Last updated: 1 November 2026
This policy explains how ST Merchandise Co., Ltd. ("we", "us") collects, uses, discloses and protects the personal data you send us when you contact us through www.stmerchandise.co.th, and the data collected when you visit it, in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
1. Who we are
The data controller is:
ST Merchandise Co., Ltd.
1570 Sukhumvit Road, Samrong Nuea, Mueang Samut Prakan, Samut Prakan 10270, Thailand
Email: [email protected] · Phone: +66 2 749 3472
2. Personal data we collect
When you email or call us, for example from the contact or quotation pages: your name, company, email address, phone number and country, the content of your message, the details of your requirement (product category, quantity, material and description) and any drawings, photos or documents you attach. Please avoid including personal data in attachments that we do not need.
Technical data: our hosting provider records standard server logs (such as IP address, browser type and the pages requested) for the security and operation of the website. To choose the website's language, your browser may also check which country you are in (see section 6).
We do not knowingly collect sensitive personal data, and the website is not directed at children.
3. Why we use your data, and our legal basis
| Purpose | Legal basis under the PDPA |
|---|---|
| Replying to your enquiry and preparing a quotation at your request | Steps taken at your request before entering into a contract (Section 24(3)) |
| Following up on orders, deliveries and after-sales service | Performance of a contract (Section 24(3)) |
| Keeping the website secure and protecting it against abuse | Our legitimate interests (Section 24(5)) |
| Measuring website performance with anonymous, aggregated statistics | Our legitimate interests (Section 24(5)) |
| Keeping records required by Thai law, e.g. accounting and tax | Legal obligation (Section 24(6)) |
We do not sell your personal data, and we do not use it to send marketing messages without your separate consent.
4. Who we share your data with
Your data is handled by our sales, engineering and administration staff who need it to respond to you. We also use the following service providers, who process data on our behalf and under our instructions:
- Cloudflare, Inc.: website hosting and security, and anonymous website analytics.
- Our business email provider, which stores the emails and attachments we receive.
Some of these providers store data on servers outside Thailand, including in the United States. Where data is transferred abroad, we rely on the safeguards permitted by Sections 28 and 29 of the PDPA, such as the provider's data protection agreements and standard contractual protections.
We may also disclose data where required by law or by a competent authority.
5. How long we keep your data
- Enquiries and quotation requests, including any attachments, that do not lead to an order are kept for up to 2 years after our last contact with you.
- If your request leads to an order, related records are kept for as long as required by Thai accounting, tax and commercial law (generally up to 10 years).
When the retention period ends, we delete or anonymise the data.
6. Cookies and analytics
The website uses one functional cookie, locale, which is set only when you choose a language and remembers your choice for up to one year. It is not used for tracking.
When you open the website without a language in the address (for example www.stmerchandise.co.th), your browser asks Cloudflare which country you are connecting from, to show the website in Thai in Thailand and in English elsewhere. Only the country is used, the check happens in your browser, and the result is not stored.
We use Cloudflare Web Analytics to understand how the website is used and how fast it loads. It does not use cookies and reports only aggregated, anonymous statistics.
The contact page shows an embedded Google Maps map. When it loads, Google may receive your IP address and set its own cookies under the Google Privacy Policy.
The home page plays our company video through YouTube in privacy-enhanced mode (youtube-nocookie.com). When the video loads, Google may receive your IP address and store data in your browser under the Google Privacy Policy. If you prefer reduced motion, the video starts only when you press play.
7. Your rights
Under the PDPA you have the right to:
- withdraw consent where we rely on consent;
- request access to, and a copy of, your personal data;
- receive your data in a commonly used electronic format, or have it sent to another controller;
- object to the collection, use or disclosure of your data;
- request deletion, destruction or anonymisation of your data;
- request that we restrict the use of your data;
- request that your data is corrected and kept accurate, complete and up to date; and
- lodge a complaint with the Office of the Personal Data Protection Committee (PDPC).
To exercise any of these rights, email [email protected]. We will respond within 30 days and may need to verify your identity first.
8. Security
We use appropriate technical and organisational measures to protect your data, including encrypted (HTTPS) connections, restricted access to the enquiries we receive, and service providers with recognised security practices. No method of transmission over the internet is completely secure, but we work to protect your data against loss, misuse and unauthorised access.
9. Changes to this policy
We may update this policy from time to time. The latest version will always be published on this page with the date of the last update.
10. Contact us
If you have any questions about this policy or how we handle your personal data, please contact us at [email protected] or +66 2 749 3472.