Privacy notice

This notice explains how we collect, use and disclose the personal data you send through the contact and quote-request form on this website, under Thailand's Personal Data Protection Act B.E. 2562 (2019).

1. Who collects your data

YouYongPhan Co., Ltd. (บริษัท อยู่ยงภัณฑ์ จำกัด), which trades under the Crystalclear brand ("we"), is the data controller for the personal data you send through this form.

• Contact address: 29/63 Soi Sakae Ngam 30 Yaek 1, Samae Dam, Bang Khun Thian, Bangkok 10150
• Email: crystalclearstoreonline@gmail.com
• Phone: 063-313-3524
• Business hours: Mon - Sat, 9:00 AM - 5:00 PM

2. What we collect

• What you enter: customer type (company or individual), full name, company name and position (if you write on behalf of a company; position is optional), email, phone, products of interest and your message.
• What the system records: the site language you used, the date and time you sent the form, and your tick acknowledging this notice together with the version of the notice you were shown.
• Technical data recorded with the request for security and to investigate spam or misuse: your IP address, the approximate country from that address, and your browser and device type (User-Agent). This data also passes through Cloudflare's services.
• The name of the website or app that brought you to our site (for example Google or Facebook), or an earlier page of our site that you came from (if your browser reports it), to help our team understand where the request came from, and to count it in the statistics described in section 3.
• The product you were viewing, if you pressed "Get a Quote" on its product page (it is shown on the form and you can remove it before sending), to help our team reply about the right product, and to count it in the statistics described in section 3.
• Data created later: our emails with you, quotations, the follow-up status of your request and our team's internal notes, and, if you order, sales and tax documents.

Please do not put ID card numbers or sensitive personal data, such as health details or religious beliefs, in the "Tell us more" box.

3. Why we use it and our legal basis

Internal statistics: while your request is in our system, we count it in our statistics. We use only the month it was sent, the product groups you chose, the product whose "Get a Quote" button you pressed (if any), whether you wrote as a company or an individual, the site language, the channel that brought you, from a fixed list of main platforms (for example Google, Facebook, LINE or Shopee), and the status of the request (for example whether you ordered).

What we keep as statistics is only monthly totals by category. They contain no names, company names, email addresses, phone numbers, messages, IP addresses or countries. Websites other than the main platforms are counted together as "other websites", without recording their names. We do not use these statistics to identify or contact anyone, or to make any decision about anyone.

Seven days after each month ends, we save that month's totals, and we keep them after your request is deleted under section 7, to show long-term trends. You can object to your request being counted (sections 8 and 9); objecting does not affect our reply or your quotation. When you object or ask us to delete your data, we also take your request out of the totals, including months already saved, if your request is still in our system at that time. Once your request has been deleted under section 7, nothing in the remaining totals links back to it.

We do not use data from this form to send you advertising or marketing offers. If we ever want to, we will tell you and ask for your separate consent first.

4. What you must provide

Fields marked * are needed to reply and prepare a quotation; if they are left blank, the form cannot be sent, but you can still contact us by the email or phone in section 1. Other fields are optional. If you order, we need the details required for the sale and for tax documents under the law; without them we may not be able to complete the sale or issue those documents. Before sending, you must tick a box to confirm you have read and acknowledge this notice. That tick is an acknowledgement, not consent, and does not change the legal bases in section 3.

5. Who may receive your data

• Our staff who handle enquiries and sales, only as far as needed.
• Google (Gmail): receives the alert email for each new request and is used for our email conversation with you.
• Cloudflare: runs our website and stores its data, including your request (database and files), as our service provider; carries all traffic between your browser and our website, including what you enter in the form; and, when enabled, runs the Turnstile bot check, which examines signals from your browser and device. Cloudflare processes the technical data in section 2 to protect the site and may use some of it to improve its own services under its policy.
• If you order: our accountant or auditor, delivery companies, and government agencies where the law requires, such as the Revenue Department.
• Government agencies, courts or officials with legal authority, where the law requires or they lawfully order disclosure, and legal advisers where needed to establish, exercise or defend legal claims.

6. Transfers outside Thailand

Requests are stored in our website's system, which Cloudflare, Inc. (USA) provides to us. We have set it to store data in the Asia-Pacific region, but Cloudflare does not guarantee the country. Google and Cloudflare use data centres and networks in many countries, so they may store or process data outside Thailand. We send them only what is needed to run and protect the website, reply to you and act on your request, and we use each provider under its terms of service. You can ask us for more details about transfers outside Thailand through the channels in section 9.

7. How long we keep it

• Requests that do not lead to a sale: kept for 12 months from the last update to the request in our system (for example when our team changes its status after contacting you), then deleted from our system, including the related alert emails.
• Our emails with you and quotations, if you do not order: kept for 12 months from our last contact, then deleted.
• Customers who order: the request, contact details, our emails with you and quotations are kept for 5 years from your last order, then deleted. Accounting and tax documents are kept as long as the law requires (generally at least 5 years).
• IP address, country and browser details recorded with a request in our system: deleted automatically 90 days after the request is sent. The short browser and device summary in the alert email to our team is deleted with that email.
• Website activity logs, which may contain IP addresses and the addresses of pages opened: deleted automatically after 7 days.
• Other technical data processed by Cloudflare: under Cloudflare's policy.
• Monthly statistics totals (section 3), which contain no names or contact details: kept without a time limit, to show long-term trends.
• Restore history and backups: the database system we use keeps an automatic restore history for 30 days, so deleted data may still be recoverable from it until 30 days after the deletion, and data may remain in any backup copy made before the deletion until we delete that copy. We do not use such data during that time.

When a period ends we delete, destroy or anonymise the data, unless the law requires us to keep it or it is needed for legal claims.

8. Your rights

• Access your data and get a copy, or ask us to disclose how we obtained data about you that you did not consent to (s.30).
• Receive your data in a machine-readable format, or have it sent to another controller, for data we process to act on your request or to perform our contract with you (s.31).
• Object to processing based on legitimate interest, including your request being counted in our statistics (s.32).
• Have your data erased, destroyed or anonymised (s.33).
• Have the use of your data restricted (s.34).
• Have your data corrected, kept up to date and completed (ss.35–36).
• Withdraw consent, if we ever ask for your consent for something (s.19).
• Complain to the Office of the Personal Data Protection Committee at www.pdpc.or.th if you believe we have not followed the law (s.73).

Some rights have legal limits. For example, we may have to keep accounting and tax records for the legal period even if you ask us to delete them.

9. How to exercise your rights

• Email: crystalclearstoreonline@gmail.com
• Post: 29/63 Soi Sakae Ngam 30 Yaek 1, Samae Dam, Bang Khun Thian, Bangkok 10150
• In person: 29/63 Soi Sakae Ngam 30 Yaek 1, Samae Dam, Bang Khun Thian, Bangkok 10150, during business hours (Mon - Sat, 9:00 AM - 5:00 PM)

Please make your request in a signed letter or by email, giving your full name, which right you want to use and the details of your request, and how you want us to reply. If someone else makes the request for you, please attach your signed authorisation. To confirm your identity under the rules set by law, we may ask you, and your representative if any, to show an ID card, passport or other government-issued ID if you come in person, or to send a copy certified as a true copy if you write by post or email. We will act within the time limits set by law, and if we refuse a request we will tell you why. Copies sent electronically are free. Paper copies may carry a fee at cost, no higher than the rates set by the Personal Data Protection Committee (for example, up to THB 1 per A4 photocopied page, THB 3 per A4 computer-printed page and THB 5 per certification), and we will tell you the fee before or when you make your request.

10. If you give us someone else's details

If you enter another person's details, such as a colleague who will be the contact, please let them know about this notice. We will also give them the details of this notice when we first contact them.

11. Security

We limit access to staff who need it, our admin system can only be opened by authorised people after confirming a one-time code sent to their registered email, and we use organisational and technical security measures appropriate to the risk, as the law requires.

12. Changes to this notice

We may update this notice and will show the date of the last update at the top. If we want to use your data for a new purpose not described in this notice, we will tell you first and, where the law requires, ask for your consent.