Last updated: August 3, 2026
This policy explains what personal data tapeetea.net collects, why, how long we keep it, and the rights you have over it. If anything here is unclear, email service@tapeetea.net and we will explain it in plain terms.
1. Who is responsible for your data
The data controller is the company that operates tapeetea.net, registered in Thailand. Our company details and contact address are on our Contact page. We trade as Tapee Tea at tapeetea.net.
Contact for any privacy matter: service@tapeetea.net.
2. What we collect, why, and our lawful basis
Orders
Name, email address, delivery address, phone number if you give one, and the contents and value of your order. We use this to take payment, pack and deliver your order, handle returns and answer support questions.
Lawful basis: performance of our contract with you. Keeping the resulting records is also a legal obligation (tax and accounting).
Payments
Card details are collected and processed by our payment processors, not by us. We never see or store your full card number. We do receive confirmation of payment and a partial reference for reconciliation and fraud checks.
Lawful basis: performance of a contract, and our legitimate interest in preventing fraud.
Account
If you create an account we store your email address, password (hashed, never in readable form) and order history so you can track and reorder.
Lawful basis: performance of a contract.
Marketing email
If you opt in, we use your email address to send occasional news and offers. The box is never pre-ticked, and every email has a one-click unsubscribe.
Lawful basis: your consent, which you may withdraw at any time.
Website use
Necessary cookies keep your basket and session working, and our site uses LiteSpeed caching for performance, which may set purely technical cookies needed for the site to function. Any analytics or marketing cookies are set only if you accept them in our consent banner (powered by Complianz); you can change or withdraw that choice at any time.
Lawful basis: legitimate interest for strictly necessary cookies; consent for everything else. See our Cookie Policy.
Session recording (Microsoft Clarity)
We use Microsoft Clarity, provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA), to understand how visitors use our pages. Clarity reconstructs a playback of your visit — the pages you view, clicks and taps, scrolling and mouse movement, and how you interact with elements on the page — together with your browser and device type, the page that referred you, and an approximate location derived from your IP address. This is commonly described as session recording or session replay.
Clarity is a non-essential statistics technology. Where your consent is required, the Clarity script is not loaded at all until you accept statistics cookies — so no session recording takes place and the Clarity cookies listed in our Cookie Policy (_clck, _clsk and _cltk) are never set. You can withdraw that consent at any time through the cookie banner or our Cookie Policy, which stops Clarity loading on the pages you view afterwards.
We use Clarity to diagnose usability problems and improve the site, not to identify individual visitors. Clarity masks the content of form fields by default, and we do not use it to capture payment details. Microsoft acts as a processor for this data and may process it in the United States; see the Microsoft Privacy Statement.
Messages you send us
If you write to us or use the contact form we keep the correspondence so we can deal with your query and any follow-up.
Lawful basis: our legitimate interest in answering enquiries and keeping a record of them.
3. Who we share it with
We share only what is needed, with:
- our payment processors, to take and reconcile payment;
- our fulfilment operation and postal or courier carriers, to pack and deliver your parcel (this includes your name and delivery address);
- customs authorities, where an international shipment legally requires declaration of the recipient and contents;
- our email platform, to send order notifications and, if you opted in, marketing;
- our hosting provider, which stores the site and its database;
- professional advisers or authorities where the law requires it.
We do not sell your personal data, and we do not share it for third-party advertising.
4. International transfers
We are based in Thailand, and orders are packed and dispatched from Thailand. If you order from the United Kingdom or the European Economic Area, your name, delivery address and order details are therefore transferred to, and processed in, Thailand in order to fulfil your order. Some of our service providers may also process data outside the UK or EEA.
Thailand is not currently covered by a UK or EU adequacy decision. Where we receive personal data from the UK or EEA we rely on appropriate safeguards — contractual protections with the recipient limiting use of the data to fulfilling your order — or, where relevant, on the transfer being necessary for the performance of the contract with you (delivering the goods you ordered). You can ask us for details of the safeguards that apply. As a company established in Thailand we are also subject to the Thai Personal Data Protection Act (PDPA) in how we handle your information.
5. How long we keep it
- Order and transaction records: six years from the end of the relevant financial year, to meet UK tax and accounting requirements.
- Account data: until you ask us to close your account, after which it is deleted except where an order record must be retained above.
- Marketing consent and email data: until you unsubscribe or withdraw consent, plus a suppression record so we do not email you again in error.
- Support correspondence: up to three years from the last message, so we can follow up on returns, faults and disputes.
- Cookie and consent records: as set out in our Cookie Policy.
6. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase data, where we have no continuing lawful reason to keep it;
- restrict or object to processing, including processing based on legitimate interests;
- portability — receive data you gave us in a machine-readable form;
- withdraw consent at any time, where consent is the basis (this does not affect processing already carried out).
To exercise any of these, email service@tapeetea.net. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to your local supervisory authority if you are in the EEA. We would appreciate the chance to put things right first.
7. Security
The site is served over HTTPS, passwords are stored hashed, and access to order data is limited to the people who need it to run the shop. No system is perfectly secure, but we take appropriate technical and organisational measures and review them as the shop changes.
8. Children
This shop is intended for adults. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
9. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects for you. Our payment processors may run automated fraud checks on a transaction as part of authorising it.
10. Changes
If we change this policy we will publish the updated version here and change the date at the top. Material changes affecting how we use data you already gave us will be notified by email where we hold one for you.