Privacy Policy

1. Who is the data controller?
   Hong Thai Herbal is the data controller responsible for the processing of your personal data. If you have questions about this notice or our data practices, you can contact us at: hongthaiherbal@gmail.com

2. What personal data do we collect?
   We may collect the following categories of personal data:

• Identification data (e.g., name, title).

• Contact details (e.g., email address, phone number, postal address).

• Account information (e.g., username, credentials, preferences).

• Transaction and billing data (e.g., payment method, purchase history).

• Usage data (e.g., pages visited, features used, links clicked, IP address, device and browser information, cookies and similar technologies).

• Support communications (e.g., inquiries, feedback, and any attachments you send).

• Any other information you provide to us voluntarily.

3. How do we use the personal data we collect?
   We use personal data to:

• Provide, operate, and improve our services and website.

• Create and manage accounts, process transactions, and provide customer support.

• Personalize content and recommend features.

• Communicate with you about updates, security alerts, and marketing (where permitted).

• Monitor, prevent, and detect fraud or misuse.

• Comply with legal obligations and enforce our terms.

4. What is our legal basis for processing your personal data?
   Where applicable (e.g., under the GDPR), our legal bases include:

• Performance of a contract (to deliver requested services).

• Legitimate interests (e.g., to improve services, ensure security).

• Consent (for certain marketing or cookies where required).

• Compliance with legal obligations (e.g., tax, accounting, regulatory requests).

5. Who will process your data?
   Your data may be processed by:

• Our authorized employees and contractors bound by confidentiality.

• Trusted service providers acting as processors (e.g., hosting, analytics, customer support tools, payment processors) under written agreements.

• Professional advisers (e.g., lawyers, auditors) where necessary.

• Public authorities when required by law or valid legal process.

6. Data transfer outside the European Union
   If data is transferred outside your country or the European Economic Area (EEA), we will ensure appropriate safeguards (e.g., adequacy decisions, Standard Contractual Clauses, or equivalent mechanisms) so that your data remains protected.

7. How long do we keep your data?
   We retain personal data only as long as necessary for the purposes described in this notice, including to comply with legal, accounting, or reporting obligations. When no longer needed, we will delete or anonymize the data.

8. Your rights
   Subject to applicable law, you may have the right to:

• Access, correct, or delete your personal data.

• Object to or restrict certain processing.

• Port your data to another service.

• Withdraw consent at any time (without affecting prior processing).
  To exercise these rights, contact us at [email address]. You may also have the right to lodge a complaint with your local supervisory authority.

9. Security
   We implement technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, destruction, or alteration. Despite our efforts, no method of transmission or storage is completely secure.

10. Complaints
    If you have concerns about how we handle your data, please contact us first at hongthaiherbal@gmail.com so we can try to resolve the issue. You also have the right to file a complaint with your data protection authority.

11. Changes to this notice
    We may update this Privacy Policy from time to time. We will post the updated version on this page and indicate the “Last updated” date. Material changes may be communicated by additional notice.

12. Legislative references and useful links
    Depending on your location, relevant laws may include the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), or other local regulations. For more information, consult your local data protection authority.