Privacy Policy

Villa Market Co., Ltd. (“Villa Market”, “we”, “us”, or “our”) is the data controller responsible for your personal data. Our registered office is located at 593/29-41 Soi Sukhumvit 33/1, Klongton Nua, Wattana, Bangkok 10110, Thailand.

We may collect the following categories of personal data:

• Identity data: name, date of birth, national ID or passport number
• Contact data: email address, phone number, delivery address
• Account data: username, password (encrypted), preferences
• Transaction data: purchase history, payment details, order information
• Technical data: IP address, browser type, device information, cookies
• Usage data: browsing history on our site, product interactions, search queries

We process your personal data for the following lawful purposes under the PDPA:

• Processing and fulfilling your orders and deliveries
• Managing your Villa Market account and loyalty programme
• Processing payments and preventing fraud
• Communicating with you about orders, promotions, and service updates
• Improving our products, services, and website experience
• Complying with legal obligations and regulatory requirements
• Personalising your shopping experience with relevant recommendations

We rely on the following legal bases under the PDPA:

• Consent: where you have given explicit consent for marketing communications and cookie tracking
• Contractual necessity: to fulfil orders and provide services you have requested
• Legitimate interest: to improve our services, prevent fraud, and ensure security
• Legal obligation: to comply with tax, accounting, and regulatory requirements

Our website uses cookies and similar technologies to enhance your browsing experience. We use:

• Strictly necessary cookies: required for the website to function (e.g., shopping cart, authentication)
• Analytics cookies: to understand how visitors use our website and improve performance
• Marketing cookies: to deliver relevant advertisements and measure campaign effectiveness

You may manage your cookie preferences through our consent banner or your browser settings. Disabling certain cookies may affect website functionality.

We may share your personal data with the following categories of recipients:

• Payment processors (KBank, Stripe) for transaction processing
• Delivery partners for order fulfilment
• Cloud service providers (AWS) for secure data storage and processing
• Analytics providers for website performance monitoring
• Government authorities when required by law or court order

We require all third-party service providers to respect the security of your personal data and process it in accordance with the PDPA.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: for the duration of your account and up to 2 years after closure
• Transaction data: up to 7 years as required by Thai tax and accounting regulations
• Marketing data: until you withdraw consent or unsubscribe
• Technical/analytics data: up to 13 months from collection

Under the PDPA, you have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data in certain circumstances
• Right to restriction: request that we limit processing of your data
• Right to data portability: request transfer of your data in a machine-readable format
• Right to object: object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact our Data Protection Officer at the details provided below.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and monitoring
• Employee training on data protection practices

Your personal data may be transferred to and processed in countries outside Thailand where our service providers operate (e.g., cloud servers in Singapore). We ensure that such transfers comply with the PDPA and that adequate safeguards are in place to protect your data.

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on our website or sending you an email. The “last updated” date at the top of this policy indicates when it was last revised.

If you have questions about this privacy policy or wish to exercise your data protection rights, please contact:

You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) if you believe your data protection rights have been violated.