Privacy
Privacy Policy
This policy explains what personal data Maris Jewelry collects through this website, why, who receives it, how long we keep it, and the rights you have under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).
Effective date: 5 November 2026
Who we are
The data controller for this website is Maris Jewelry, located at 302/9-10 Surawong Road, Si Phraya Subdistrict, Bang Rak District, Bangkok 10500, Thailand (302/9-10 ถ. สุรวงศ์ แขวงสี่พระยา เขตบางรัก กรุงเทพมหานคร 10500). You can contact us about your personal data at marisjewelryth@gmail.com or +66 95 879 2659. We have not appointed a Data Protection Officer; please send any privacy request or question to the contact details above.
Personal data we collect
Account: name, email address, optional phone number, and a password stored only as a one-way hash. Wishlist and bag: the pieces you save, kept in your account while you are signed in. Enquiries: the details you enter in the Contact, Request a Quote, and custom order forms, such as name, email, phone, company, message, budget, and ring size. Newsletter: your email address. Security: a one-way hash of your network address and a fingerprint of form submissions, used only to limit spam and repeated attempts. We do not intentionally collect sensitive personal data. Name, email, and a password are needed to create an account, and name and email are needed to answer an enquiry; without them we cannot provide those services. Everything else is optional.
Why we use your data and our legal basis
To run your account and saved items, we rely on performing our agreement with you. To answer enquiries, prepare quotes, and make custom orders, we rely on taking steps at your request before a contract and on performing it. To send marketing emails, we rely on your consent, which you may withdraw at any time. To protect the website from spam and abuse, we rely on our legitimate interest in keeping it secure. To meet tax, accounting, and other legal duties for confirmed orders, we rely on legal obligation.
Marketing emails
If you subscribe through the newsletter form or the 10% offer pop-up, we use your email address to send collection news and offers, and you tick a separate box or press the join button to say yes. Creating an account does not subscribe you: the sign-up form has its own unticked box for marketing emails, and the welcome email with the 10% offer is sent only if you tick it. Every marketing email contains an unsubscribe link, and you can also withdraw your consent by contacting us at the email address in the "Who we are" section. You can use the website and make enquiries without subscribing.
Cookies
We use strictly necessary cookies, which are always on: one keeps you signed in for up to 7 days and one remembers your cookie choice for 180 days. We also use your browser's local storage for your wishlist, bag, and pop-up preference. The website currently does not use analytics or advertising cookies. If we add them, they will be used only if you allow them in the cookie banner, and you can change your choice at any time from "Cookie settings" in the footer.
Who receives your data and transfers abroad
We do not sell your personal data. We share it with providers who process it for us: Supabase (database and file storage), Vercel (hosting), and Resend (email). At present we do not share personal data with any other recipients. Our database is hosted in Seoul, South Korea, and Vercel and Resend may process data in other countries. When we send personal data abroad, we do so only as sections 28 and 29 of the Personal Data Protection Act B.E. 2562 allow, relying on the data processing terms of these providers and appropriate security safeguards. We may also disclose data where the law requires it.
How long we keep data
We keep personal data only as long as needed for the purposes above. Account data: we keep it while your account is active and delete it if you have not signed in for 2 years, or immediately when you delete your account from the Account page. When the period ends we delete or anonymize the data.
How we protect data
Passwords are stored hashed, sign-in cookies are signed and hidden from page scripts, the database is reachable only from our servers, and sign-in and form attempts are rate limited. No system is completely secure; where the law requires, we will notify you and the authority of a data breach.
Your rights
Under the Personal Data Protection Act you may ask to access your personal data and receive a copy, receive it in a portable format, object to its use, ask us to delete or anonymize it, ask us to restrict its use, ask us to correct it, and withdraw consent at any time without affecting earlier lawful use. You can delete your account yourself from the Account page (we ask for your password to confirm); this removes your account, saved wishlist and bag, and email subscription, while enquiry, quote, order, and payment records we are required or entitled to keep are kept for the periods in this policy. For any other request, contact us at the email address in the "Who we are" section. We may need to confirm your identity first. We aim to reply within 30 days. If we refuse a request we will tell you why in writing. You may also complain to the Personal Data Protection Committee (pdpc.or.th).
Children and changes to this policy
The website is not directed at children, and we do not knowingly collect their personal data. We may update this policy; the effective date above shows the current version, and we will post a notice of material changes and ask for consent again where the law requires it.