Privacy policy

• Data controller — Elina Dress Rental
• Address — 276/6 Building B, TC Green, Rama 9 Road, Bang Kapi, Bangkok 10310
• Email — elinadressrent@gmail.com
• Telephone — 0919828888
• Opening hours — Monday–Sunday, 10.00–19.00

We collect only what the service needs:

• Identity and contact data — Your name, telephone number, email address, LINE account, and the address used for delivery and receipts.
• Data the rental itself requires — Your measurements, the date and place of the event, and your rental and return history.
• Payment data — Transfer slips, booking reference, amounts, and the last four digits of a card. We do not store full card numbers or CVV codes — those stay with the payment provider.
• Identity verification (only where necessary) — A copy of your national ID card or passport, to verify identity before we hand over a high-value gown. We ask you to redact anything not needed, such as religion and blood type.
• Website usage data — IP address, browser and device type, pages visited, time spent, and data from cookies.
• Communications — Messages you send us through the form, email, LINE or social media, including complaints and any photographs attached.

It is not our policy to collect sensitive personal data under section 26 of the PDPA (religion, ethnicity, health data, biometric data). If you send such data unnecessarily, we delete or redact it as soon as we notice.

We process your personal data on the following legal bases.

Performance of a contract (section 24(3))

• Handling the booking, the rental agreement, delivery and collection, inspecting the gown, refunding the deposit, and after-sales service.
• Confirming bookings, notifying you of delivery status, and answering questions or complaints.

Compliance with a legal obligation (section 24(6))

• Issuing receipts and tax invoices, and keeping accounting records.

Legitimate interests (section 24(5))

• Verifying identity before handing over a high-value gown, preventing fraud, and pursuing claims where a gown is lost or damaged.
• Analysing website usage to improve the service, and keeping our systems secure.

Consent (section 19), which you may withdraw at any time

• Sending news, promotions and marketing by email, SMS or LINE.
• Using analytics and advertising cookies.

Where data is needed for the rental agreement, we may be unable to accept your booking or serve you without it. Where we rely on consent, you may decline without affecting the ordinary service.

4.1 We ask for consent to marketing and non-essential cookies separately and explicitly, never bundled with the core service, and never with pre-ticked boxes.

4.2 You may withdraw consent at any time — use the unsubscribe link at the foot of our emails, change the cookie settings on the website, or write to elinadressrent@gmail.com. We act within 5 business days. Withdrawing consent does not affect processing already lawfully carried out.

Our website uses cookies to work correctly and to improve your experience. They fall into three groups:

• Strictly necessary cookies — These make the website work — remembering your signed-in state and what you have selected. They do not require consent.
• Analytics cookies — These measure visitor numbers and behaviour, for example Google Analytics. They require your consent first.
• Advertising cookies — These show advertising matched to your interests, for example Google Ads and Meta Pixel. They require your consent first.

You can set or change your cookie choices in the cookie settings bar on the website, or in your browser settings. Turning some cookies off may leave parts of the website working incompletely.

We do not sell, rent or trade your personal data to third parties for commercial purposes. We may disclose what is necessary to:

• Couriers — To deliver and collect the gown — Thailand Post, Kerry, Flash, Grab and Lalamove.
• Payment providers and banks — To take payment and issue refunds.
• Website and cloud providers — To host the website and store data — Vercel, Cloudflare, and the content management system the website uses.
• Analytics and advertising providers — To measure and advertise — Google Analytics, Google Ads and Meta.
• Cleaning and repair services — To care for the gown after it is returned; only what they need is disclosed.
• Professional advisers and government agencies — Accountants, auditors and legal advisers, or where lawfully ordered.

We require every data processor to keep the data confidential, use it only on our instructions, and maintain appropriate security measures.

Some of our providers — cloud hosting, email systems and analytics tools — may hold servers outside Thailand. Where that happens we comply with sections 28 and 29 of the PDPA, by choosing providers with an adequate standard of data protection or by putting standard contractual clauses in place.

• Customer records and rental history — For as long as you are a customer, and 2 years after the last transaction.
• Accounting and tax records — 5 years, as the Revenue Code requires.
• Identity documents — Deleted or destroyed within 30 days of the gown being returned and your deposit refunded in full.
• Marketing data — Until you withdraw consent.
• Website usage data and cookies — For the lifetime set on each cookie type, generally no more than 12 months.

Once those periods pass we delete, destroy or anonymise the data.

Under the PDPA you have the following rights:

• Right of access (section 30) — To access and obtain a copy of the personal data we hold about you.
• Right to data portability (section 31) — To receive your data in a machine-readable form, or have it sent to another controller.
• Right to object (section 32) — To object to the collection, use or disclosure of your data, particularly for direct marketing.
• Right to erasure (section 33) — To have your data deleted once it is no longer needed, or once you withdraw consent.
• Right to restrict use (section 34) — To have use of your data suspended while its accuracy is checked.
• Right to rectification (section 35) — To have inaccurate, out-of-date or incomplete data corrected.
• Right to withdraw consent (section 19) — To withdraw consent you have given, at any time.
• Right to complain (section 73) — To complain to the Personal Data Protection Committee office.

To exercise a right, email elinadressrent@gmail.com or call 0919828888. We act within thirty (30) days of receiving the request. We may ask you to verify your identity first, and may refuse where the law requires us to keep the data — in which case we tell you why. Exercising your rights is free, unless a request is excessive or repeated without good reason.

We maintain appropriate technical and organisational security measures: SSL/TLS encryption of the website connection, access limited to the staff who need it, backups, and confidentiality obligations on our staff.

That said, the internet is open by nature and we cannot guarantee that transmission is entirely free of unauthorised access. If a personal data breach occurs that risks your rights and freedoms, we notify the Personal Data Protection Committee office within seventy-two (72) hours of becoming aware, and notify you without delay as the law requires.

Our service is for people aged 18 and over. We do not set out to collect personal data from minors. If you are under 18, use the service under the supervision and consent of a parent or guardian. If we learn we have collected a minor’s data without valid consent, we delete it promptly.

We may update this policy from time to time to keep it in step with our service or with the law. The latest version, with its revision date, is published on the website. Where a change is material, we tell you through an appropriate channel.

If you have a question, want to exercise a right, or wish to complain about data protection, please contact us.