Privacy Policy

1. Personal data we collect

Identity & contact data: your name, email address, telephone number and delivery address(es).

Order data: items ordered, order history, pickup/delivery method, delivery instructions, branch (store) and the price you paid.

Account data: your login credentials (managed securely by our authentication provider), saved addresses and saved favourites.

Payment data: payments are processed by our payment provider (Stripe). We do not collect or store your full card number — we receive only a confirmation of payment and limited transaction details.

Location data: when you enter a delivery address we use a mapping service to calculate distance and delivery fees; we do not continuously track your location.

Technical & usage data: IP address, device and browser type, and basic analytics about how you use the site.

Notification data: if you enable alerts (for staff/picker devices), we store the push-notification subscription token for that device.

2. How we collect your data

Directly from you — when you create an account, place an order, enter contact or address details, contact us, or enable notifications.

Automatically — through cookies and similar technologies when you use the website (see section 7).

From third parties — for example our payment provider confirms the result of a transaction.

3. Purposes and legal bases for processing

To create and manage your account and process and deliver your orders (necessary for performance of the contract with you).

To take payment and prevent fraud (performance of contract and our legitimate interest).

To contact you about your order, send order confirmations and service messages (performance of contract).

To provide customer support and handle requests, complaints and refunds (performance of contract and legitimate interest).

To improve and secure the website and our services (legitimate interest).

To send you marketing or promotional messages — only where you have given consent, which you may withdraw at any time.

To comply with legal, tax and accounting obligations under Thai law (legal obligation).

4. Disclosure of your data

We do not sell your personal data. We share it only with service providers who help us run the service, and only as needed:

Payment processing — Stripe.

Hosting and database — our cloud hosting and database providers.

Email delivery — our transactional email provider, to send order confirmations.

Maps and address lookup — our mapping/geocoding provider, to calculate delivery.

Order and kitchen management (ERP) — to prepare and fulfil your order at the relevant branch.

Delivery partners — the courier handling your delivery receives the details needed to deliver to you.

We may also disclose data where required by law, court order, or a lawful request by a competent authority, or to protect our rights.

5. International data transfers

Some of our service providers may store or process data on servers located outside Thailand. Where we transfer personal data abroad, we take steps to ensure an adequate level of protection and appropriate safeguards, as required by the PDPA.

6. Cookies and similar technologies

We use cookies and local storage that are strictly necessary to operate the site — for example to keep you logged in, remember your cart and your chosen branch and language.

We may also use limited analytics to understand and improve how the site is used. You can control cookies through your browser settings; disabling necessary cookies may affect how the site works.

7. Data retention

We keep your personal data only for as long as necessary for the purposes described above — including to provide the service, maintain your order history, and meet legal, tax and accounting requirements.

When data is no longer needed, we will delete, anonymise or de-identify it. You may also ask us to delete your account (see your rights below).

8. Data security

We apply appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, alteration or disclosure — including encryption in transit (HTTPS), access controls, and using reputable providers for payments and hosting.

No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.

9. Your rights under the PDPA

Subject to the conditions of the PDPA, you have the right to: access and obtain a copy of your personal data; request correction of inaccurate data; request erasure or de-identification; restrict or object to certain processing; request data portability; and withdraw consent at any time (without affecting processing already carried out).

You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand if you believe your rights have been infringed.

To exercise any of these rights, contact us at info@kosher-place.com. We may need to verify your identity before acting on your request.

10. Children's privacy

Our service is intended for customers who can lawfully enter into a contract. We do not knowingly collect personal data from children without appropriate parental consent. If you believe a child has provided us data without consent, please contact us and we will take appropriate action.

11. Marketing and notifications

We will only send you marketing messages where you have consented. Every marketing message will let you opt out, and you can withdraw consent at any time by contacting us. Service messages relating to your orders are not marketing and will still be sent.

12. Changes to this policy

We may update this Privacy Policy from time to time. The current version, with its date, will always be available on this page. Significant changes will be highlighted where appropriate.

13. Contact us

If you have any questions, requests or complaints about this Privacy Policy or your personal data, please contact us:

The Kosher Place (J Cafe), Phuket, Thailand.

Email: info@kosher-place.com