Privacy Policy
Grace Foundation, which runs Grace Bannasan (“we”), respects your privacy. This policy explains how we collect, use and look after your personal data when you use www.gracebannasan.com, in line with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA).
What we collect
When you place an order
- Your name, email address and phone number
- Your shipping address and billing address
- What you ordered, the amount paid, and your order history
- Limited payment details returned by Stripe: your card brand and last 4 digits, or that you paid by PromptPay. We never see or store your full card number.
When you sign in
- With Google: the name, email address and profile photo from your Google account
- With an email code: your email address
- Session details that keep your account secure: your IP address and browser type
When you sign up for news
- Your email address and the date you signed up (from the homepage form, or the “Email me with news and offers” box at checkout)
How we use it
- To process and deliver your order, including cancellations, returns and refunds
- To send you emails about your order, such as shipping updates, and to send sign-in codes
- To contact you if there’s a problem with your order
- To run your account and protect it from unauthorised use and fraud
- To send you news, only if you’ve signed up for it
- To keep accounting records and meet our legal obligations
Our legal bases are performing our sales contract with you, our legal obligations, our legitimate interest in keeping the site secure, and your consent for news emails.
Who we share it with
We don’t sell your personal data. We share only what’s needed with these service providers:
| Provider | What they do | What they receive |
|---|---|---|
| Stripe | Card and PromptPay payments | Payment details, email, amount |
| Sign in with Google (if you choose it) | Sign-in details | |
| Resend | Sends the site’s emails | Email address and email content |
| Cloudflare | Hosts the website and database | Everything stored by the site |
| Parcel carriers, such as Thailand Post | Deliver your parcel | Recipient name, address and phone |
Some of these providers may process data outside Thailand, and each protects it under its own privacy policy. We may also disclose data where the law requires it.
All payments are handled on Stripe’s systems, which are certified to PCI DSS Level 1, the highest level of card data security.
Cookies and browser storage
- A session cookie keeps you signed in. It’s needed for your account to work.
- Browser storage (localStorage) keeps your shopping cart on your own device only.
We don’t use advertising or third-party tracking cookies. Some pages include YouTube videos embedded in privacy-enhanced mode (youtube-nocookie.com). If you play one, YouTube handles it under Google’s privacy policy.
How long we keep it
We keep your account data for as long as you have an account with us, and order records for as long as Thai accounting and tax law requires. After that, we delete or anonymise them.
Your rights
Under the PDPA, you have the right to:
- Access your data and get a copy of it
- Have it corrected (you can update your name, phone and address yourself on your account page)
- Have it deleted, or have its use restricted
- Object to how we process it
- Have it transferred to you or another provider
- Withdraw your consent to news emails at any time
- Complain to Thailand’s Personal Data Protection Committee (PDPC)
To use any of these rights, contact us using the details below. We’ll reply within 30 days.
Changes to this policy
We may update this policy from time to time. The date of the latest update is shown at the top of this page.
Contact us
Grace Foundation (Grace Bannasan) Grace Bible School, 10 Moo 1, Talat Yai, Doi Saket, Chiang Mai 50220, Thailand Phone 092-258-1033 · Email gracebannasan@gmail.com