Privacy notice

Fivehy Ltd (trading as Vialdee), a company registered in England and Wales under number 17216524, with its registered office at Office 4689 A L, 182-184 High Street North, Area 1/1, East Ham, London, E6 2JA, United Kingdom, is the data controller for the information described here. Contact us at vialdee@fivehy.com, +44 7468 407534, or LINE @vialdee.

We have not appointed a Data Protection Officer. Our core activity is retail sale, not large-scale monitoring of individuals or the processing of sensitive personal data, so section 41 does not require one. If that changes, this notice will say so and name them.

To fulfil an order: your name, email address, Thai mobile number and delivery address. The purpose is performing the sale and getting the parcel to you.

If you create an account: the same contact details, plus any addresses you save to your address book, so you do not retype a full Thai address on every order.

If you request a full tax invoice: your registered company name, 13-digit taxpayer identification number and registered address. Required by the Revenue Code, not by us.

If you ask to be told when a sold-out decant returns: your email address and which language to write in, kept until we have sent that one message or you ask us to stop. It is used for nothing else.

We do not collect or store card numbers. PromptPay transfers happen inside your own banking app and we never see your account details. We do not collect sensitive personal data as defined in section 26 — no health, religious, biometric or similar information.

Name, phone number and delivery address are necessary to perform the contract — a courier cannot deliver without them. Without these we cannot accept your order.

Your email is necessary because it is how we send your order confirmation and how you retrieve a guest order afterwards.

Everything else is optional. An account, a saved address, a tax invoice and marketing email are each voluntary, and declining any of them does not affect your ability to buy.

Contact and delivery data: necessary for performance of the contract of sale (section 24(3)), and separately consented to at checkout.

Order and tax records: legal obligation (section 24(6)) — the Revenue Code requires us to keep them.

Marketing email: consent only (section 19). It is never required to place an order, and withdrawing it does not affect your purchase or anything else about your account.

Order records, including the address they were shipped to: five years from the end of the accounting year, because the Revenue Code requires it.

Account and address book: for as long as your account is open. Delete your account and they go with it, except for the order records above.

Marketing consent: until you withdraw it.

Cart data: 30 days from last activity, then deleted automatically.

Couriers — Flash Express or Kerry Express — receive your name, phone number and address, solely to deliver your parcel.

Supabase hosts our database on servers in ap-south-1 (Mumbai, India), and Vercel hosts the website. Both act as data processors under our instructions.

Storing data in India is a transfer outside Thailand under sections 28 and 29. It is carried out on the basis of your consent and because it is necessary to perform the contract with you, and the processor is bound by contractual data protection terms.

We do not sell your data and we do not share it with advertisers.

You may: withdraw consent at any time (s.19); access your data and obtain a copy (s.30); receive it in a portable machine-readable form (s.31); object to processing (s.32); request erasure (s.33); request restriction of processing (s.34); and request correction of inaccurate data (s.36).

Email vialdee@fivehy.com and we will respond within 30 days. Erasure is honoured by destroying your name, address and contact details while retaining the financial record of the order, which the Revenue Code obliges us to keep for five years.

You may lodge a complaint with the Personal Data Protection Committee (s.73) if you believe we have handled your data unlawfully.

We keep an anonymous cart token and your language preference in your browser's local storage. Neither identifies you, and neither is sent to a third party.

If you sign in, your session token is stored the same way so you stay signed in between visits. Signing out removes it.

We run no advertising or analytics trackers, so there is no consent banner to dismiss.