What we collect
When you order, Kesiya Co., Ltd. keeps only what the service needs: your name, phone number, delivery address, e-mail (if given), tax details (if you request a tax invoice) and your order history. Members also have their points, coupons, chosen language and — only if they add it — their birth date on the account.
What we use it for
- Processing your order, payment and delivery
- Issuing receipts and tax invoices as required by law
- After-sales care and order status updates
- Sending sign-in codes by SMS, and running the membership programme (points, tiers and coupons)
Who we share it with
We never sell or rent your personal data. It is shared only as far as the service requires:
- Couriers (KEX, Flash Express) — your name, delivery address and phone number, to deliver the parcel.
- Opn Payments — the payment itself. Card numbers you type on our website or in our app go straight to Opn's card vault (vault.omise.co) and never touch our servers.
- ThaiBulkSMS — your phone number, to deliver sign-in codes.
- PEAK, our accounting system — the name, address and tax details printed on receipts and tax invoices.
Chats on Facebook Messenger and Instagram
When you message our Facebook Page or Instagram account, Meta sends a copy of the chat data to our system. We keep and use it as follows.
- What we receive — the user ID Meta assigns for our Page only, your name and profile picture, the time of your messages, your first message (up to 100 characters) and the ad you tapped, if any.
- What we use it for — knowing which ad brought a customer, linking the chat to the order, measuring our advertising, and answering you.
- Replies — some Pages are answered from our back office, by staff or by an automated assistant (AI). For those Pages we keep the whole conversation in order to answer, and messages may be processed by an AI service provider as far as answering requires. You can ask for a person at any time.
- Telling Meta about results — we may tell Meta which chat led to a purchase (amount and order number) to measure our advertising.
- Retention — first messages are deleted within 30 days, the raw data received from Meta within 7 days, whole conversations answered from our back office after 12 months, and chats that never led to an order after 180 days without contact. Chats linked to an order are kept with that order.
- Deleting your data — ask us in the Page's chat or through our contact page. We delete chat data within 30 days, except order and accounting records the law requires us to keep.
We do not sell chat data, and we do not send you advertising in chat unless you wrote to us first.
In your browser
Our website keeps a few small items in your browser's local storage — your bag, your chosen language, your sign-in session, display settings and your cookie choice — so that the site works. These are essential and need no consent.
We count visitors ourselves without cookies and without identifying anyone: a temporary key derived from the connection changes every day and the IP address is never stored, so the count cannot follow you across days or other websites.
Usage statistics (Google Analytics) and advertising measurement (Meta Pixel, Google Ads) run only after you accept them in the cookie banner; data then goes to Google and Meta under their own policies. You choose on your first visit and can change your mind any time via "Cookie settings" in the footer. Declining never affects ordering.
The KESIYA mobile app
When you use the KESIYA app (Android / iOS), the following applies as well:
- Sign-in — your phone number and a one-time code sent by SMS (through ThaiBulkSMS). No passwords are stored.
- Notifications — if you allow them, the app registers a notification token for your device (through Expo and Google Firebase Cloud Messaging or Apple's push service) so we can tell you about your orders, coupons and points. Turn them off in the app (Me → Notifications) or in your phone's settings; signing out removes the token from that device.
- App usage — a short list of named events (for example: app opened, coffee viewed, checkout started) to improve the app. Before you sign in they carry a random install ID; after you sign in they are linked to your account. They never contain your name, phone number or address.
- Crash reports — when the app fails, it sends the error, the app version and the device platform, with no customer data.
- Member QR code — carries only a signed, time-limited member code; no name, phone number or address is inside.
- Birth date and referral code — both optional. The birth date (set once) is used only for birthday points; a referral code links a friend who joins with it to you for the referral reward.
- Card payments — card numbers typed in the app go straight to Opn Payments (vault.omise.co); we never see or store them.
- Deleting your account — in the app (Me → Personal details → Delete my account) or on the website (account page → Personal details → Delete my account). See how to delete your account for what is deleted and what is kept.
How long we keep it
Orders, payment records and accounting documents (receipts, tax invoices) are kept for five years, as Thai accounting and tax law requires. Everything else is kept only as long as the service needs it. If you delete your member account, your login, the phone number and e-mail on the account, saved addresses, unused coupons and your points balance are removed; purchase records and tax documents are retained as the law requires.
Your rights
Under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) you may access, correct or delete your personal data and withdraw consent. Members can delete their account themselves — see how to delete your account; for anything else, contact us.