Privacy policy
Last updated: 1 September 2026
1. Data controller
TukTuk One Co., Ltd. (บริษัท ตุ๊กตุ๊กวัน จำกัด) ("the Company" or "we"), operator of the website www.kggoclub.com and the KG go and ShyOlive (Nitely) brands. Address: 20 Pradit Manutham Road, Plubpla, Wangthonglang, Bangkok 10310. Tax ID: 0105566154777. Personal data protection coordinator: team@tuktukone.com, tel. +66 86 999 0990
The Company respects your privacy and collects, uses and discloses personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
2. Data we collect
| Category | Examples |
|---|---|
| Identity and contact data | Full name, email, phone number, delivery address, tax invoice address, LINE ID |
| Account data | Username, encrypted password, account settings |
| Transaction data | Order history, products viewed, products in cart, amounts paid, payment method, delivery status, returns |
| Payment data | Card details are processed directly by the payment service provider. The Company does not store full card numbers in its systems. We keep only the last 4 digits, the card type and the payment result |
| Tax and tax invoice data | Name, address and tax identification number (when you request a tax invoice) |
| Communications data | Messages you send us via LINE, email, chat or social media; customer service records |
| Technical data | IP address, device and browser type, operating system, pages visited, visit duration, traffic source, cookies and similar identifiers |
| Content you submit | Reviews, photos, videos, comments |
Sensitive personal data: The Company does not intend to collect health data or other sensitive data. If you voluntarily give us health information (for example, telling us about allergies, underlying conditions, or your reasons for choosing a product via chat or a questionnaire), we will use that information solely to answer your questions and look after your safety, on the basis of your explicit consent only, under Section 26 of the Personal Data Protection Act B.E. 2562 (2019), and you may withdraw your consent at any time.
Minors: This website is not directed at persons under 20 years of age. If we discover that we have collected a minor's data without parental consent, we will delete that data promptly.
3. Sources of data
- Directly from you when you sign up, place an order, subscribe to news, contact us or take part in activities
- Automatically through cookies and tracking technologies when you use the website
- From third parties such as marketplace platforms, couriers, payment service providers, advertising platforms and warehouse service providers
4. Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Processing orders, delivering products, receiving payment, handling returns | Performance of a contract (Section 24(3)) |
| Creating and maintaining user accounts, providing customer service, answering enquiries | Performance of a contract / legitimate interests |
| Issuing tax invoices, keeping accounting records, complying with tax law and food law | Compliance with law (Section 24(6)) |
| Preventing fraud, monitoring system security | Legitimate interests (Section 24(5)) |
| Analysing website usage, improving products and user experience | Legitimate interests / consent (cookies) |
| Sending news, promotions and marketing by email, SMS or LINE | Consent (Section 19) — may be withdrawn at any time |
| Targeted advertising on Facebook, Instagram, TikTok, Google | Consent (marketing cookies) |
| Using your reviews and content in marketing | Consent / legitimate interests |
| Monitoring product safety and recalling products (if necessary) | Compliance with law / to prevent or suppress a danger to a person's life, body or health (Section 24(2)) |
5. Disclosure to third parties
The Company does not sell your personal data. We disclose data only to the extent necessary to:
- Shopify Inc. — online store platform provider
- Payment service providers — providers connected to Shopify for credit/debit cards and PromptPay
- Couriers — Thailand Post (EMS) and DHL eCommerce (recipient name, address, phone number)
- Warehouse and fulfillment service provider — MyCloud Fulfillment
- Marketing and analytics service providers — Google Analytics, Google Ads, Meta (Facebook/Instagram), TikTok, LINE Official Account and Shopify's email marketing system
- Professional advisers — auditors and lawyers, under confidentiality agreements
- Government authorities — when required by a lawful order, such as the Revenue Department, the Thai Food and Drug Administration (Thai FDA), the Office of the Consumer Protection Board (OCPB) or law enforcement agencies
6. Transfer of data outside Thailand
Some of the Company's service providers (such as Shopify, Google, Meta, TikTok) have servers located outside Thailand. The Company will ensure that appropriate safeguards are in place in accordance with Sections 28 and 29 of the PDPA, such as standard data protection contractual clauses, or transfers that are necessary to perform our contract with you.
7. Data retention period
| Type of data | Period |
|---|---|
| Order data and accounting documents | 5 years from the transaction date (Accounting Act B.E. 2543 (2000), Section 14, and Revenue Code, Section 87/3), extendable to no more than 7 years as prescribed by the Registrar, and may be kept longer only to the extent necessary to establish legal claims within the statute of limitations |
| User account data | For as long as the account remains active, and for a further 2 years after it becomes inactive |
| Marketing data | Until you withdraw consent, or after 2 years without interaction |
| Customer service contact records | 2 years from the most recent contact |
| Cookie data | According to the lifespan of each type of cookie (see clause 9) |
When these periods expire, the Company will delete, destroy or anonymise the data so that it can no longer identify any individual.
8. Rights of the data subject
Under the PDPA you have the following rights:
- The right to access and obtain a copy of your personal data (Section 30)
- The right to request data portability to another data controller (Section 31)
- The right to object to the collection, use or disclosure of data, in particular for direct marketing (Section 32)
- The right to request erasure or destruction of data (Section 33)
- The right to request restriction of use of data (Section 34)
- The right to request rectification so that data is accurate and up to date (Section 35)
- The right to withdraw consent at any time, without affecting processing lawfully carried out before withdrawal (Section 19)
- The right to lodge a complaint with the Expert Committee through the Office of the Personal Data Protection Committee (PDPC)
How to exercise your rights: Send your request to team@tuktukone.com, stating your name, the email address used for your orders, and the right you wish to exercise. The Company will act on your request within 30 days of receiving it. The Company may ask for identity verification documents for security purposes.
Unsubscribing from marketing: Click the "unsubscribe" link at the bottom of any email, block our LINE Official Account, or contact us at the email address above.
9. Cookies
The website uses the following cookies:
| Type | Purpose | Consent required |
|---|---|---|
| Strictly necessary cookies | Maintaining login status, shopping cart and security | No |
| Analytics cookies | Google Analytics — understanding user behaviour and improving the website | Yes |
| Marketing cookies | Meta Pixel, TikTok Pixel, Google Ads — showing relevant ads and measuring results | Yes |
| Functional cookies | Remembering your language, region and settings | Yes |
You can manage cookies through the cookie banner on the website or your browser settings. Disabling certain types of cookies may prevent the website from working fully.
10. Security measures
The Company uses appropriate technical and organisational measures, such as encryption of data in transit (SSL/TLS), limiting access rights to staff who need it, and using PCI-DSS compliant service providers for payments.
However, no system is completely secure. In the event of a personal data breach, the Company will notify the Office of the Personal Data Protection Committee (PDPC) without delay and within 72 hours of becoming aware of the breach, unless the breach poses no risk to the rights and freedoms of individuals. If the breach poses a high risk to your rights and freedoms, the Company will also notify you, together with remedial measures, without delay, in accordance with Section 37(4).
11. Changes to this policy
The Company may update this policy from time to time and will publish the latest version on the website with the date of update. If there are material changes, the Company will notify you in advance by email or by a notice on the website.
12. Contact us
TukTuk One Co., Ltd. (บริษัท ตุ๊กตุ๊กวัน จำกัด) — Personal Data Protection Coordinator. Email: team@tuktukone.com · Tel: +66 86 999 0990 · Address: 20 Pradit Manutham Road, Plubpla, Wangthonglang, Bangkok 10310
If you are not satisfied with how the Company handles your data, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) — pdpc.or.th
This policy is issued in both Thai and English. In the event of any conflict between the two, the Thai version shall prevail.
