This Privacy Policy explains how COVERMAT CO., LTD. ("Merry's Care", "we", "us") collects, uses and discloses personal data when you use this website - including when you browse, create an account, check out as a guest, place and track orders, or contact us.
Please read it together with our Cookie Policy and Terms & Conditions. Where the law requires your consent (for example for analytics cookies or marketing emails), we ask for it separately.
1. Who we are
The party responsible for your personal data is COVERMAT CO., LTD., 1 Soi Phutthabucha 2, Phutthabucha Road, Bangmod, Jomthong, Bangkok 10150, Thailand. Our contact details are at the end of this policy.
2. Personal data we collect
We collect data directly from you, automatically from your browser or device, and from service providers such as Google (Google Login) and shipping carriers (tracking updates). Depending on how you use the website, this includes:
- Account data: email address, first and last name, username, gender and date of birth (where you provide them), phone number (where you provide it), your password (stored only as a one-way hash, never in readable form), whether your email has been verified, and your last login time.
- Google Login data: when you sign in with Google, we receive your Google account's email address, its verified-email status, your name and a unique Google account identifier. We do not receive your Google password.
- Saved addresses: the recipient name, company (optional), phone number and delivery address details you save in your account.
- Guest checkout and order data: email address, name, phone number, delivery address, any note you leave on the order, optional tax invoice details (company name, tax ID, address, phone number and email), the items ordered, prices, discounts, VAT, shipping fee and totals, the shipping method you selected, and your order number.
- Cart and checkout information: the items in your cart and your checkout selections, which are kept in your browser's storage on your own device until you place an order or clear them.
- Payment-related data: we do not receive or store bank card details. Payment is made by transferring money via PromptPay QR in your own banking app. We record the payment status of your order and any payment slip image you upload, which may show information your bank includes on the slip (for example the amount, date and time, and account holder details).
- Shipping and tracking data: the carrier you selected (Thailand Post EMS or DHL eCommerce), the tracking number, shipment and delivery times, tracking events reported by the carrier, and proof of delivery where the carrier provides it.
- Order history and activity records: your past orders and a log of important actions on each order (for example order created, payment confirmed, shipped, delivered, cancelled or expired).
- Verification (OTP) data: one-time codes sent to your email (stored only as a hash), their expiry, the number of attempts, and whether our email provider reported the email as delivered or bounced.
- Messages you send us: your name, email address, phone number and message when you use the contact form.
- Marketing preference: whether you opted in to promotional emails when registering, and when you did so.
- Usage and device data: information about your visits and device collected through cookies and similar technologies (see our Cookie Policy), plus technical data such as your IP address and browser information that is processed to run and secure the website. We also count how many times each article is viewed.
3. How we use personal data
- To create and manage your account, sign you in (including with Google), keep you signed in, and let you view and manage your profile, addresses and orders.
- To verify your email address and support password reset by sending one-time codes (OTP).
- To process orders: check and hold stock, calculate prices, discounts, VAT and shipping, show the payment QR, review payment slips, confirm orders, arrange shipping, and provide tracking and order status.
- To apply promotions (Launch Promotion and Flash Sale), including checking eligibility and preventing a limited offer from being used more often than allowed - for example one Launch Promotion right per account, or per phone number for guest orders.
- To send service emails about your orders (order received for payment review, shipment with tracking number, delivery, cancellation), account verification codes, and replies to your messages.
- To issue a tax invoice when you request one at checkout.
- To respond to your enquiries and provide customer support.
- To understand how the website is used and improve it (analytics) - only if you accepted analytics cookies.
- To send promotional or newsletter emails - only if you opted in when registering. Placing an order or checking out as a guest does not sign you up for marketing.
- To keep the website, accounts and orders secure, and to detect and prevent misuse, fraud and abuse (including by limiting the rate of requests).
- To comply with legal, accounting and tax obligations, and to establish, exercise or defend legal claims.
4. Legal basis for processing
[LEGAL BASIS FOR EACH PURPOSE ABOVE - TO BE CONFIRMED BY COVERMAT CO., LTD. AND ITS LEGAL ADVISER BEFORE PUBLICATION]
5. Orders, payment and shipping
Payment: orders are paid by PromptPay QR shown on the payment page. We do not operate an online card payment gateway. After paying, you upload a payment slip image, which is stored in a private storage area and used by our staff to verify the payment. Uploading a slip does not by itself confirm payment.
Order emails: we email you when your order and payment slip have been received for review, when your order has been shipped (with the carrier and tracking number), when it has been delivered, and when it has been cancelled (with the reason). These emails go to the address you gave at checkout.
Shipping: to deliver your order we use your recipient name, phone number and delivery address, and share what is needed for delivery with the carrier you selected (Thailand Post EMS or DHL eCommerce). Tracking numbers are used to retrieve status updates from those carriers' tracking services, which are shown on your order page.
Guest orders: if you check out without an account, access to your order is by your order number together with a private access link or token generated for that order. Keep that link private.
6. Accounts, Google Login and email verification
When you register with email and password, or reset your password, we send a 6-digit one-time code to your email. The code is valid for 10 minutes, can be used once, and is disabled after a limited number of incorrect attempts. Our email provider reports back whether each verification email was delivered or bounced, so that we can tell you if your address cannot receive it.
When you use Google Login, Google verifies your identity and gives us your email address, name and Google account identifier. If an account with the same email already exists, your Google sign-in may be linked to it. Google's handling of your data is governed by Google's own privacy policy.
Once signed in, your session is kept using a secure cookie. If you choose "remember me" the session lasts up to 30 days; otherwise it ends when you close your browser. Logging out ends the session.
8. Who we share personal data with
We disclose personal data only as needed for the purposes above, to:
- Shipping carriers - Thailand Post (EMS) and DHL eCommerce - for delivery and tracking.
- Email delivery provider (Resend) - which sends our verification, order and contact emails on our behalf and reports delivery status.
- Hosting, database and file-storage providers (including Supabase for file storage, such as product images and payment slips) that run the website's infrastructure.
- Google - when you use Google Login, and for Google Analytics 4 if you accepted analytics cookies. YouTube (Google) also provides the embedded videos shown on the website.
- Microsoft (Clarity) and Meta (Meta Pixel) - only if you accepted analytics cookies.
- Professional advisers, courts, regulators and other authorities where we are required or permitted to do so by law.
9. Transfers outside Thailand
Some of the providers above may store or process personal data outside Thailand. [SAFEGUARDS FOR INTERNATIONAL TRANSFERS - TO BE CONFIRMED BY COVERMAT CO., LTD.]
10. Security
We use measures such as hashing passwords and one-time codes, HTTP-only and secure session cookies, encrypted (HTTPS) connections, private storage for payment slips, unguessable order-access links, request rate limiting, and role-based access for our staff. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
11. How long we keep personal data
We keep personal data for as long as needed for the purposes in this policy, including maintaining order and payment records, handling claims, and meeting legal, accounting and tax requirements. [RETENTION PERIODS BY TYPE OF DATA - TO BE CONFIRMED BY COVERMAT CO., LTD.]
Some retention behaviour is built into the website itself:
- Verification codes are valid for 10 minutes and can be used only once.
- A login session ends when you log out or close your browser, or after up to 30 days if you chose "remember me".
- Items stored in your browser (such as your cart) stay on your device until you clear them or they are replaced - see our Cookie Policy.
- Each order keeps its own record of the products, prices and delivery details as they were when you ordered, even if the product is later changed or you later update your profile.
12. Your rights
Under applicable personal data protection law (for example Thailand's Personal Data Protection Act B.E. 2562), and subject to the conditions and exceptions in that law, you may have the right to:
- access your personal data and obtain a copy;
- have inaccurate or incomplete data corrected;
- withdraw your consent at any time (this does not affect processing already carried out);
- object to, or ask us to restrict, certain processing;
- ask us to delete or anonymise your personal data;
- receive your data in a portable format, where applicable; and
- lodge a complaint with the competent supervisory authority.
13. How to exercise your rights
You can view and update your profile and saved addresses yourself in your account. For any other request - including withdrawing marketing consent - contact us at merrys-care@covermat.co.th or through the channels below. We may need to verify your identity before acting on a request. To change your cookie choice, see our Cookie Policy.
14. Links to other websites
The website links to third-party sites and platforms, such as Shopee, Lazada, social media channels and the Department of Business Development's e-commerce registration page. We are not responsible for their privacy practices; please read their own policies.
15. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always on this page with its "Last updated" date. Where the law requires, we will give additional notice of material changes.
16. Contact us
If you have questions about this policy or your personal data:
- COVERMAT CO., LTD.
- Address: 1 Soi Phutthabucha 2, Phutthabucha Road, Bangmod, Jomthong, Bangkok 10150, Thailand
- Phone: 02-427-8216 (Monday - Friday only, 8:30 AM - 5:30 PM)
- Privacy & general contact email: merrys-care@covermat.co.th
- LINE: @merrys.care