PRIVACY POLICY

Last updated: June 2026

This Privacy Policy is prepared in compliance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA) of Thailand. GraffCraft Studio is the data controller for personal data collected through this website.

1. DATA CONTROLLER

GraffCraft Studio, registered in Thailand, is responsible for processing your personal data.

2. DATA WE COLLECT

We may collect the following personal data when you use our website or place an order:

Name, surname, email address, phone number
Delivery address and billing information
Order history and transaction data

3. PURPOSES & LEGAL BASIS

We process your data for the following purposes:

Contract performance: processing and fulfilling your orders
Legitimate interest: fraud prevention, website security, and analytics
Legal obligation: compliance with Thai tax and accounting laws

4. DATA RETENTION

Order records are retained for 5 years as required by Thai Revenue Code. Marketing data is retained until you withdraw consent. You may request deletion of other personal data at any time.

5. YOUR RIGHTS UNDER PDPA

You have the right to: access your personal data, correct inaccurate data, request deletion, restrict processing, object to processing, and data portability. To exercise your rights, contact us by the dedicated page.

6. DISCLOSURE TO THIRD PARTIES

We share your data only with payment processors and logistics partners necessary to fulfil your order, and only to the extent required. We do not sell your personal data.

7. INTERNATIONAL TRANSFERS

Some service providers may be located outside Thailand. We ensure adequate data protection safeguards are in place in accordance with PDPA requirements.

8. CONTACT & COMPLAINTS

If you believe we have not complied with PDPA, you may lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.