Privacy Policy

1) Data We Collect

We collect the following personal data:

• Account details (when you register or edit your account): name, username, company, email, phone number, LINE ID, industry, and address (street, district, city, province, postal code, country). Your password is stored only as a one-way hash.
• Quotation requests (RFQs): the contact details you enter, the parts and quantities you request, your requirements and notes, and any images or PDF files you upload.
• Account activity records (whenever you use these features): signing in and out, registering, requesting or completing a password reset, adding or removing items in your cart, creating, re-sending, deleting or restoring a quotation, changes to your account details, and whether the related notification emails were delivered. Each record holds the date and time, your IP address, your browser type (user agent) and the page used.
• Sign-in security records: the email address entered, IP address, browser type, whether the attempt succeeded and, if not, why — for every sign-in attempt and password reset request.
• Usage analytics — only if you accept analytics on our cookie banner:
  • pages you view, including the page address (and so any search terms you enter in the product search) and the page you came from;
  • buttons and links you click, with their visible text; forms you submit (which form and where it goes — not what you entered); options you choose in drop-down lists and checkboxes; and how long you stay on each page;
  • a random identifier stored in your browser (see Cookies), your IP address, browser type and, if you are signed in, your account.
  We never record what you type into text fields, and email addresses that appear in page text are masked before they are stored. This data is also measured by Google Analytics on our behalf (see Third-Party Services).
• Communications: emails and messages you send us, and our replies.

We collect this data from you directly, from your browser and device when you use the website, and, for Google Analytics, through Google.

2) How We Use Personal Data

• Create and manage your account, and let you sign in.
• Receive, process and reply to your quotation requests, and send you and our staff emails about them.
• Keep the website and your account secure: detect and block repeated failed sign-ins, automated abuse and misuse, and investigate problems.
• Keep a record of actions on your account and quotations, so we can answer your questions, resolve disputes and support you.
• With your consent, understand how the website is used — which pages and parts people look for, where they get stuck — to improve its content, search and navigation.
• Comply with legal obligations and respond to lawful requests from authorities.

We do not use your data for automated decision-making that has legal or similarly significant effects on you, and we do not sell personal data.

3) Legal Bases

4) Sharing & Disclosure

Your data is accessed by our staff who handle quotations, customer service and the website, on a need-to-know basis. We share it only with:

• Service providers that process data on our behalf: our website and database hosting provider, Cloudflare (bot protection on sign-in, registration and password reset), and Google (analytics, only with your consent). See Third-Party Services.
• Matsui group companies, where needed to supply or quote the parts you asked for.
• Authorities and advisers, where required by law, or to establish, exercise or defend legal claims.
• A buyer or successor of our business, in a merger, acquisition or asset transfer, under equivalent protection.

5) International Transfers

Our website and database are hosted in Thailand. If you accept analytics, Google Analytics data is processed by Google, including in the United States; Cloudflare’s bot protection runs on its global network. These transfers rely on the providers’ data processing terms, including standard contractual clauses, as safeguards permitted under PDPA section 29.

6) Data Retention

7) Your Rights & Choices

Under the PDPA you have the right to:

• Access your personal data and obtain a copy, and ask how we obtained it where you did not give it to us;
• Data portability — receive the data you gave us in a commonly used electronic format, or have it sent to another controller;
• Object to processing based on our legitimate interests;
• Erasure — ask us to delete or anonymise your data;
• Restriction — ask us to suspend use of your data;
• Rectification — ask us to correct inaccurate or incomplete data (you can also edit your account details yourself after signing in);
• Withdraw consent at any time, without affecting processing before withdrawal. For analytics, open Cookie settings (also at the bottom of every page) and choose “Necessary only”; we then stop collecting usage analytics and remove the analytics identifiers and Google Analytics cookies from your browser;
• Complain to the Office of the Personal Data Protection Committee (PDPC) of Thailand.

To exercise these rights, contact us at servicemac@matsui.net. We may ask you to verify your identity first, and we will respond within 30 days. Some rights are limited by law, for example where we must keep records; if we cannot fully meet your request we will tell you why.

8) Cookies & Tracking

We use cookies and similar browser storage. Necessary ones are always on. Analytics ones are used only if you accept them on the cookie banner; you can change your choice at any time in Cookie settings. We do not use advertising or marketing cookies.

You can also block or delete cookies in your browser settings; blocking necessary cookies will stop sign-in and the cart from working.

We do not currently respond to “Do Not Track” browser signals; use Cookie settings instead.

9) Security

We protect personal data with technical and organisational measures, including encrypted connections (HTTPS), one-way hashing of passwords, limits on repeated sign-in attempts and bot protection, and access to customer data and logs restricted to authorised staff with individual accounts. No method of transmission or storage is fully secure, but we will notify the PDPC and, where required, affected individuals of a personal data breach as the PDPA requires.

10) Children’s Privacy

This website is for business customers and is not directed to persons under 20 (minors under Thai law). We do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, please contact us and we will delete it.

11) Third-Party Services

• Google Analytics (Google LLC) — usage measurement, only with your consent. Google’s privacy policy: policies.google.com/privacy.
• Cloudflare Turnstile (Cloudflare, Inc.) — bot protection on sign-in, registration and password reset. Cloudflare’s privacy policy: cloudflare.com/privacypolicy.
• Hosting provider (Thailand) — stores the website and its database.
• Email — account and quotation emails are sent from our own mail servers.

These providers process data on our behalf under contracts that require them to protect it and use it only for the services they provide to us.

12) Changes to This Policy

We may update this Policy. The version and “Last updated” date above show the current version. If we make material changes — for example, a new purpose or a new kind of data — we will show a notice on the website and, where the change needs your consent, ask for it again.

13) Contact Us

Data controller: Matsui (Asia) Co., Ltd.

• Privacy requests and Data Protection Officer: servicemac@matsui.net
• General enquiries: servicemac@matsui.net
• Phone: +66 86-091-6843
• Address: 300 Soi 5 C, Phraeksa, Samut Prakan 10280, Thailand

14) Jurisdiction-Specific Disclosures

Thailand (PDPA)

This Policy is written to meet the PDPA. Your rights are set out in section 7. You may contact our Data Protection Officer at the address in section 13, and you may lodge a complaint with the Office of the Personal Data Protection Committee (PDPC).

EEA/UK (GDPR)

If the GDPR applies to you, you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent, and you may lodge a complaint with your local supervisory authority. The legal bases in section 3 correspond to GDPR Article 6(1)(a), (b), (c) and (f).