SIAMAYA BUSINESS CUSTOMER PRIVACY NOTICE

Last updated: 7 March 2026

Siamaya Craft Co., Ltd. (“Siamaya,” “we,” “us,” or “our”) respects privacy and is committed to handling personal data responsibly. This Privacy Notice explains how we collect, use, disclose, retain, and otherwise process personal data relating to business customers, prospective wholesale customers, and their representatives in connection with our wholesale portal, website, communications, sales, and related business operations.

1. Who this notice applies to

This Privacy Notice applies to personal data relating to: individuals applying for or using a wholesale account; owners, directors, employees, representatives, buyers, finance contacts, and logistics contacts of business customers and prospective business customers; and other individuals whose personal data is provided to us in connection with wholesale sales or business communications.

2. Data controller

Siamaya Craft Co., Ltd.
12/8 Wua Lai Rd., Soi 3, T. Haiya, A. Mueang, Chiang Mai 50100, Thailand
Email: wholesale@siamaya.com
Phone: +66 [TO BE CONFIRMED]

3. Personal data we collect

We may collect the following categories of personal data: name; job title; company name; business address; billing address; delivery address; email address; phone number; LINE or other business contact information; account and portal data, including username, approval status, customer group, and account activity; order history, invoices, payment status, delivery records, returns, claims, and related communications; business verification data, such as company registration details, branch details, and tax information; technical data, such as IP address, browser type, device information, cookies, and website or portal usage information; and any other information provided in forms, emails, calls, chats, or other business communications.

4. Purposes of processing

We may use personal data for the following purposes: to evaluate and approve wholesale account applications; to create and manage wholesale accounts; to provide access to the wholesale portal; to process, confirm, fulfill, deliver, and administer orders; to issue invoices, receive payment, and manage credit or collection; to provide customer support and respond to inquiries, complaints, and claims; to manage the commercial relationship with business customers; to verify eligibility, prevent fraud, protect our systems, and manage risk; to manage product safety, recalls, complaints, or quality matters; to improve our products, services, website, and portal experience; to send service-related communications, operational notices, or policy updates; to conduct lawful marketing or business development communications where permitted; to comply with legal, tax, accounting, regulatory, and audit obligations; and to establish, exercise, defend, or resolve legal claims.

5. Legal bases

Depending on the circumstances, we may process personal data on one or more of the following legal bases under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”):

•           Contractual necessity: To take steps at your request before entering into a contract, or to perform a contract with you or your organization. This covers account registration, order processing, delivery, invoicing, payment, and related account management.

•           Legitimate interests: For our legitimate interests, including managing the business relationship, securing systems, preventing fraud, improving our services, and protecting product quality and brand integrity, provided that such interests are not overridden by your fundamental rights.

•           Legal obligation: To comply with legal or regulatory obligations, including tax, accounting, product safety, and regulatory reporting requirements.

•           Consent: Where required and where no other legal basis applies, with your consent. Where consent is relied upon, you may withdraw consent at any time, but this will not affect processing already carried out lawfully before withdrawal.

6. Disclosure of personal data

We may disclose personal data to: payment service providers; logistics, warehousing, and delivery providers; Shopify, BSS Commerce, hosting providers, and other IT or software service providers; professional advisers, including lawyers, accountants, auditors, and insurers; marketing, analytics, or communications service providers; regulators, courts, authorities, or other third parties where disclosure is required by law or necessary to protect legal rights; and affiliated or successor entities in connection with a restructuring, merger, sale, or transfer of business.

7. Cross-border transfers

Some service providers or digital platforms used by Siamaya, including Shopify and BSS Commerce, may process or store personal data outside Thailand. Where personal data is transferred outside Thailand, Siamaya will take reasonable steps to ensure that transferred personal data is protected in accordance with the PDPA, including by relying on adequate data protection standards in the destination country, standard contractual clauses, or other appropriate safeguards as required by applicable law.

8. Retention

We retain personal data only for as long as necessary for the purposes described in this Notice, including for the duration of the business relationship and for a reasonable period afterward for contract administration, recordkeeping, dispute resolution, tax, accounting, audit, and legal compliance.

9. Your rights

Subject to the PDPA and applicable law, you may have the right to: request access to personal data; request correction of inaccurate or incomplete personal data; request deletion or anonymization in certain circumstances; object to certain processing activities; request restriction of processing in certain circumstances; request data portability where applicable; withdraw consent where consent is the basis of processing; and lodge a complaint with the Personal Data Protection Committee or the relevant authority.

To exercise your rights, please contact us using the details in Section 2 above.

10. Cookies and similar technologies

Our website and wholesale portal may use cookies, analytics tools, and similar technologies to support functionality, security, performance, and usage analysis. Additional details may be provided in a separate cookie notice or website privacy settings.

11. Third-party services

Our website or portal may integrate third-party platforms or services. Their processing of personal data may be subject to their own terms and privacy policies.

12. Updates to this notice

We may update this Privacy Notice from time to time. The latest version will be made available on our website or wholesale portal with the updated effective date.