Privacy Policy

1. Who We Are

Thai Basil Regina(“we”, “our”, or “us”) operates this website and online ordering platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or place an order.

2. Information We Collect

We collect information you provide directly and information generated by your use of our platform.

Information you provide

• Account & identity — name, email address, password (stored as a one-way hash)
• Order details — delivery address, contact phone number, order contents, special instructions
• Payment — card number, expiry, and CVC are transmitted directly to our PCI-DSS–certified payment processor (Stripe). We store only a token and the last four digits.
• Communications — messages you send to our support team

Information collected automatically

• Usage data — pages viewed, clicks, session duration (anonymous unless you are signed in)
• Device & network data — IP address, browser type, operating system, referring URL
• Cookies — see Section 5 below

3. How We Use Your Information

We process your data on the following legal bases:

• Contract performance — to accept, process, and fulfil your orders; to send order confirmations and status updates
• Legitimate interests — to detect and prevent fraud; to analyse aggregate usage patterns and improve our platform
• Consent — to send promotional emails or SMS messages (you can withdraw consent at any time)
• Legal obligation — to comply with applicable tax, accounting, and regulatory requirements

4. Sharing Your Information

We do not sell, rent, or trade your personal data. We share it only as described below:

• Service providers — Stripe (payments), delivery partners, email/SMS notification services. Each provider is contractually bound to use your data solely to perform services on our behalf.
• Legal requirements — when required by law, court order, or governmental authority
• Business transfers — if we merge with or are acquired by another entity, your data may be transferred as part of that transaction; we will notify you beforehand

5. Cookies & Tracking Technologies

We use three categories of cookies:

• Strictly necessary — session authentication, shopping cart persistence. These cannot be disabled without breaking core functionality.
• Functional — language preference, location selection memory. Collected with your implied consent.
• Analytics — aggregate traffic measurement (e.g. page views). No cross-site tracking. You may opt out via your browser settings.

Most browsers allow you to refuse or delete cookies. Doing so may affect certain features of our website.

6. Data Retention

• Order history — retained for 7 years to comply with tax and accounting requirements
• Account data — retained while your account is active; deleted within 30 days of a verified deletion request
• Server logs — anonymised and deleted after 90 days

7. Security

We apply industry-standard safeguards: TLS encryption in transit, encrypted storage at rest, role-based access controls, and regular security reviews. No method of transmission over the internet is 100 % secure; we cannot guarantee absolute security but commit to notifying you promptly in the event of a breach affecting your data.

8. Your Rights

Depending on your jurisdiction you have some or all of the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your data (subject to legal retention obligations)
• Portability — receive your data in a structured, machine-readable format
• Objection / Restriction — object to or restrict certain types of processing
• Withdraw consent — unsubscribe from marketing communications at any time via the link in any email or by contacting us

To exercise any right, contact us at the details in Section 11. We will respond within 30 days.

9. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If we learn that we have done so, we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. For material changes we will provide notice via email or a prominent notice on our website at least 14 days before the change takes effect.

11. Contact Us

For privacy-related questions or to exercise your rights, please contact: