Skip to content
Junimaru

Legal

Privacy Policy

Last updated 7 November 2026

  1. 01Who we are

    Junimaru is a small home-based daifuku stall run by SUKANDA SINLAPARAYA (“we”, “us”). We are the data controller for the personal data described in this policy, under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

  2. 02What we collect

    • When you pre-order: your name, your Instagram handle and/or phone number, an optional note, the items you order, the market day and the total.
    • If you pay by PromptPay: the image of your transfer slip. A slip can show your bank, your account name and part of your account number.
    • Technical data: your IP address, used briefly to block spam and abuse of the order form, and the standard request logs kept by our hosting provider.
    • One cookie, jm_locale, which remembers your language. We do not use analytics, advertising or tracking cookies.

    We never see or store card or bank login details. PromptPay payments go straight from your bank to ours.

  3. 03Why we use it

    • To take, prepare and hand over your order, and to contact you about it. Legal basis: performing our contract with you.
    • To check that your payment arrived. Legal basis: performing our contract with you.
    • To prevent spam and abuse of the order form. Legal basis: our legitimate interests.
    • To keep basic sales records. Legal basis: legal obligations and our legitimate interests.

    We do not sell your data and we do not use it for marketing. We only contact you about your order.

  4. 04Who we share it with

    Only with service providers that run the website for us and may process data on our behalf:

    • Vercel: website hosting and private storage of payment slips.
    • Neon: the database that holds orders.
    • Resend and LINE: alerts that tell us a new order has arrived.

    Some of these providers store data outside Thailand (for example in the United States or Singapore). We use established providers with appropriate data protection safeguards, as the PDPA requires for transfers abroad. We may also disclose data when the law requires it.

  5. 05How long we keep it

    We keep order details and payment slips for up to 12 months after your pickup date, then delete them. IP addresses used to block abuse are kept only as long as needed for that purpose.

  6. 06How we protect it

    The site only runs over HTTPS. Payment slips are stored privately and only we can open them, through a password-protected dashboard. Your order page can only be reached through its own link, so please don’t post that link publicly.

  7. 07Your rights

    Under the PDPA you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Where we rely on your consent, you can withdraw it at any time.

    To make a request, message us on Instagram @junimaru.dfk or LINE @junimaru with your order code. We will reply within 30 days. If you are unhappy with how we handled your data, you can complain to the Office of the Personal Data Protection Committee (PDPC) at pdpc.or.th.

  8. 08Changes to this policy

    If we change this policy we will update this page and the date at the top.

Privacy Policy — Junimaru