Privacy Policy | Mahanakorn Tapioca

1. Data Controller

Mahanakorn Tapioca Co., Ltd.
Registration No. 0415565003420
789 Moo 1, Udon Thani 41240, Thailand
Email: tp.mahanakorn@gmail.com
Phone: +66 63-894-5351

We are the Data Controller for personal data collected through this website (mntapioca.com) and through our business correspondence. If you have questions about this policy or wish to exercise your rights, please contact us using the details above or see Section 11.

2. Personal Data We Collect

We collect personal data only when necessary for legitimate business purposes. The categories of data we may collect include:

Category	Data Elements	Source	Purpose
Contact & Identity	Full name, job title, company name, email address, phone number, mailing address	Inquiry form, email, business card	Responding to inquiries, issuing quotations, order fulfilment
Business Data	Company registration number, VAT/tax ID, billing address, shipping address, import licence number	Order forms, KYC verification	Issuing invoices, customs documentation, regulatory compliance
Transaction Data	Order details, product specifications, quantities, pricing, payment confirmation references	Orders, payment gateway callbacks	Order processing, accounting, dispute resolution
Payment Data	Last 4 digits of card, card type, transaction ID (full card numbers are never stored by us)	Payment gateways (Omise, 2C2P, Ksher)	Payment processing & fraud prevention
Technical Data	IP address, browser type, device type, OS, pages visited, time on site, referral URL	Google Analytics, server logs	Website analytics, security, performance improvement
Communications Data	Email correspondence, chat messages, inquiry content	Email, contact form	Customer support, maintaining records of agreements
Cookies & Tracking	Cookie identifiers, session tokens, analytics IDs	Your browser (see Section 10)	Website functionality, analytics

We do not intentionally collect sensitive personal data (e.g., health data, racial or ethnic origin, political opinions, religious beliefs, biometric data). If such data is inadvertently provided, it will be deleted promptly.

3. How We Use Your Personal Data

We use personal data for the following purposes:

Processing inquiries and quotations — to respond to your product or pricing requests.
Order fulfilment — to process, ship, and invoice orders for tapioca starch and related products.
Payment processing — to facilitate secure payment transactions through our payment partners.
KYC and regulatory compliance — to verify business identity as required by Thai law, financial regulators, and our payment gateway providers.
Customer support — to handle complaints, returns, and post-sale queries.
Legal obligations — to comply with Thai Revenue Code, Customs Department requirements, anti-money laundering regulations, and other applicable laws.
Business analytics — to understand how visitors use our website and to improve our content and services.
Marketing communications — only with your prior consent, to send product updates, price lists, or newsletters. You may withdraw consent at any time.

4. Legal Basis for Processing

Under the PDPA and GDPR, we rely on the following legal bases:

Processing Activity	Legal Basis (PDPA)	Legal Basis (GDPR)
Responding to pre-sale inquiries	Legitimate Interest / Contract	Art. 6(1)(b) — Pre-contractual steps
Order fulfilment and invoicing	Contract Performance	Art. 6(1)(b) — Contract performance
Payment processing	Contract Performance	Art. 6(1)(b) — Contract performance
KYC / AML verification	Legal Obligation	Art. 6(1)(c) — Legal obligation
Tax and customs records	Legal Obligation	Art. 6(1)(c) — Legal obligation
Website analytics (Google Analytics)	Consent	Art. 6(1)(a) — Consent
Marketing communications	Consent	Art. 6(1)(a) — Consent
Fraud prevention and security	Legitimate Interest	Art. 6(1)(f) — Legitimate interests

5. Third-Party Service Providers

We share personal data with trusted third-party service providers only as necessary to operate our business. All processors are contractually bound to protect your data and may not use it for their own purposes.

Provider	Service	Data Shared	Country	Privacy Policy
Omise (OmiseGO)	Online payment processing	Name, billing address, card data (tokenised), transaction amount	Thailand / Singapore	omise.co/privacy-policy
2C2P	Online payment processing	Name, billing address, card data (tokenised), transaction amount	Thailand / Singapore	2c2p.com/privacy-policy
Ksher	QR / mobile payment processing	Transaction ID, amount, merchant reference	Thailand	ksher.com/privacy-policy
Google Analytics	Website analytics	Anonymised IP address, device data, browsing behaviour on this site	USA (Standard Contractual Clauses apply)	policies.google.com/privacy
Google Fonts	Web typography	IP address (for font delivery)	USA (SCCs apply)	policies.google.com/privacy
Hostinger	Web hosting	Server logs (IP addresses, access times)	Lithuania / Singapore	hostinger.com/privacy-policy
Shipping & Logistics Partners	Freight forwarding, customs clearance	Consignee name, company, address, contact details for shipping documents	Varies by destination	As per individual carrier terms

We do not sell, rent, or trade your personal data to any third party for commercial marketing purposes.

6. International Data Transfers

As a Thai export company, we may transfer personal data to recipients in other countries as part of international trade operations. Where we transfer data outside of Thailand or the European Economic Area (EEA), we implement appropriate safeguards including:

Standard Contractual Clauses (SCCs) approved by the EU Commission, for transfers to our payment and analytics providers in the USA.
Adequacy decisions, where applicable.
Binding agreements with logistics partners and agents that include data protection obligations.

By submitting an order or inquiry involving shipment, you acknowledge that certain data (e.g., consignee information on bills of lading) must be shared with customs authorities and carriers in the destination country as required by law.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy, or as required by law. Our standard retention periods are:

Data Category	Retention Period	Reason
Customer order & invoice records	10 years	Thai Revenue Code — mandatory accounting retention
Customs & export documentation	5 years	Thai Customs Act
Payment transaction records	5 years	Payment gateway requirements & financial regulations
Inquiry / pre-sale correspondence	3 years	Legitimate interest — potential disputes
Website analytics data	26 months	Google Analytics default; consent-based
Marketing consent records	Until consent is withdrawn, then 1 year	PDPA compliance — proof of consent
Unsuccessful inquiries / rejected leads	1 year	Legitimate interest

When data is no longer required, it is securely deleted or anonymised.

8. Your Rights

Under the PDPA (Section 30–43) and GDPR (Articles 15–22), you have the following rights regarding your personal data:

Right of Access (PDPA §30 / GDPR Art. 15)

You may request a copy of the personal data we hold about you, along with information about how we process it.

Right to Rectification (PDPA §34 / GDPR Art. 16)

You may request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure (PDPA §33 / GDPR Art. 17)

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note: we may be required to retain certain data by law (e.g., tax records).

Right to Data Portability (PDPA §31 / GDPR Art. 20)

You may request your personal data in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.

Right to Object (PDPA §32 / GDPR Art. 21)

You may object to processing of your personal data for direct marketing purposes (at any time, without justification) or for processing based on legitimate interests.

Right to Restrict Processing (GDPR Art. 18)

You may request that we restrict the processing of your data in certain circumstances, such as when you contest its accuracy or have objected to processing.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

Right to Lodge a Complaint (PDPA §73 / GDPR Art. 77)

You have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand or your local data protection authority in the EU.

To exercise any of these rights, please submit a written request to tp.mahanakorn@gmail.com. We will respond within 30 days (PDPA) or 1 month (GDPR). We may need to verify your identity before processing the request. There is no fee for most requests unless they are manifestly unfounded, repetitive, or excessive.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

SSL/TLS encryption — all data transmitted between your browser and our server is encrypted.
PCI DSS compliance — payment card data is processed exclusively by our certified payment partners (Omise, 2C2P, Ksher). We never store full card numbers on our systems.
Access controls — data access is restricted to authorised personnel on a need-to-know basis.
Regular backups — business data is regularly backed up in encrypted form.
Staff training — employees handling personal data receive data protection training.

In the event of a personal data breach that is likely to result in high risk to your rights and freedoms, we will notify you without undue delay, in accordance with PDPA Section 37 and GDPR Article 33.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. We use the following types of cookies:

Cookie Type	Purpose	Basis	Duration
Strictly Necessary	Language preference (localStorage), session management	Legitimate interest	Session / Persistent
Analytics	Google Analytics — page views, session data, user behaviour	Consent	Up to 2 years
Payment	Payment gateway session cookies (Omise / 2C2P / Ksher) — set only during checkout	Contract performance	Session

You can control cookies through your browser settings. Note that disabling certain cookies may affect website functionality. To opt out of Google Analytics tracking, you may install the Google Analytics Opt-out Browser Add-on.

11. Contact & Data Protection Officer

For questions about this Privacy Policy, to exercise your rights, or to raise a concern, please contact us:

Data Protection Contact
Mahanakorn Tapioca Co., Ltd.
789 Moo 1, Udon Thani 41240, Thailand
Email: tp.mahanakorn@gmail.com
Phone: +66 63-894-5351
Business hours: Monday–Friday, 08:00–17:00 ICT (UTC+7)

If you are in the EU and are not satisfied with our response, you may contact your local supervisory authority. For Thailand, complaints may be submitted to the Personal Data Protection Committee (PDPC) via pdpc.or.th.

Policy Updates

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated via email to active customers or through a prominent notice on our website. We encourage you to review this policy periodically.