Privacy Policy

Last updated: June 19, 2026

This Privacy Policy explains how ArtisanThai.com collects, processes, stores, and protects your personal data when you visit our website, make a purchase, or communicate with us. It is designed to comply with UK GDPR and the Data Protection Act 2018.

1. Data Controller

THAITEAS LTD is the data controller responsible for your personal data.

  • Company Number: 16870792
  • Email: contact@artisanthai.com
  • Information Commissioner's Office (ICO) Registration: Pending

2. Personal Data We Collect & Lawful Bases

We collect and process personal data only when we have a lawful basis to do so under the UK GDPR.

Purpose of ProcessingCategories of DataLawful Basis for Processing
Order Fulfilment: Processing payments, arranging shipping, and sending order updates.Name, email address, phone number, shipping address, billing address, order details.Performance of a Contract (processing is necessary to complete your order).
Customer Support: Responding to enquiries, resolving issues, and answering questions.Name, email address, message history, communication preferences.Legitimate Interests (to provide effective customer service).
Marketing: Sending newsletters, product updates, and promotional offers (via Omnisend).Name, email address, marketing consent preferences.Consent (you must opt-in to receive marketing communications).
Website Optimization: Analyzing usage patterns and ensuring secure website operation.IP address, browser type, device information, cookie identifiers.Legitimate Interests (to run and secure our site) and Consent (for non-essential cookies).

3. Data Retention Periods

We keep your personal data only for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.

  • Order Records & Financial Transactions: Retained for 6 years from the end of the financial year in which the transaction occurred, to comply with UK tax laws and Companies Act requirements.
  • Customer Support Enquiries: Retained for 2 years from the date of the last communication, to ensure continuity of service and resolve any follow-up questions.
  • Marketing Subscriptions: Retained until you withdraw your consent (unsubscribe). If you unsubscribe, we retain your email address on a suppression list indefinitely to ensure we do not send you further marketing.
  • Cookies & Analytics Logs: IP and analytics data are retained for up to 14 months before automatic deletion.

4. Your Rights (UK GDPR)

Under the UK GDPR, you have the following rights in relation to your personal data:

  • Right of Access: You can request a copy of the personal data we hold about you.
  • Right to Rectification: You can ask us to correct inaccurate or incomplete data.
  • Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data under certain conditions.
  • Right to Restrict or Object to Processing: You can object to us processing your data (e.g. for direct marketing) or ask us to restrict how we use it.
  • Right to Data Portability: You can request a copy of your data in a structured, machine-readable format.
  • Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at contact@artisanthai.com.

5. How to Complain

If you have any concerns about our use of your personal data, you can make a complaint to us at contact@artisanthai.com.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

  • ICO Website: https://ico.org.uk
  • ICO Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Payment providers

We use a specialist third-party payment processor to process card payments. Your card details are entered directly with the payment processor and are never stored on our servers. The processor handles your name, contact and payment information to complete your transaction and for fraud prevention. We previously used Mollie B.V. (Burgwal 47, 2611 GG Delft, Netherlands) to process payments; Mollie is retained for refunds and support on historical orders placed before our transition to our current payment processor. The identity of our current processor is available on request via contact@artisanthai.com.

Analytics and advertising

We use Google Analytics and Google Ads, provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), to understand how visitors use our website and to measure advertising performance. Google may process your IP address, device information and usage data, and may set analytics and advertising cookies. These cookies are managed through our cookie banner, where you can review or withdraw your consent at any time. Data processed by Google is transferred to the United States under the safeguards described below.

Session recording (Microsoft Clarity)

We use Microsoft Clarity, provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA), to understand how visitors use our pages. Clarity reconstructs a playback of your visit — the pages you view, clicks and taps, scrolling and mouse movement, and how you interact with elements on the page — together with your browser and device type, the page that referred you, and an approximate location derived from your IP address. This is commonly described as session recording or session replay.

Clarity is a non-essential statistics technology. Where your consent is required, the Clarity script is not loaded at all until you accept statistics cookies — so no session recording takes place and the Clarity cookies listed in our Cookie Policy (_clck, _clsk and _cltk) are never set. Once you accept, Clarity loads and we also pass your choice to Microsoft using their own consent signal. You can withdraw that consent at any time through the cookie banner or our Cookie Policy, which stops Clarity loading on the pages you view afterwards.

We use Clarity to diagnose usability problems and improve the site, not to identify individual customers, and we do not use it to capture payment card details — card data is entered into and handled by our payment provider. Microsoft acts as a processor for this data and may process it in the United States; see the Microsoft Privacy Statement.

Other service providers

We also use a small number of other service providers who may process limited personal data on our behalf: Tidio (live chat) processes chat transcripts and any personal data you volunteer in a chat conversation; FraudLabs Pro processes order, IP address and email data for fraud-risk screening; and TrackShip processes order and shipping data to power shipment tracking and delivery notifications.

International transfers

Some of our processors are located outside the United Kingdom — our card payment processor, Mollie B.V. (Netherlands, EU) (retained for historical order support), Omnisend (United States), and Google LLC (United States). Where personal data is transferred outside the UK we rely on UK adequacy regulations and/or the International Data Transfer Agreement (IDTA) or Standard Contractual Clauses as appropriate safeguards.