LEGAL

PDPA Notice

This notice describes how Roots Agriculture Co., Ltd. ("we", "us", "our") handles your personal data under the Thailand Personal Data Protection Act B.E. 2562 (2019) ("PDPA") when you use the Panya Seeds website at growpanya.com (the "Site") and any related services.

Data controller

Roots Agriculture Co., Ltd. — registered in Thailand. We are the data controller responsible for your personal data collected through the Panya Seeds website.

What we collect

When you use the Site, we may collect:

Identity and contact data — name, email address, phone number, shipping and billing address when you place an order or create an account.
Order data — the products you buy, your order history, delivery status, and any special instructions.
Payment data — processed by our payment providers (PromptPay via 2C2P, Stripe, etc.). We do not store full card numbers on our servers.
Usage data — pages you visit, session duration, referrer, and device type, collected via cookies and first-party analytics.
Marketing preferences — whether you have opted in to our newsletter or promotional messages.

Why we collect it

We process your personal data for the following purposes:

To fulfil your orders, arrange delivery, and handle returns.
To communicate with you about your order or respond to customer service enquiries.
To send you marketing communications, but only where you have opted in.
To improve the Site, our products, and your shopping experience.
To comply with legal, tax, and accounting obligations.
To detect and prevent fraud, abuse, or security incidents.

Lawful basis

Under the PDPA we rely on the following bases depending on the activity:

Contractual necessity — to fulfil your order and provide the Services you have requested.
Consent — for marketing communications and non-essential cookies. You can withdraw your consent at any time.
Legal obligation — for tax, accounting, and regulatory record-keeping.
Legitimate interests — for security, fraud prevention, analytics, and improving our Services, balanced against your rights.

Who we share it with

We share personal data only with:

Payment providers (2C2P, Stripe) to process your payment.
Logistics partners to deliver your order to you.
Cloud and infrastructure providers (e.g. Vercel, Cloudflare) that host the Site.
Analytics and communication tools (e.g. Resend for email) under data processing agreements.
Government authorities where legally required.

We do not sell your personal data.

How long we keep it

Order and transaction records: 10 years (required by Thai tax law).
Account data: until you close your account plus 12 months.
Marketing data: until you unsubscribe or withdraw consent.
Analytics data: aggregated and typically retained up to 26 months.

Your rights

Under the PDPA you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your personal data in certain circumstances.
Object to or restrict processing.
Withdraw consent where consent is the legal basis.
Request data portability.
Lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand.

To exercise any of these rights, email us at privacy@growpanya.com.

Transfers outside Thailand

Some of our service providers may process your personal data outside Thailand. When they do, we rely on contractual safeguards and the other mechanisms permitted under the PDPA to protect your rights.

Cookies

The Site uses first-party cookies for essential functionality (cart, login) and, with your consent, analytics and marketing cookies. You can change your preferences any time via the cookie settings link in our footer.

Contact

Roots Agriculture Co., Ltd. Email: privacy@growpanya.com Website: https://growpanya.com

Updates

We may update this PDPA notice from time to time. The date at the top reflects the most recent revision.