Privacy policy

1. Data controller

MADEE BEST COMPANY LIMITED, company registration no. 0385561000401, is the data controller. Contact details are in section 9.

2. What we collect, why, and on what legal basis

• When you order (via Facebook chat, phone or LINE): recipient name, Facebook account name, phone number, full delivery address (sub-district, district, province, postcode), items, options, quantities and prices, payment method, the transfer slip image if you pay by transfer, notes to our production team, how you reached us (for example which ad), delivery status, and the order’s edit history — to confirm, produce, deliver and install the order, collect cash on delivery, and provide after-sales care. Legal basis: performance of the sales contract (Sec. 24(3)) and statutory accounting records (Sec. 24(6)).
• When you message our Page after tapping one of our ads: Meta sends us a Page-scoped user ID, our Page ID, the ID of the ad you tapped, the referral type and the time; our system then asks Meta for your Facebook account name to match the chat to an order — so we know which ad brought you and can measure and improve our advertising. Legal basis: legitimate interest (Sec. 24(5)).
• Ad measurement: after an order is recorded we send Meta a “Purchase” event. The data that could match it to you — phone number, name, district, province, postcode and country — is one-way hashed (SHA-256) before sending; the order number, time, total, and product types, quantities and prices are sent as they are. We do not send your IP address or browser data. Purpose: to measure which ads lead to purchases. Legal basis: legitimate interest (Sec. 24(5)); you may object under section 7.
• When you visit madeebest.com: we use Google Analytics, which sets cookies to record usage such as pages viewed, device type, browser and approximate city-level location — to understand overall use and improve the site. We do not use it to identify you. You can block cookies in your browser settings or install the Google Analytics Opt-out add-on.
• Back-office users (staff): username, display name, email, role, account status, sign-in security data and an activity log — to keep sign-in secure and changes traceable. Password-reset emails are sent through the provider Resend.

3. If you do not provide data

Your name, phone number and delivery address are needed to deliver the goods; without them we cannot accept or deliver the order.

4. Who receives your data

• Our production team, delivery and installation team, and carriers — an order slip with the order number, product details, price and payment method, notes, recipient name, Facebook name, phone and address, only as needed to produce and deliver.
• Meta Platforms (Facebook, Messenger) — our chat and advertising provider, including the hashed measurement data in section 2.
• Google (Google Analytics) — website usage statistics.
• Service providers acting for us: the server provider hosting our order system; Cloudflare, which carries traffic for the website, back office and order system; Google Drive for backup copies of the database and slips (when off-server backup is enabled, about 30 days of backups are kept); and Resend for emails to staff — only as needed to provide their service to us.
• Government authorities where the law requires, such as the Revenue Department.

We do not sell your personal data to anyone.

5. Transfers outside Thailand

Meta and Google store data on servers abroad (for example the United States and Ireland), and Cloudflare routes traffic through its global network. Messenger conversations are necessary to take the order you request (Sec. 28(3)); other transfers are covered by the data-protection terms those providers apply to their business customers.

6. How long we keep it

• Orders, transfer slips and their edit history: at least 5 years from the order date, as accounting and tax law requires. They are not deleted automatically; once that period has passed you may ask us to delete or anonymise them under section 8.
• Ad-referral data Meta sends us (section 2): deleted automatically once older than 60 days, except the ad ID saved as an order’s source, which is kept with the order.
• Google Analytics statistics: per the retention setting in our Google Analytics account, at most 14 months.

7. Your rights

Under the PDPA (Sec. 30–36) you may: access and obtain a copy of your data; have it corrected; have it erased or anonymised; restrict its use; receive or transfer it; object to processing (including use for ad measurement); withdraw consent where we rely on consent; and complain to the Personal Data Protection Committee office (PDPC) at www.pdpc.or.th.

Send requests through section 9. We reply within 30 days and may first ask you to confirm your identity so your data is not disclosed to someone else.

8. How to request deletion

• Email [email protected] or message our Page with the subject “Delete my data”, giving the name and phone number you ordered with (or the Facebook name you messaged from).
• Our staff verify your identity, carry out the deletion within 30 days and confirm back — except order records that accounting and tax law require us to keep, which we retain only for that legal period and use for nothing else; backup copies that still contain the data expire on the backup cycle.
• Data held by Facebook itself (such as chat history in your account) can be managed in your Facebook account settings.

9. Contact

• Email: [email protected]
• Phone: +66 96 259 5423
• Facebook Page chat: facebook.com/madeebestmattress

10. Security and changes

Our order system is open only to staff with user accounts, and transfer slips are never public. If a breach puts you at risk we will notify the PDPC within 72 hours and tell you without undue delay. When we change this policy, the date at the top will show the latest revision.