Privacy and Cookie Policy
The Sixtynine Communication Co., Ltd. (the “Company”, “we” or “us”), operator of The Sixtynine Store website, respects your privacy. This policy explains how we collect, use, disclose and protect your personal data when you visit the website, place an order, create an account or contact us, and how we use cookies and similar storage in your browser.
This policy is prepared under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA) and takes account of data protection laws in other jurisdictions, such as the EU and UK GDPR, where those laws apply to our processing of your data. The Thai version of this policy is the authoritative text; this English version is a translation.
Effective from 17 September 2026.
1. Data controller
The data controller is The Sixtynine Communication Co., Ltd., 89/10 Khao Lam Road, Saen Suk, Mueang Chon Buri, Chon Buri 20130, Thailand. You can reach us about your personal data through the channels in section 16.
2. Personal data we collect
We collect only what we need to provide our service, either directly from you or as a result of your use of the website:
- Order and delivery data — your name, phone number, email address, delivery address, tax invoice details (if requested), the items ordered, the amount paid and the order status. You can order without creating an account.
- Account data — your email address, name, saved addresses and order history. Your password is handled by an industry-standard authentication provider; we can neither see nor store it. If you sign in with a third-party account (such as a Google account), we receive your name, email address and profile picture from that provider.
- Order-tracking data — the order number together with the phone number or email address used at checkout, to confirm that the order is yours.
- Correspondence — the messages and details you send us by phone, email, LINE or Facebook.
- Technical data — IP address, browser and device type and version, the pages requested, the date and time of access, and system error information, recorded by our servers for security and troubleshooting.
- Usage statistics — pages visited, clicks and traffic sources, collected through a third-party web analytics tool only if you choose “Accept” on the cookie notice.
We do not seek to collect sensitive personal data (such as race, religion, health or biometric data). Please do not send us information of that kind.
3. Payment data
We do not store your credit or debit card number. When you pay by card, your card details are sent from your browser directly to a licensed payment service provider, which converts them into a single-use token. Our servers receive only that token. In some cases the card security code (CVV) may pass through our server to the payment provider solely to complete the transaction; it is never stored or logged.
For PromptPay, the payment provider generates a QR code for your amount and reports the outcome back to us. We keep only the payment method, amount, result and transaction reference.
4. Purposes and legal bases for processing
- To perform our contract of sale — accepting and fulfilling orders, taking payment, delivering goods, sending status updates, and providing warranty, returns, refunds and after-sales service.
- To provide your account — authenticating you, keeping your addresses and order history, and linking an order placed as a guest to your account at your request (contract).
- To comply with the law — issuing tax invoices, keeping accounting records and responding to lawful requests from competent authorities (legal obligation).
- For our legitimate interests — keeping our systems secure, preventing fraud and misuse, detecting and fixing errors, and answering your enquiries, in ways you would reasonably expect.
- To analyse and improve the website — measuring usage through a web analytics tool on the basis of your consent, which you may withdraw at any time.
- For marketing — we will send you news or promotions only where you have given consent, and you may opt out at any time.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. If you do not provide data that is necessary for the contract, we may be unable to accept or deliver your order.
5. Disclosure and data processors
We do not sell your personal data, and we do not disclose it for cross-site behavioural advertising. We share it only as necessary with the following recipients, who are bound by data processing terms or duties of confidentiality:
- Authentication provider — registration and sign-in: email address, password in protected form, and profile data from any third-party account you sign in with.
- Web analytics provider — website usage statistics, active only with your consent.
- Error-monitoring provider — error details, the address of the page requested and technical request data, so that we can detect and fix problems quickly.
- Licensed payment service providers — the card details you enter, the amount, and the data needed to authorise the transaction and prevent fraud.
- Delivery carriers — the recipient's name, address and phone number, in order to deliver your goods.
- Cloud infrastructure and email providers — storing and processing data on our behalf.
- Professional advisers, auditors and public authorities — where the law requires, or to establish, exercise or defend legal claims.
- A successor to the business — in the event of a merger or transfer, on condition that the successor honours this policy in respect of your data.
6. International transfers
Some of our providers may process data on servers outside Thailand or outside the country where you live, where data protection standards may differ. In those cases we ensure that appropriate safeguards required by law are in place, such as Standard Contractual Clauses or the provider's data processing agreement. You may request further details, including the identity of the providers concerned, using the contact information in section 16.
7. Retention
We keep personal data only for as long as the purposes above require. Order records, tax invoices and accounting documents are kept for the period required by Thai tax and accounting law. Account data is kept for as long as you hold an account, and is deleted or anonymised within a reasonable period after you ask us to close it, except for data the law requires us to retain.
Technical logs and error data are kept for a limited period, as needed for security and troubleshooting. The lifetime of each cookie and browser storage item is set out in section 11.
8. Security
We apply appropriate technical and organisational measures, including HTTPS encryption in transit, access restricted to those who need it, card details sent directly to the payment provider, and rate limits on order look-ups. No system is completely secure, however. If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify the regulator and you as the law requires.
9. Your rights
Under the PDPA and other applicable data protection laws, you have the rights below. Contact us using the details in section 16. We will respond within 30 days of receiving your request, free of charge unless the request is manifestly unfounded or excessive, and we may first ask for information to verify your identity.
- To access your personal data and obtain a copy of it.
- To have inaccurate or incomplete data corrected and kept up to date.
- To have your data erased, destroyed or anonymised.
- To restrict our use of your data.
- To object to the collection, use or disclosure of your data, including for direct marketing.
- To receive your data, or have it transferred, in a machine-readable format.
- To withdraw consent at any time, without affecting processing lawfully carried out before the withdrawal.
- To lodge a complaint with Thailand's Office of the Personal Data Protection Committee (PDPC), or with the supervisory authority in the country where you live.
10. Visitors outside Thailand
This website primarily serves customers in Thailand. Wherever you are, however, we handle your data to the standard set out in this policy.
European Economic Area, United Kingdom and Switzerland — where the GDPR or an equivalent law applies, our legal bases are those in section 4 (contract, legal obligation, legitimate interests and consent). You have the rights in section 9, including the right to complain to your local data protection authority. Non-essential cookies run only after you have given consent.
United States, including California — we do not sell personal information, do not share it for cross-context behavioural advertising, and will not discriminate against you for exercising your rights. You may ask to know, access, correct or delete your personal information using the details in section 16.
Other jurisdictions — where the law of your country grants you additional rights, we will honour them as that law requires.
11. Cookies and browser storage
Cookies are small text files that a website saves in your browser. Besides cookies, our website uses your browser's own storage, which works in a similar way except that the data stays on your device and is not sent to a server automatically. This policy refers to both as “cookies”. We do not use advertising cookies.
Strictly necessary items — used without asking for consent, because without them the website could not provide the service you have requested:
- Language preference — remembers the language you chose — deleted when you close your browser.
- Consent preference — records whether you accepted or declined analytics cookies, so that we need not ask again — kept until you change your choice or clear your browser data.
- Shopping cart — the contents of your cart, with no personally identifying data — kept until you empty the cart or clear your browser data.
- Sign-in — the authentication tokens that keep you signed in and accompany requests for your account data — removed when you sign out.
- Latest order — your order number, the name and email address you entered, and a single-use token for linking the order to an account, so that the payment status page can work — removed when you close the tab. The token expires within 24 hours and is deleted as soon as it has been used.
Analytics cookies — active only if you choose “Accept”: a third-party web analytics tool sets cookies (lasting up to 2 years) to distinguish visitors and count usage. If you choose “Decline”, those scripts are never loaded.
Third-party services on specific steps — when you pay by card, a script from the payment service provider may be loaded to tokenise your card details and help prevent fraud. When you sign in with a third-party account, that provider's window uses its own cookies. The registered e-commerce trust badge in the footer is loaded from the server of the government agency that issues it, which receives your IP address and browser details as with any file request. These services are governed by each provider's own privacy policy.
12. Managing cookies and withdrawing consent
You can change your decision about analytics cookies at any time by pressing “Cookie settings” at the bottom of this page. If you withdraw consent, we delete the analytics cookies set through our website and stop loading the analytics scripts from your next page load.
You can also delete or block cookies and stored data through your browser settings. Please note that blocking the strictly necessary items may prevent the shopping cart, sign-in or the payment status page from working fully.
13. Minors
Our service is not directed at minors. If you have not reached the age of majority, please use the service only with the consent of your parent or guardian. If we learn that we have collected a minor's data without the consent the law requires, we will delete it promptly.
14. Links to other websites
Our website links to external services such as social media, messaging apps and government websites. This policy does not cover those sites; please read each service's own privacy policy before using it.
15. Changes to this policy
We may update this policy when our service, our providers or the law change. The latest version, with its effective date, will always be published on this page. Where a change is material, we will give clear notice on the website and will ask for fresh consent where the law requires it.
16. Contact us
If you have any question about this policy, or wish to exercise your rights, please contact The Sixtynine Communication Co., Ltd., Monday to Friday, 8:00–17:00 (Thailand time), through the channels on our Contact us page.
Changed your mind? Update your cookie choice any time.