Privacy policy

Last updated 14 October 2026

This policy explains what personal data SideQuest collects when you use www.sidequest-shop.com, why, who else sees it, how long it is kept and what you can ask of us. It is written to meet Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

1. Who is responsible for your data

SideQuest is an online game shop based in Bangkok, run by Peeranat Somboonsirikul, who is the data controller for the personal data described here. For anything about your data — a question, a request, a complaint — email sidequestshop99@gmail.com. We have not appointed a data protection officer; the PDPA does not require one for a business of our size, so requests come straight to the owner.

2. What we collect, why, and on what legal basis

• Your account — name, email address, password (stored only as a one-way hash we cannot read), and a phone number if you give one. If you sign in with LINE instead, we receive the name, profile picture and — if you allow it — the email address LINE shares, plus your LINE user ID so we recognise you next time; no password, and we keep none of LINE’s access tokens. Used to create and run your account and to send you sign-in codes. Basis: performing our contract with you.
• Your orders — the recipient’s name, phone number and delivery address, any note you add, what you bought, what you paid and any coupon used. Used to process, deliver and support the order. Basis: our contract with you, and our legal duty to keep accounting and tax records. Digital-key orders need no address. If you buy a key or a pre-order without an account, we keep the email you give at checkout: your keys are emailed there, we tell you about the pre-order there, and the order moves to an account you later open with that address.
• Pre-orders — we email you when the stock arrives, at your account’s address or the one you gave at checkout. We record the deposit you paid, when the stock arrived and when the balance is due, and we email and notify you about it. Basis: our contract with you.
• Payments — you pay by PromptPay QR through our payment provider, Beam. We send Beam only the amount and our order number, and receive back whether and when you paid. We never see or store card or bank-account details.
• Saved addresses and wishlist — kept in your account so you do not have to enter them again. Basis: our contract with you.
• Reviews — if you review something you bought, the review is shown publicly together with your account name. Basis: our legitimate interest in showing genuine buyers’ reviews. Ask us and we will remove a review.
• Marketing email — only if you ticked the separate box when you registered. Basis: your consent, which you can withdraw at any time by emailing us.
• News on LINE — only if you linked LINE and ticked “Send me news on LINE” in your account settings, a consent separate from marketing email. Basis: your consent, which you withdraw by unticking it or unlinking LINE.
• Notifications — if you turn on browser notifications (for example “payment received”), we store your browser’s push address and its user-agent string. Turn them off in your browser at any time.
• Keeping the shop safe — your IP address is used for a few minutes, in memory only, to slow down repeated sign-in, checkout and similar attempts. It is not written to our database. Basis: our legitimate interest in preventing abuse.
• Visit statistics — Vercel Web Analytics counts page views and a few shop events (such as adding to the bag) without cookies and without identifying you. Order links and unrelated URL parameters are stripped before anything is sent. Basis: our legitimate interest in understanding which pages work.
• Session recordings — Microsoft Clarity, only if you accept optional cookies. See section 3.
• Advertising measurement — the Meta Pixel, a report to Meta when an order you placed is paid, and a report to Google Ads when an order you placed after clicking a Google ad is paid, only if you accept optional cookies. See section 3.
• Messages — if you contact us on LINE or Instagram, those conversations are held by LINE or Meta under their own policies; we use them to answer you.

Giving us your details is up to you, but without a name, phone number and address we cannot deliver a parcel, and without an email address we cannot open an account.

3. Cookies and similar technologies

Strictly necessary — always on, because the shop does not work without them:

Optional: Microsoft Clarity — only if you press “Accept” on the cookie banner. One answer covers Clarity and the Meta Pixel below. Clarity records how you use our pages — clicks, taps, scrolling, mouse movement, the pages you visit, your device and browser, and your approximate location worked out from your IP address — so we can see where the shop is confusing and fix it. What you type into forms is hidden; the checkout, account and address screens are hidden entirely; and order pages are never recorded. Microsoft keeps recordings for 30 days (a small random sample, and any we mark as favourites, for up to 9 months) on its Azure cloud.

Basis: your consent. You can change your answer whenever you like — withdrawing it deletes Clarity’s cookies on our site and stops the recording: Cookie settings

Optional: Meta Pixel — only if you press “Accept” on the cookie banner. It tells Meta Platforms (Facebook, Instagram) which pages of the shop you visit and which products you look at, add to your bag and take to checkout, so we can tell which of our ads work and show them to people likely to be interested. Order pages are never reported. When an order you placed is paid, we also tell Meta from our server: what was bought and for how much, your email address and phone number scrambled with a one-way hash (SHA-256), your IP address, your browser’s user-agent string and the Meta cookies below — so Meta can match the purchase to an ad you saw. We never send your name, your address or anything that opens your order. Meta links this to your Facebook or Instagram account if you have one, and uses it under its own privacy policy as well as for us.

Basis: your consent. Withdrawing it deletes the Meta cookies on our site and stops the Pixel, and a purchase made after that is not reported: Cookie settings

Optional: Google Ads click — only if you press “Accept”. When you arrive from a Google ad, the link carries a click code from Google (gclid). We keep it in a cookie and with your order, and when that order is paid, Google Ads collects from our server the click code, the time and the amount — nothing else: no name, no contact details, no order number. No Google script runs on our pages for this. The click code is deleted from your order after 90 days, or straight away if the order is never paid.

Basis: your consent. Withdrawing it deletes this cookie: Cookie settings

Optional: YouTube videos that play by themselves — the packing videos on our home page and on the Packed & shipped page are on YouTube. If you press “Accept”, they start playing, silently, when they scroll into view. That loads Google’s YouTube player (from youtube-nocookie.com), which sees your IP address, device and browser, and can store its own cookies and browser data under Google’s privacy policy. If you decline, a video shows only a still picture, and the player loads only when you press play — as with game trailers on product pages.

Basis: your consent for the autoplay; your request when you press play. Withdrawing consent stops videos playing by themselves: Cookie settings

4. Who else sees your data

We do not sell your data. We share only what each service needs to do its job for us:

• Vercel — hosts the website (servers in Singapore) and provides the visit statistics above.
• Neon — our database (servers in Singapore). Phone numbers and addresses are encrypted before they are stored.
• Beam — takes the PromptPay payment (amount and order number only).
• Mailtrap — delivers our emails, such as sign-in codes, pre-order arrival notices and keys bought without an account (your email address, and the order details — or the key — in the message).
• LINE (LY Corporation) — only if you sign in with or link LINE: LINE confirms who you are and shares the profile you approve. With LINE linked, your receipts are sent to you on LINE from our official account (the order number, items and amounts), and news too if you ticked “Send me news on LINE”.
• Telegram — tells us about new orders: order number, total, the recipient’s name and the items.
• Browser push services (Google, Apple, Mozilla, Microsoft) — deliver notifications you turned on.
• Microsoft — Clarity, only if you accept optional cookies.
• Meta Platforms — the Meta Pixel and purchase reports, only if you accept optional cookies (section 3).
• Google (Google Ads) — the click code, time and amount of a paid order that came from a Google ad, only if you accept optional cookies (section 3).
• Google (YouTube) — packing videos and game trailers; the player loads when you press play, or by itself if you accept optional cookies (section 3).
• The delivery company we hand your parcel to — the recipient’s name, phone number and address.
• Authorities — when the law requires us to.

5. Data sent outside Thailand

Our website and database run in Singapore, and some of the services above are based in the United States or elsewhere. When your data leaves Thailand we rely on these providers’ contractual data protection commitments, as the PDPA allows, and send them no more than they need.

6. How long we keep it

• Account details, saved addresses, wishlist — while your account is open. Ask us to close it and we delete or anonymise them, except what the law makes us keep.
• Paid orders and payment records — 5 years, as Thai accounting and tax law requires, then deleted.
• Orders that were never paid — up to 12 months, to answer payment questions, then deleted.
• Reviews — until you or we remove them. If your account is closed, a review stays but is shown as anonymous.
• Marketing consent — until you withdraw it.
• Notification subscriptions — until you turn notifications off or your browser stops accepting them.
• Clarity recordings — as described in section 3.
• Advertising data — what we hold to report a purchase to Meta (the Meta cookies, IP address and user agent from checkout) is deleted as soon as the report is sent, or when an unpaid order expires. A Google Ads click code is deleted from its order after 90 days, or when an unpaid order expires. What Meta and Google receive they keep under their own policies.

7. Your rights

Under the PDPA you can ask us to:

• give you access to, or a copy of, the personal data we hold about you;
• send it to you, or to another business, in a common electronic format;
• correct anything that is wrong or out of date;
• delete or anonymise it;
• stop or limit using it for a while;
• stop using it where we rely on our legitimate interests;
• withdraw any consent you gave — this does not affect what we did before you withdrew it.

Email sidequestshop99@gmail.com. We may ask you to confirm who you are, and we reply within 30 days. Where the law makes us keep something (tax records, for example) we will tell you what we cannot delete and why. You can also complain to the Office of the Personal Data Protection Committee (PDPC), www.pdpc.or.th.

8. Security

The site is served only over HTTPS. Phone numbers and addresses are encrypted in our database, passwords are stored as one-way hashes, sign-in sessions are stored as hashes, and only the shop’s owner and staff can open orders. If a breach puts your data at risk we will tell the PDPC and, where the risk is high, you.

9. Children

The shop is meant for adults. If you are under 20, please ask a parent or guardian to agree before you create an account or place an order. We do not knowingly collect data from children under 10; if you think we have, email us and we will delete it.

10. Changes to this policy

We will update the date at the top whenever this policy changes. If a change affects the cookie choice you made, the cookie banner will ask you again.