Privacy policy

Last updated: 29 October 2026

This policy explains how LUMERA (THAILAND) CO., LTD (Tax ID 0105568102529) collects and uses personal data on https://shop.lumera.co.th.

It is written under the Personal Data Protection Act B.E. 2562. LUMERA (THAILAND) CO., LTD is the data controller, which means that we decide why and how the data is used. This policy covers both the pre-order and ordinary shop sections of the site.

If this policy and the Terms of service disagree about personal data, this policy controls that data-processing question.

1.Email-only account and notices

Your email address is your account login and the channel we use for all notices. We send sign-in codes, order updates, arrival invoices, refund instructions, and service or policy notices by email.

Phone is contact data only. We do not use SMS as an identity or notice channel. We do not require a LINE account, LINE linking, or LINE notices for a pre-order.

2.What we collect

We collect what we need to run a pre-order, take payment, import the goods, deliver or offer pickup, refund you when a refund is due, keep the site secure, and answer your messages. This may include:

  • your name, email address, and phone number;
  • the shipping address you provide in Thailand and whether you choose pickup or delivery on your arrival invoice;
  • campaigns or items you view or put in a cart, quantities, prices shown at checkout, payment plan (full payment or 50%), amounts paid and still due, order status, fulfillment details, and messages you send us;
  • PromptPay payment status, amount, time, Beam payment reference, and our own order or payment reference. We do not store your PromptPay PIN or bank-app login;
  • bank name, account name, and account number that you provide for a manual refund;
  • IP address, browser or app type, rough location derived from an IP address, ordinary site logs, and a session cookie; and
  • information and photographs that you send about a damaged, defective, short, lost, or incorrect item.

We do not ask for a national ID card for an ordinary pre-order. We may ask you to prove who you are if we reasonably suspect fraud or if you ask us to exercise a privacy right.

3.Where the data comes from

Most data comes directly from you when you sign in, check out, choose delivery, provide refund details, or contact us.

Beam tells us whether a PromptPay payment succeeded, failed, or expired. Our hosting, database, email, and security providers keep system logs. If you choose delivery, the carrier may send us delivery events. We may also receive information from staff handling your order or refund.

4.Why we use it

We use your account, cart, payment plan, amounts paid, arrival invoice, fulfillment choice, address, and order notices to perform the pre-order contract.

We use payment information to accept and reconcile PromptPay payments, and bank details only to arrange and record a manual refund. We use your address and phone number to import goods, arrange delivery, or tell you where to collect them.

We use session data and logs to keep the site secure, prevent fraud, protect account ownership, and investigate payment or fulfillment disputes. We keep records where Thai law requires them.

We send service and order notices by email because they are part of the pre-order. If we want to send marketing about other pre-orders, we will ask for consent first, and you can withdraw that consent. We do not use refund bank details for marketing and we do not sell personal data.

Under the PDPA, these uses may rely on the contract, a legal duty, our legitimate interest in operating a secure shop, or consent where we ask for it.

5.Who we share data with

We share data only when necessary to operate the shop, provide a service you request, protect the site, or comply with law. Depending on the service, recipients may include:

  • Beam Checkout, which processes PromptPay and card payments and reports payment status;
  • hosting, database, website, email, and security providers, including Neon, Vercel, and Resend;
  • Thai banks, when we manually transfer a refund to the account you provide;
  • carriers, when you choose delivery and we need to send your name, phone number, and address;
  • accountants, lawyers, or public authorities where Thai law requires or permits disclosure; and
  • a successor to the business, subject to continuing duties to protect customer data.

We do not share more data than the recipient needs for that purpose.

6.Data processed outside Thailand

Some service providers may store or access data outside Thailand. Where the PDPA requires safeguards for an overseas transfer or processor, we use the protections required by law or contract.

If you do not want any data to leave Thailand, you may not be able to use every part of this site.

7.Cookies and logs

We use the lumera_preorder_session cookie to keep you signed in; it expires when your sign-in session expires. The cart, checkout, and account pages need that cookie. We also use the lumera-locale cookie to remember your chosen language for up to 1 year. We do not use separate advertising cookies on this site as of the date above; if that changes, we will update this policy.

You can block cookies in your browser, but login and checkout will not work without the session cookie. Security logs may be kept for a short operating period or longer when needed to investigate a security event or dispute.

8.Children

This site is for people aged 20 or older, or for younger people whose parent or legal guardian has agreed to the Terms of service. We do not knowingly collect children's data for marketing. A parent or guardian may email us to ask us to delete a child's data where the law allows.

9.How long we keep data

We keep order, payment, account, refund, and dispute records for as long as needed to perform the contract, comply with legal obligations, resolve disputes, and protect our rights. Refund bank details are kept with the related payout record for that purpose and then deleted or de-identified when no longer needed.

When data is no longer needed, we delete it or make it unable to identify you, subject to records that the law requires us to retain.

10.Your rights

Subject to the limits in the PDPA, you may:

  • access the personal data we hold about you;
  • request a copy in a commonly used format;
  • ask us to correct inaccurate data;
  • ask us to delete data where the law allows deletion;
  • object to or restrict some processing;
  • withdraw consent where we relied on consent, without undoing processing already completed; and
  • complain to the Office of the Personal Data Protection Committee.

Some records must be retained even after a deletion request where the law requires retention or the records are needed for a paid order, refund, or dispute.

To exercise a right, email hello@lumera.co.th from an address we can match to the account. We will verify that you are the account owner, respond within the period required by the PDPA, and explain any refusal that the law permits. We will not treat you unfairly because you exercise a right.

11.Security

The site uses HTTPS. Access to staff tools is limited to people who need it, and service providers that process data for us are subject to contractual controls. No transmission or storage method is completely secure.

Do not send us bank passwords, PromptPay PINs, or bank-app login details. For a refund, send only the bank details we request through the refund process.

12.Marketing and policy changes

Messages about an open pre-order, including an arrival invoice, a delivery request, a refund request, or a deadline, are service messages. They are sent by email and cannot be turned off while the order requires them.

We may post a new version of this policy and change the date above. If a change materially affects data we already hold and the PDPA requires notice, we will notify you by email. Email remains the sole launch notice channel.

13.Ordinary shop, imported order history and marketplaces

The ordinary shop uses the same controller and the same email account. Ordinary orders are paid in full through our payment provider (Beam) rather than under a pre-order payment plan, and we process the data described above for them in the same way.

Ordinary orders may also be paid by credit or debit card. You enter card details on Beam's payment page, and Beam collects and handles that card data. We do not receive or store your full card number or security code; we keep only the payment status, amount, time, and Beam payment reference.

We imported order history from our previous store (Shopify) so that past buyers can see their earlier orders and so that we can handle support and accounting. If you buy through a marketplace where we sell (for example Shopee, Lazada, or TikTok Shop), the marketplace shares the buyer and order data we need to accept, fulfil, and support that order.

14.Contact

For this policy or a PDPA request:

  • Operator: LUMERA (THAILAND) CO., LTD
  • Registered office: No. 15 Century The Movie Plaza, Room 611, 6th Floor, Phayathai Rd, Thanon Phayathai, Ratchathewi, Bangkok 10400, Thailand
  • Tax ID: 0105568102529
  • Phone: 065 169 3569
  • Email: hello@lumera.co.th
  • Customer service hours: Daily 10:00-21:00
  • Reply time: Within 1 business day
  • Pickup address: Lumera @ Centerpoint Siam Square, 2nd floor, above Molly Tea
  • Pickup hours: Daily 10:00-21:00
  • Website: https://shop.lumera.co.th

You may also complain to the Office of the Personal Data Protection Committee.