Privacy Policy
What personal data the hyCommerce website and client portal collect, why, on what legal basis, how long we keep it, where it goes outside Thailand, and what rights you have.
Last updated 17 September 2026
01Who runs this site
This website and the client portal are run by hyCommerce. hyCommerce gives brands entering Thailand product registration, import, customs, logistics and fulfillment together with marketing, distribution and e-commerce in one service. In this policy "we" means hyCommerce, and hyCommerce is responsible for the personal data collected through this site and the client portal. The point of contact is info@doosigan.com.
02What we collect
The inquiry form asks for your company, contact name, email, phone number, inquiry type (you may pick more than one) and your message. A file attachment and an online-meeting request are optional. We also store the language you were reading so that we reply in the same language. Without the required fields we cannot answer your inquiry. Material you send us directly by email is handled the same way. For the client portal we need a login email and the company you belong to. The inventory, outbound, return and billing records shown in the portal are company transaction data, but they can contain details that identify a member of staff, so we protect them on the same basis. To stop the same source submitting the form repeatedly we check the connecting IP address briefly. That value stays in server memory only and is not stored. Please do not include sensitive details such as health, religion or ethnicity in your message.
03Why we use it, and on what basis
Answering your inquiry, scoping the work and preparing a contract rest on section 24(3) of Thailand's Personal Data Protection Act: steps taken at your request before entering into a contract. Keeping a record of inquiries and preventing misuse rest on the legitimate interest ground in section 24(5). Running the client portal and keeping warehouse and logistics records is processing necessary to perform our contract with you. Analytics cookies, including the recording of how a page is used, are used only where you consent under section 19. We do not send marketing email; if that changes we will ask for separate consent first. We do not sell personal data or pass it to advertising networks.
04Cookies and analytics
Necessary items run without consent: the language you chose (hyc-lang) and the record of this cookie choice (hyc-consent), both kept in your browser, and the client portal login session. Without them your language would reset on every page and you could not stay signed in. Analytics items load only after you accept them. Before that no analytics script is downloaded at all. · Google Analytics 4 — measures which pages are read and how often (_ga and similar). · Microsoft Clarity — records how far a page is scrolled and where people leave (_clck, _clsk). We use the playback only to find usability problems, never for advertising. You can change or withdraw your choice at any time through "Cookie settings" at the bottom of the page. After withdrawal no analytics script is downloaded on your next visit. We do not use advertising cookies.
05Where it is stored
Inquiries are stored in Airtable and a notification goes to info@doosigan.com. The website runs on Vercel and is served from the Singapore region. Client portal data is stored in Supabase (Singapore region), and our company email is Google Workspace. Analytics records are held by Google and Microsoft in their own services. Access is limited to the staff handling your inquiry or contract and to the administrator. In the client portal each company's data is separated, so another client's records cannot be read even at the database level.
06Transfers outside Thailand
Airtable is based in the United States, and Vercel, Supabase, Google and Microsoft operate servers in several regions including the United States and Singapore. Your data therefore leaves Thailand. We hold a data processing agreement with each provider and rely on standard contractual clauses for the level of protection, which is the appropriate safeguard route under section 29 of the PDPA.
07How long we keep it
Inquiries that do not lead to an engagement are deleted two years after they arrive. For clients, regulatory records and related documents are kept for ten years after the engagement ends, because certificate renewals and variation filings require the earlier history and because the general prescription period under the Thai Civil and Commercial Code is ten years. Warehouse movement and billing records are kept for as long as tax and accounting rules require. Cookie consent records are kept for two years; analytics records follow Google's and Microsoft's own retention policies. After these periods data is deleted or made non-identifiable.
08Your rights
You may request access to your data and a copy of it, correction, deletion, restriction of processing, objection and portability. Where we rely on your consent you may withdraw it, and processing carried out before the withdrawal remains valid. If you believe your data has been handled improperly you may lodge a complaint with Thailand's Personal Data Protection Committee.
09How to exercise them
Write to us by email or post. We verify your identity and answer within 30 days of receiving a complete request. If we need longer we will tell you why and may extend by up to 30 days. We do not charge for handling a request. Email: info@doosigan.com Phone: +66 2 023 7698 Post: hyCommerce, 49/53, Nong Rahaeng Rd., Sam Wa Tawan Tok, Khlong Sam Wa, Bangkok 10510, Thailand
10How we protect it
Inquiries and portal sessions travel only over encrypted connections, and storage is limited to named staff accounts. In the client portal the database itself restricts each session to the signed-in company's data, and the screens are built so that they cannot bypass that restriction. Access rights are reviewed regularly and withdrawn as soon as someone leaves or changes role. If we conclude that personal data has been breached we notify the Personal Data Protection Committee within 72 hours, and we notify affected individuals where the risk to their rights is high.
11We do not train AI on your data
Material you send us, your inquiry and the transaction records in the portal are not used to train AI models.
12Contact and changes
For anything about how we handle personal data, write to info@doosigan.com. When this policy changes we update the date on this page, and for material changes we ask for your cookie choice again. It is published in English, Korean and Thai.
Last updated 17 September 2026