1. Data Controller
Ving Thailand Co., Ltd. acts as the Data Controller for personal data collected through the Service. Our contact details are:
Ving Thailand Co., Ltd.
Address: [Company Registered Address], Thailand
Email: privacy@vingthailand.com
Website: https://vingthailand.com
2. Data Protection Officer
We have designated a Data Protection Officer (“DPO”) to oversee our compliance with applicable data-protection laws and to respond to inquiries from data subjects. You may contact our DPO at:
Name: [Data Protection Officer Name — to be appointed]
Email: privacy@vingthailand.com
Address: [Company Registered Address], Thailand
Until a dedicated DPO is formally appointed, all data-protection inquiries should be directed to privacy@vingthailand.com.
3. Personal Data We Collect
We collect the following categories of personal data in connection with the Service:
3.1 Account and Contact Information
Name, business name, email address, phone number, job title, billing address, country of operation, and login credentials for the Service.
3.2 TikTok Shop Seller Data
When you authorise the Service to connect to your TikTok Shop seller account, we receive and process data including: seller profile, shop name, shop identifier, authorised region, product listings, product images and descriptions, stock levels, orders, buyer names and shipping addresses (as provided by TikTok Shop), order amounts, shipment and tracking information, returns and refunds, financial settlements, and seller performance metrics.
3.3 Authorisation Tokens
Access tokens, refresh tokens, and related authorisation metadata issued by TikTok Shop. These are stored securely and used solely to make API requests on your behalf. We do not store your TikTok Shop password.
3.4 Usage and Technical Data
IP address, device type, operating system, browser type, referring pages, pages visited, features used, time and date of access, session identifiers, and similar log information generated through your interaction with the Service.
3.5 Support and Communications
Correspondence, support tickets, feedback, and any other information you provide when you contact us.
We generally do not collect sensitive personal data as defined under Section 26 of the PDPA (such as racial or ethnic origin, religious beliefs, health data, biometric data, or criminal records). If the collection of such data becomes necessary, we will request your explicit consent in advance.
4. Legal Bases for Processing
Under the PDPA, we rely on one or more of the following legal bases to process your personal data:
(a) Contractual necessity — to provide the Service you have signed up for and to perform our obligations under the Terms of Service.
(b) Legitimate interests — to operate, secure, improve, and promote the Service, prevent fraud, and defend our legal rights, provided such interests are not overridden by your rights and freedoms.
(c) Legal obligation — to comply with tax, accounting, and other legal or regulatory requirements applicable to us.
(d) Consent — where required by law, such as for certain marketing communications or the processing of sensitive personal data. You may withdraw consent at any time without affecting the lawfulness of prior processing.
5. How We Use Personal Data
We use personal data for the following purposes:
(a) to create and administer your account, verify your identity, and authenticate your access to the Service;
(b) to synchronise product, order, inventory, and fulfilment data between TikTok Shop and your ERP, accounting, or operational systems;
(c) to make API requests to TikTok Shop on your behalf using the authorisation tokens you have provided;
(d) to provide customer support, respond to inquiries, and resolve technical issues;
(e) to monitor, maintain, secure, and improve the Service, including debugging, analytics, and performance monitoring;
(f) to detect, prevent, and investigate fraud, abuse, security incidents, or violations of our Terms of Service;
(g) to send service-related notifications, updates, and administrative messages;
(h) to comply with legal and regulatory obligations, including tax, accounting, and lawful requests from public authorities; and
(i) to enforce our agreements and protect our legal rights.
6. Disclosure of Personal Data
We do not sell your personal data. We may disclose personal data only in the following circumstances:
6.1 Service Providers
We share personal data with trusted third-party service providers who perform services on our behalf, such as cloud hosting, data storage, email delivery, analytics, and customer support. These providers are bound by contractual obligations to protect personal data and to use it only for the purposes we authorise.
6.2 TikTok Shop
When you use features of the Service that interact with TikTok Shop, we transmit requests and data to TikTok Shop through official APIs. Your use of TikTok Shop is also governed by TikTok’s own terms and privacy policies.
6.3 Legal and Regulatory Disclosure
We may disclose personal data when required to do so by law, court order, or other lawful request from a competent authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, to investigate fraud, or to respond to a government request.
6.4 Business Transfers
If we are involved in a merger, acquisition, corporate reorganisation, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and data-protection safeguards. We will notify you of any such transfer where required by law.
7. Data Storage and International Transfers
Personal data processed through the Service is stored on servers located in Thailand. We do not transfer personal data outside Thailand except where strictly necessary to provide the Service (for example, API calls to TikTok Shop global endpoints). Where any such transfer occurs, we will ensure that appropriate safeguards are in place in accordance with the PDPA, including, where applicable, obtaining your consent or relying on another lawful transfer mechanism.
8. Data Retention
We retain personal data for as long as your account with the Service is active and for a reasonable period thereafter to fulfil the purposes described in this Privacy Policy, including providing ongoing support, resolving disputes, enforcing our agreements, and complying with legal, tax, and accounting obligations.
Specifically:
(a) Account data is retained for the duration of your account.
(b) TikTok Shop authorisation tokens are deleted promptly (typically within thirty (30) days) after you revoke authorisation or disconnect your shop.
(c) Synchronised business data (orders, products, inventory, etc.) is retained for up to ninety (90) days after account closure to allow for reactivation and dispute resolution, after which it is deleted or anonymised unless a longer retention period is required by law.
(d) System and security logs are retained for up to twelve (12) months for security, audit, and troubleshooting purposes.
(e) Financial and tax records are retained for the period required by Thai law (typically five (5) to ten (10) years).
9. Data Security
We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include: encryption of data in transit using TLS, encryption of sensitive fields at rest, access controls based on the principle of least privilege, secure credential storage (including hashed passwords and encrypted authorisation tokens), network firewalls, regular security assessments, and staff training on data protection.
Despite our efforts, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but will notify affected data subjects and the relevant authority of any personal data breach in accordance with the PDPA.
10. Your Rights Under the PDPA
Subject to applicable law and certain conditions, you have the following rights in relation to your personal data:
(a) Right of access — to request a copy of the personal data we hold about you.
(b) Right to rectification — to request correction of inaccurate or incomplete data.
(c) Right to erasure — to request deletion of your personal data in certain circumstances.
(d) Right to restrict processing — to request that we suspend or limit our processing of your data.
(e) Right to data portability — to receive your personal data in a structured, commonly used, and machine-readable format.
(f) Right to object — to object to processing based on legitimate interests or for direct-marketing purposes.
(g) Right to withdraw consent — to withdraw any consent you have previously given, at any time, without affecting the lawfulness of prior processing.
(h) Right to lodge a complaint — to file a complaint with the Office of the Personal Data Protection Committee of Thailand if you believe your rights have been violated.
To exercise any of these rights, please contact us at privacy@vingthailand.com. We will respond to your request within thirty (30) days or the period required by applicable law. We may need to verify your identity before processing your request.
11. Cookies and Similar Technologies
Our website and web application may use cookies, local storage, and similar technologies to operate essential features, remember your preferences, authenticate your session, analyse usage, and improve the Service. You may control or disable cookies through your browser settings; however, disabling essential cookies may affect the functionality of the Service.
12. Children’s Privacy
The Service is intended for use by businesses and their authorised personnel and is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
13. Third-Party Links and Services
The Service may contain links to or integrations with third-party services (including TikTok Shop). This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party service you use.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the Service. When we make material changes, we will notify you by posting the updated policy at https://vingthailand.com/privacy-policy and updating the “Effective Date” above, or by other reasonable means. Your continued use of the Service after the effective date of the revised Privacy Policy constitutes acceptance of the changes.