Last updated: May 2026

1. INTRODUCTION

www.bodylumestudio.com ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website www.bodylumestudio.com and make purchases from us.

We operate globally and serve customers worldwide. This Privacy Policy is designed to comply with applicable privacy laws across multiple jurisdictions, including but not limited to:

• The Personal Data Protection Act B.E. 2562 (2019) (PDPA) — Thailand
• The General Data Protection Regulation (GDPR) 2016/679 — European Union and European Economic Area
• The UK General Data Protection Regulation (UK GDPR) — United Kingdom
• The California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) — California, USA
• The Personal Information Protection and Electronic Documents Act (PIPEDA) — Canada
• Other applicable local privacy laws where you are located

By using our website or purchasing our products, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not access or use our website.

----

2. DATA CONTROLLER

The Data Controller responsible for your personal data is:

bodylume.studio
Email: bodylumestudio@gmail.com/ bodylumestudiosupport@gmail.com
Website: www.bodylumestudio.com

For customers in the European Union, European Economic Area, or United Kingdom, we are the Data Controller as defined under the GDPR and UK GDPR. If required by applicable law, we will appoint a local representative — please contact us for details.

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at bodylumestudiosupport@gmail.com.

----

3. PERSONAL DATA WE COLLECT

We collect personal data that you provide to us directly, as well as data collected automatically when you use our website.

3.1 Data You Provide Directly

When you create an account, place an order, or contact us, we may collect:

• Identity data: first name, last name
• Contact data: email address, telephone number, billing address, shipping address
• Financial data: payment card details (processed securely through our payment provider — we do not store full card numbers)
• Transaction data: details of products you have purchased, order history, and payment records
• Account data: username and password (stored in encrypted form)
• Communication data: messages, emails, or correspondence you send us, including customer service inquiries

3.2 Data Collected Automatically

When you visit our website, we may automatically collect:

• Usage data: pages you visit, time spent on each page, links you click, referring URLs
• Device data: IP address, browser type and version, operating system, device identifiers
• Location data: general geographic location derived from your IP address
• Cookie data: information stored via cookies and similar technologies (see Section 8)

3.3 Data from Third Parties

We may receive data about you from third-party service providers such as payment processors, shipping companies, and analytics providers, only to the extent necessary to fulfill your order or improve our services.

3.4 Sensitive Personal Data

We do not intentionally collect sensitive personal data (such as health information, racial or ethnic origin, religious beliefs, or biometric data). Please do not submit such information to us.

----

4. LAWFUL BASIS FOR PROCESSING

We must have a lawful basis for processing your personal data. Depending on your jurisdiction, we rely on the following:

• Processing and fulfilling your orders — Performance of a contract
• Creating and managing your account — Performance of a contract
• Sending order confirmations and updates — Performance of a contract
• Complying with legal obligations (tax, accounting, customs) — Legal obligation
• Sending marketing emails and promotions — Consent (you may withdraw at any time)
• Improving our website and services — Legitimate interest
• Preventing fraud and ensuring security — Legitimate interest / Legal obligation
• Responding to your inquiries — Legitimate interest / Performance of a contract

Where we rely on consent as our lawful basis, you have the right to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

Where we rely on legitimate interest, we have assessed that our interests are not overridden by your rights and freedoms. You may object to this processing at any time (see Section 11).

----

5. HOW WE USE YOUR PERSONAL DATA

We use the personal data we collect to:

• Process and fulfill your orders, including arranging international shipping and delivery
• Send you order confirmations, invoices, and shipping notifications
• Create and maintain your customer account
• Respond to your customer service inquiries and complaints
• Send you marketing communications, newsletters, and promotional offers (where you have opted in)
• Personalize your shopping experience and show you relevant products
• Conduct analytics to understand how our website is used and to improve it
• Detect, investigate, and prevent fraudulent transactions and other illegal activities
• Comply with legal and regulatory obligations in Thailand and other applicable jurisdictions
• Enforce our Terms of Service and other agreements

We will not use your personal data for purposes incompatible with those listed above without first obtaining your consent.

----

6. DISCLOSURE OF YOUR PERSONAL DATA

We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients only to the extent necessary:

Service Providers: Trusted third-party companies that help us operate our business, including:

• Payment processors (e.g., Stripe, Omise, or equivalent) to process transactions
• Shipping and logistics providers (e.g., DHL, FedEx, Thailand Post, or equivalent) to deliver your orders internationally
• E-commerce platform providers (Shopify) to host and operate our online store
• Email service providers to send transactional and marketing emails
• Analytics providers (e.g., Google Analytics) to help us understand website usage
• Customer support tools to manage inquiries

All service providers are contractually required to process your data only on our instructions and to maintain appropriate security standards.

Legal Compliance: We may disclose your personal data to government authorities, law enforcement, tax authorities, or regulators where required by applicable law or a lawful court order in any jurisdiction.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy. We will notify you before your data becomes subject to a different privacy policy.

With Your Consent: We may share your data with other third parties where you have given us explicit consent to do so.

----

7. INTERNATIONAL DATA TRANSFERS

We are based in Thailand and our service providers operate globally. Your personal data may be transferred to, stored, and processed in countries outside your home country, including Thailand, the United States, and other countries where our service providers operate.

When transferring personal data internationally, we ensure appropriate safeguards are in place, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission or UK ICO, for transfers from the EU/EEA and UK
• Adequacy decisions where the destination country has been recognized as providing an adequate level of data protection
• Binding Corporate Rules or other legally recognized transfer mechanisms
• Compliance with the PDPA's cross-border transfer requirements for transfers from Thailand

By using our website, you acknowledge that your data may be transferred internationally. We will always ensure your data receives an equivalent level of protection regardless of where it is processed.

----

8. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies on our website. When you first visit our website, we will ask for your consent before placing non-essential cookies on your device (as required under GDPR and similar laws).

Strictly necessary cookies: Required for the website to function (e.g., keeping items in your cart, maintaining your login session). No consent required.

Performance/analytics cookies: Help us understand how visitors interact with our website. Requires consent in applicable jurisdictions.

Functional cookies: Remember your preferences (e.g., language, currency, region). Requires consent in applicable jurisdictions.

Marketing/advertising cookies: Track your activity to deliver relevant advertisements across websites. Requires consent in applicable jurisdictions.

You can manage or withdraw your cookie consent at any time through our cookie consent banner or through your browser settings. Withdrawing consent for non-essential cookies will not affect your ability to use the website. For more information about cookies, visit www.allaboutcookies.org.

----

9. DATA RETENTION

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law.

• Order and transaction records: 5–7 years (as required by tax and accounting laws in applicable jurisdictions)
• Customer account data: Until account deletion, plus 1 year
• Marketing preferences and consent records: Until you unsubscribe or withdraw consent, plus 3 years (to demonstrate compliance)
• Customer service communications: 2 years from last contact
• Website analytics data: 26 months
• Cookie consent records: 1 year

When we no longer need your personal data, we will securely delete or anonymize it.

----

10. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data. These include:

• SSL/TLS encryption for all data transmitted between your browser and our website
• Encrypted storage of passwords and sensitive data
• Access controls limiting who can access your data within our organization
• Regular security assessments and updates
• Secure third-party payment processing (we do not store full card details)
• Data minimization — we only collect what is necessary

No method of transmission over the Internet is 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authorities and, where required, notify you directly within the timeframes required by applicable law (e.g., 72 hours under GDPR, as soon as practicable under PDPA).

----

11. YOUR PRIVACY RIGHTS

Depending on your location, you have specific rights regarding your personal data. We honor all requests regardless of jurisdiction — please contact us at bodylumestudiosupport@gmail.com to exercise any of the rights below.

Rights available to all customers globally:

• Right to be Informed — Know what data we collect and how we use it (this Policy fulfills that obligation)
• Right of Access — Request a copy of the personal data we hold about you
• Right to Rectification — Request correction of inaccurate or incomplete data
• Right to Erasure — Request deletion of your data where there is no lawful basis to retain it
• Right to Restriction — Request that we limit processing of your data in certain circumstances
• Right to Data Portability — Receive your data in a structured, machine-readable format
• Right to Object — Object to processing based on legitimate interest, including direct marketing
• Right to Withdraw Consent — Withdraw consent at any time where processing is consent-based

Additional rights for EU / EEA / UK customers (GDPR / UK GDPR):

In addition to the rights above, you have the right to lodge a complaint with your local supervisory authority. In the EU, this is the data protection authority of your Member State. In the UK, this is the Information Commissioner's Office (ICO) at www.ico.org.uk. You also have the right not to be subject to solely automated decision-making that produces legal or significant effects on you.

Additional rights for California residents (CCPA / CPRA):

• Right to Know — Request details about the categories and specific pieces of personal information we have collected about you, the sources, business purposes, and third parties we share it with
• Right to Delete — Request deletion of your personal information, subject to certain exceptions
• Right to Correct — Request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing — We do not sell or share your personal information for cross-context behavioral advertising. If this changes, we will provide a "Do Not Sell or Share My Personal Information" link on our website
• Right to Limit Use of Sensitive Personal Information — We do not use sensitive personal information beyond what is necessary to provide our services
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights

Additional rights for Thai customers (PDPA):

All rights listed above apply. To exercise your PDPA rights specifically, contact us at bodylumestudiosupport@gmail.com. We will respond within 30 days, with a possible extension of 60 days for complex requests.

Additional rights for Canadian customers (PIPEDA):

You have the right to access your personal information and challenge its accuracy. You may also file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

How to submit a request:

Email bodylumestudiosupport@gmail.com with your full name, email address, country of residence, and a description of your request. We will respond within 30 days (or within the timeframe required by your local law). We may need to verify your identity before processing your request. We will not charge a fee unless your request is manifestly unfounded or excessive.

----

12. MARKETING COMMUNICATIONS

With your consent, we may send you marketing emails about new products, promotions, and offers. You can opt out at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email
• Emailing us at bodylumestudiosupport@gmail.com with "Unsubscribe" in the subject line
• Updating your preferences in your account settings

Opting out of marketing will not affect transactional emails related to your orders. We will honor opt-out requests within 10 business days.

----

13. CHILDREN'S PRIVACY

Our website and services are not directed at minors. We apply the most protective standard applicable based on your location:

• Thailand: Under 20 years old
• EU / EEA / UK: Under 16 years old (or lower age as set by your Member State)
• United States: Under 13 years old (COPPA)
• All other countries: Under 18 years old, or the applicable age of majority in your jurisdiction

We do not knowingly collect personal data from minors without verified parental or guardian consent. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at bodylumestudiosupport@gmail.com and we will promptly delete that data.

----

14. LINKS TO THIRD-PARTY WEBSITES

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites you visit.

----

15. COMPLAINTS AND SUPERVISORY AUTHORITIES

We take privacy complaints seriously. If you are unhappy with how we have handled your personal data, please contact us first at bodylumestudiosupport@gmail.com — we will do our best to resolve your concern promptly.

If you are not satisfied with our response, you have the right to contact the relevant supervisory authority in your jurisdiction:

• Thailand: Personal Data Protection Committee (PDPC) — www.pdpc.or.th
• EU/EEA: Your local data protection authority — www.edpb.europa.eu
• UK: Information Commissioner's Office (ICO) — www.ico.org.uk
• Canada: Office of the Privacy Commissioner — www.priv.gc.ca
• Australia: Office of the Australian Information Commissioner — www.oaic.gov.au
• Other countries: The relevant national data protection authority

----

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated version on this page with a revised "Last updated" date.

For significant changes that materially affect how we use your personal data, we will notify you by email (if you have an account with us) or by displaying a prominent notice on our website before the changes take effect. Where required by law, we will seek your renewed consent.

Your continued use of our website after changes have been posted constitutes acceptance of the updated Privacy Policy.

----

17. CONTACT US

bodylume.studio
Email: bodylumestudiosupport@gmail.com
Website: www.bodylumestudio.com

We aim to respond to all privacy-related inquiries within 30 days.