with the retention duties in section 6.
• Restrict processing temporarily.
• Object to processing that relies on legitimate interests.
• Port the data you gave us, in a machine-readable form.
• Complain to the Personal Data Protection Committee if you believe we have handled your data improperly.

We answer a complete request within 30 days of receiving it. We may ask you to confirm your identity first, so that your data is never handed to someone else.

8. How your data is protected

• Every page of the site is encrypted with HTTPS.
• Passwords are stored in a form that cannot be reversed. Nobody at the shop can see your password.
• Payment slip images are kept outside the site's public files and every request for one is permission-checked. Only the owner of the order and staff whose job requires it can open a slip.
• A customer can see only their own orders, addresses and payments, and cannot query anyone else's.
• Staff access is limited to their role, and changes to important data are recorded every time.

9. Children's data

This site is not intended for anyone under 20 years of age ordering without a guardian's supervision. If we learn that we hold a minor's data without proper consent, we will delete it.

10. Changes to this policy

If this policy changes we always update the date at the top of the page to match the current version. Changes that significantly affect your rights will also be announced by email to your registered address.