Legal

Privacy
Policy

Effective date: 3 May 2026 (last updated 28 July 2026) · Lashberry House, Bangkok

This Privacy Policy explains how Lashberry House collects, uses, stores, and protects your personal data in compliance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA), which came into full force on 1 June 2022. We take your privacy seriously and are committed to handling your information transparently and lawfully.

Also see:Terms of Service →

1. Who We Are (Data Controller)

1.1

The data controller responsible for your personal data is:

Lashberry House
99 Nasa Street Building, Unit L03-B01, 3rd Floor
Ramkhamhaeng Road, Suan Luang
Bangkok 10250, Thailand
+66 87 807 5440
info@lashberryhouse.com

1.2

For all privacy-related enquiries, data subject requests, or consent withdrawal, please contact us at privacy@lashberryhouse.com.

2. Personal Data We Collect

We collect the following categories of personal data:

A. Identification & Contact Data

Full name, phone number, and email address (collected at booking)
LINE ID or social profile (if you contact us via LINE or social media)

B. Booking & Service Data

Appointment history, service preferences, and therapist notes
Booking date, time, and confirmation records
Payment transaction records (amounts; card details are not stored by us)

C. Health & Sensitive Data ⚠ Sensitive

Allergy history, skin type, eye conditions, or medical disclosures relevant to your treatment
Patch test records and results
Pre-treatment health screening information

Health data is classified as sensitive personal data under the PDPA and is collected only with your explicit consent and solely for the purpose of delivering safe, appropriate services.

D. Photography & Visual Data

Before/after service photographs (with your explicit consent)
Images shared by you on social media tagging our studio

E. Website & Technical Data

Browser type, device type, pages visited, and session duration (via analytics)
IP address and approximate location (country/city level)
Cookie data (see Section 9)

3. How & Why We Use Your Data

We process your personal data only for the following purposes and on the legal bases stated:

Purpose	Data Used	Legal Basis
Booking & appointment management	Name, phone, email, booking records	Contract performance
Delivering beauty services safely	Health, allergy, and treatment data	Explicit consent (sensitive data)
Payment processing	Transaction amount, reference	Contract performance
Service quality & aftercare follow-up	Booking history, contact details	Legitimate interest
Marketing & promotions (with opt-in)	Name, email, phone	Consent
Before/after photography for portfolio	Photographs	Explicit consent
Studio security (CCTV)	Visual footage	Legitimate interest
Website analytics & improvement	Technical/cookie data	Legitimate interest / Consent
Legal compliance & dispute resolution	Relevant personal data	Legal obligation

4. Sharing Your Personal Data

4.1

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

4.2

Your data may be shared with the following categories of trusted service providers who process data on our behalf under strict contractual obligations:

Online booking system provider (appointment scheduling software)
Payment gateway provider (for secure transaction processing)
Email and messaging service providers (for booking confirmations)
Website hosting and analytics providers
Accounting and invoicing software

4.3

We may disclose your data if required by Thai law, court order, or government authority, or to protect the legal rights and safety of Lashberry House, our staff, or clients.

4.4

Cross-border transfers: Some of our service providers (e.g., cloud hosting, booking software) may be based outside Thailand. Where data is transferred internationally, we ensure appropriate safeguards are in place in compliance with PDPA Section 28 and the PDPC's cross-border transfer notifications effective 24 March 2024.

5. How Long We Keep Your Data

Data Category	Retention Period
Client booking records & service history	3 years from last appointment
Health / allergy disclosures	3 years from last appointment, then securely deleted
Payment transaction records	5 years (Thai accounting/tax law)
Before/after photographs (consented)	Until consent is withdrawn, or 3 years
CCTV footage	30 days, then automatically overwritten
Marketing contact lists	Until consent is withdrawn or opt-out requested
Website analytics data	13 months (anonymised after 90 days)

After the applicable retention period, data is securely deleted or anonymised so that it can no longer be attributed to you.

6. Your Rights Under the PDPA

As a data subject under Thailand's PDPA, you have the following rights. All requests will be responded to within 30 days of receipt.

Right	What it means
Access	Request a copy of the personal data we hold about you.
Rectification	Ask us to correct inaccurate or incomplete data.
Erasure	Request deletion of your personal data where no longer necessary.
Portability	Receive your data in a structured, machine-readable format.
Restriction	Ask us to limit how we use your data in certain circumstances.
Object	Object to processing based on legitimate interest, including direct marketing.
Withdraw Consent	Withdraw consent at any time without affecting prior lawful processing.
Lodge a Complaint	File a complaint with Thailand's PDPC at pdpc.or.th.

To exercise any of these rights, contact us at privacy@lashberryhouse.com with your name, contact details, and a description of your request. We may ask you to verify your identity before processing the request.

7. How We Protect Your Data

7.1

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include password-protected systems, restricted staff access on a need-to-know basis, and encrypted data transmission (HTTPS).

7.2

Access to client records is limited to authorised Lashberry House personnel involved in delivering your service or managing your booking.

7.3

Data breach notification: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify Thailand's Personal Data Protection Committee (PDPC) within 72 hours of becoming aware of the breach, and notify affected individuals without undue delay as required by law.

8. Minors

8.1

Our services are available to clients of all ages, including minors. For clients under 20 years of age, we require verifiable parental or guardian consent prior to collecting sensitive personal data (health information) and prior to providing certain chemical or advanced treatments.

8.2

For clients under 10 years of age, parental/guardian consent is required for all personal data processing without exception.

8.3

We do not knowingly market our services directly to minors without parental consent.

9. Cookies & Website Tracking

9.1

Our website uses cookies and similar technologies to improve your browsing experience, analyse site traffic, and support booking functionality.

9.2

Essential cookies are required for the booking system and website to function. These cannot be disabled.

9.3

Analytics cookies (e.g., Google Analytics) help us understand how visitors use our site. These are only set with your consent.

9.4

You can manage or withdraw cookie consent at any time using the control (also available in the website footer) or through your browser settings. Withdrawing consent stops further analytics/advertising storage and deletes the advertising click identifiers we hold in your browser. Disabling non-essential cookies will not affect your ability to book an appointment.

9.5

Microsoft Clarity. Clarity loads only after you accept analytics cookies. We use Microsoft Clarity to understand, in aggregate, how visitors use our website — including heatmaps and session recordings — so we can improve navigation and the booking experience. Clarity collects high-level interaction data (such as clicks, scrolling, and mouse movement), device and browser information, and the pages visited. Booking and customer form fields remain masked by Clarity's default settings, and we do not intentionally use Clarity to capture sensitive customer details. Microsoft's handling of this data is described in the Microsoft Privacy Statement and the Microsoft Clarity Terms.

9.6

First-party website analytics. We also run our own lightweight, first-party analytics to understand aggregate site usage (pages viewed, booking funnel steps, and which contact links are used). These measurements are cookieless and use only a per-tab session identifier that is discarded when you close the tab. We derive an approximate location (country/region only) from network request headers and never store your IP address for analytics. This data contains no names, phone numbers, emails, notes or payment details, is retained for 13 months, and is honoured only when you have not enabled a Do-Not-Track or Global Privacy Control browser signal — if either signal is present, we collect nothing.

9A. Advertising, Click IDs & Conversion Measurement / การวัดผลโฆษณา / 广告与转化衡量

9A.1

Google Ads click identifiers. If you arrive at our website from a Google advertisement and you have accepted analytics/advertising cookies, we store the advertising click identifier from the URL (GCLID, GBRAID or WBRAID) and campaign parameters in your browser for up to 90 days. Without your consent, these identifiers are not stored persistently. Google tags load only after consent, using Google Consent Mode v2 with all storage denied by default.

9A.2

Offline conversion measurement. When a booking deposit is confirmed by our staff, we may report that a conversion occurred to Google Ads (via Google's Data Manager conversion import) using the click identifier, the booking value and time. If — and only if — you accepted analytics/advertising cookies, this report may also include your email address and phone number in hashed (SHA-256, irreversible) form so Google can improve conversion matching. We never send your name, raw email, raw phone number, notes or any health information to Google.

9A.3

Retention & withdrawal. Click identifiers expire from your browser after 90 days; conversion records retain only hashed identifiers. You can withdraw consent at any time via Cookie Settings, which stops further advertising measurement and deletes stored click identifiers — bookings made after withdrawal are reported without hashed contact data, or not attributed at all. We do not sell your personal data.

ภาษาไทย: หากคุณเข้าชมเว็บไซต์ของเราผ่านโฆษณา Google และยอมรับคุกกี้เพื่อการวิเคราะห์/โฆษณา เราจะจัดเก็บรหัสคลิกโฆษณา (GCLID/GBRAID/WBRAID) และพารามิเตอร์แคมเปญไว้ในเบราว์เซอร์ของคุณสูงสุด 90 วัน หากไม่ได้รับความยินยอม จะไม่มีการจัดเก็บถาวร เมื่อเจ้าหน้าที่ยืนยันมัดจำการจอง เราอาจรายงานคอนเวอร์ชันไปยัง Google Ads โดยใช้รหัสคลิก มูลค่า และเวลาการจอง และเฉพาะกรณีที่คุณให้ความยินยอมเท่านั้น อาจรวมอีเมลและ เบอร์โทรศัพท์ในรูปแบบแฮช (SHA-256 ไม่สามารถย้อนกลับได้) เราไม่ส่งข้อมูลส่วนบุคคลดิบให้ Google คุณสามารถถอนความยินยอมได้ตลอดเวลาผ่าน "Cookie Settings" ซึ่งจะลบรหัสคลิกที่จัดเก็บไว้ เราไม่ขายข้อมูลส่วนบุคคลของคุณ

中文： 如果您通过 Google 广告访问本网站并接受了分析/广告 Cookie，我们会在您的浏览器中存储广告点击标识符（GCLID/GBRAID/WBRAID）及广告系列参数，最长 90 天；未经同意不会进行持久化存储。当工作人员确认预约定金后，我们可能通过 Google 的转化导入功能向 Google Ads 报告转化（点击标识符、预约金额和时间）。仅在您同意的情况下，报告才可能包含经 SHA-256 不可逆哈希处理的邮箱和电话号码。我们绝不会向 Google 发送原始个人信息。您可随时通过"Cookie 设置"撤回同意，撤回后将删除已存储的点击标识符。我们不会出售您的个人数据。

10. Consent & Marketing

10.1

We will only send you marketing messages (promotions, new services, special offers) if you have expressly opted in to receive them.

10.2

You can withdraw your marketing consent at any time by replying "STOP" to any message, emailing privacy@lashberryhouse.com, or contacting the studio directly. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

10.3

Transactional messages (booking confirmations, appointment reminders) are sent regardless of marketing preferences as they are necessary for the performance of your booking contract.

11. Changes to This Privacy Policy

11.1

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The current version is always available at lashberryhouse.com/privacy.

11.2

For material changes, we will provide reasonable notice via our website or LINE Official Account. Your continued use of our services after changes constitutes acceptance of the updated policy.

12. Regulatory Authority

If you are unsatisfied with how we handle your personal data or a privacy complaint, you have the right to lodge a complaint with Thailand's data protection authority:

Personal Data Protection Committee (PDPC)
Office of the National Digital Economy and Society Commission
Bangkok, Thailand
www.pdpc.or.th

Privacy requests & enquiries

Email: privacy@lashberryhouse.com
Phone: +66 87 807 5440
Studio hours: Daily 10:00–20:00 · Response within 30 days of request.

PrivacyPolicy