What we collect
When you order, Kesiya Co., Ltd. keeps only what the service needs: your name, phone number, delivery address, e-mail (if given), tax details (if you request a tax invoice) and your order history. Members also have their points, coupons, chosen language and — only if they add it — their birth date on the account.
What we use it for
- Processing your order, payment and delivery
- Issuing receipts and tax invoices as required by law
- After-sales care and order status updates
- Sending sign-in codes by SMS, and running the membership programme (points, tiers and coupons)
Who we share it with
We never sell or rent your personal data. It is shared only as far as the service requires:
- Couriers (KEX, Flash Express) — your name, delivery address and phone number, to deliver the parcel.
- Opn Payments — the payment itself. Card numbers you type on our website or in our app go straight to Opn's card vault (vault.omise.co) and never touch our servers.
- ThaiBulkSMS — your phone number, to deliver sign-in codes.
- PEAK, our accounting system — the name, address and tax details printed on receipts and tax invoices.
In your browser
Our website keeps a few small items in your browser's local storage — your bag, your chosen language, your sign-in session, display settings and your cookie choice — so that the site works. These are essential and need no consent.
We count visitors ourselves without cookies and without identifying anyone: a temporary key derived from the connection changes every day and the IP address is never stored, so the count cannot follow you across days or other websites.
Usage statistics (Google Analytics) and advertising measurement (Meta Pixel, Google Ads) run only after you accept them in the cookie banner; data then goes to Google and Meta under their own policies. You choose on your first visit and can change your mind any time via "Cookie settings" in the footer. Declining never affects ordering.
The KESIYA mobile app
When you use the KESIYA app (Android / iOS), the following applies as well:
- Sign-in — your phone number and a one-time code sent by SMS (through ThaiBulkSMS). No passwords are stored.
- Notifications — if you allow them, the app registers a notification token for your device (through Expo and Google Firebase Cloud Messaging or Apple's push service) so we can tell you about your orders, coupons and points. Turn them off in the app (Me → Notifications) or in your phone's settings; signing out removes the token from that device.
- App usage — a short list of named events (for example: app opened, coffee viewed, checkout started) to improve the app. Before you sign in they carry a random install ID; after you sign in they are linked to your account. They never contain your name, phone number or address.
- Crash reports — when the app fails, it sends the error, the app version and the device platform, with no customer data.
- Member QR code — carries only a signed, time-limited member code; no name, phone number or address is inside.
- Birth date and referral code — both optional. The birth date (set once) is used only for birthday points; a referral code links a friend who joins with it to you for the referral reward.
- Card payments — card numbers typed in the app go straight to Opn Payments (vault.omise.co); we never see or store them.
- Deleting your account — in the app (Me → Personal details → Delete my account) or on the website (account page → Personal details → Delete my account). See how to delete your account for what is deleted and what is kept.
How long we keep it
Orders, payment records and accounting documents (receipts, tax invoices) are kept for five years, as Thai accounting and tax law requires. Everything else is kept only as long as the service needs it. If you delete your member account, your login, the phone number and e-mail on the account, saved addresses, unused coupons and your points balance are removed; purchase records and tax documents are retained as the law requires.
Your rights
Under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) you may access, correct or delete your personal data and withdraw consent. Members can delete their account themselves — see how to delete your account; for anything else, contact us.