Privacy policy
Last updated:
This policy explains what personal data this website collects, why, who receives it, how long we keep it and your rights under the Thai Personal Data Protection Act B.E. 2562 (PDPA). It is written from what our systems actually do.
1. Data controller
The data controller is HOMMAS Co., Ltd. · 56 Moo 1, Ban Dara Sub-district, Phichai District, Uttaradit 53220, Thailand
For privacy matters (access, correction, deletion or withdrawing consent) use the channels below and say that your message concerns personal data.
- [email protected]
- LINE: @095sahzq
2. What we collect, and when
Items about customer accounts and orders apply once online ordering opens on this website — nothing is collected before that.
| When you | We collect |
|---|---|
| Browse the site | Cookies the site needs to work (table in section 7) · anonymous visit statistics only if you accept analytics cookies · server logs (IP address, time, page requested) for system security |
| Contact us (LINE · email · phone) | Your message and the channel you used |
| Create or sign in to a customer account | Name · email · phone (if given) · password (stored as a one-way hash, never readable) · number of sign-in attempts per IP address (temporary, to prevent password guessing) |
| Place an order | Recipient name · delivery address · phone · email · items and amount · payment status and the payment provider’s reference · parcel tracking number |
| Request a full tax invoice | Taxpayer or company name · tax ID · branch · address (kept with that order) |
We do not collect your card or bank account details (the payment provider receives them directly) or your device location.
3. Why (legal basis)
- Taking, delivering and communicating about your orders — contract
- Issuing tax invoices and sales documents, and keeping records required by accounting and tax law — legal obligation
- System security (preventing password guessing · investigating abuse) and improving the site from aggregate statistics that identify no one — legitimate interest
- Analytics and marketing cookies — only with your consent, withdrawable at any time
4. Who receives data
| Recipient | We collect | Why |
|---|---|---|
| Payment service provider | Amount · order reference | Payments and refunds |
| Delivery carriers (via the iShip platform) | Recipient name, address and phone | Delivering parcels |
| Usage data via cookies (no name, email or phone) | Visit statistics and ad measurement — only with your consent | |
| YouTube | The video request (IP address) | Playing videos embedded in articles — when you press play or have accepted cookies (no-cookie mode, youtube-nocookie.com) |
| Public authorities | As required by law | — |
We do not sell your data. Google and YouTube operate servers outside Thailand and receive data only when you consent or press play.
5. How long we keep it
- Customer account: until you ask us to delete it
- Orders, payments and tax invoices: 5 years under accounting and tax law (deleting your account does not delete these)
- Sign-in attempt counts: at most 1 hour after the last attempt
- Server logs and daily backups: rotated and deleted automatically within about 14 days
- Cookies: as listed in section 7
6. Your rights
Access · a copy · correction · deletion · withdrawing consent · objection — send requests through the channels in section 1, saying that your request concerns personal data. We answer within 30 days.
If you believe we are not complying with the law, you may complain to the Personal Data Protection Committee (PDPC) of Thailand.
7. Cookies we use
| Name | Purpose | Category | Duration |
|---|---|---|---|
| adonis-session | Form security (session) | Necessary | 2 hours |
| XSRF-TOKEN | Protects forms against forgery (CSRF) | Necessary | 2 hours |
| hm-cust | Keeps you signed in to your customer account (only when signed in) | Necessary | 30 days |
| hm_consent | Remembers your cookie choice | Necessary | 180 days |
| _ga, _ga_* | Google Analytics 4 — distinguishes visitors without identifying them | Analytics | 2 years |
Your choice and withdrawing consent
Analytics and marketing cookies are used only after you agree. You can withdraw consent any time with the button below or "Cookie settings" at the bottom of the page. We never send your name, email or phone number to these tools.
8. Security
HTTPS connections · passwords stored as one-way hashes · sign-in attempts are rate-limited · staff permissions are separated by role and back-office edits are logged · daily backups
9. Changes to this policy
When we change this policy we show the date above and announce changes on the site if they affect your rights.