1) Who We Are
The Site is operated by The One For Nature.
- Registered/Trading name: The One For Nature
- Data controller contact: [email protected]
2) Scope
This policy describes how we collect, use, disclose and protect personal data when you visit the Site, make inquiries, place orders, create an account, subscribe to communications, or interact with us in other ways. Additional notices may apply to specific features, services or regions.
3) Data We Collect
3.1 Information you provide
- Contact details — name, email, phone, address.
- Account details — username, passwords, preferences.
- Order & payment information — billing, shipping, purchase history. (Card data is processed by our payment processor; we do not store full card numbers.)
- Communications — messages, support requests, survey responses.
3.2 Information collected automatically
- Device & usage data — IP address, browser type, operating system, referring URLs, pages viewed, and timestamps.
- Approximate location derived from your IP address.
- Cookies, pixels, SDKs and similar technologies; see Cookies.
3.3 Information from third parties
- Payment processors, logistics providers, analytics and advertising partners.
- Public sources or social media (when you interact with our accounts).
Sensitive data: We do not seek to collect sensitive personal data unless required and with your explicit consent.
Children: The Site is not intended for children under 16. If you believe a child has provided personal data, contact us to request deletion.
4) How We Use Data & Legal Bases
- Provide, operate and improve the Site and our services.
- Process orders, payments, deliveries and returns.
- Communicate with you about your account, orders or inquiries.
- Send marketing with your consent or as permitted by law (opt‑out anytime).
- Personalize content and measure performance.
- Detect, prevent and investigate fraud, abuse and security incidents.
- Comply with legal obligations and enforce our terms.
Where laws require a lawful basis (e.g., GDPR/UK GDPR), we rely on one or more of: consent, contract, legitimate interests, legal obligation, or vital interests.
5) Cookies & Similar Technologies
We use first‑party and third‑party cookies and similar technologies to operate the Site, remember your settings, understand usage, and personalize content. You can manage cookies via your browser settings or, where available, a cookie banner.
Cookie Categories
- Strictly necessary — required for core functionality (e.g., cart, login).
- Preferences — remember choices (e.g., language).
- Analytics — measure traffic and performance.
- Marketing — personalize ads and measure their effectiveness.
To review or change preferences, use the Site’s cookie settings: Manage Cookies
Example third‑party cookies you may use (replace as appropriate): Google Analytics, Meta Pixel, YouTube, Cloudflare
6) Analytics, Ads & Third Parties
Where enabled, we work with service providers who may process data on our behalf, including:
- Analytics providers — Google Analytics / Plausible
- Advertising partners — Meta, Google Ads, etc.
- Email & CRM — Mailchimp, SendGrid, etc.
- Logistics — DHL, Kerry, Thailand Post, etc.
- Hosting/CDN — Cloudflare, AWS, Vercel, etc.
These providers may set their own cookies or receive certain information when you use the Site. Where required, we will seek your consent before enabling non‑essential cookies.
7) Sharing & Disclosure
- Service providers who help us operate the Site and deliver services under contracts that protect your data.
- Business transfers in connection with a merger, acquisition or reorganization.
- Legal compliance to comply with law, respond to lawful requests, or protect rights, safety and property.
- With your consent or at your direction.
We do not sell personal information. If we engage in “sharing” for cross‑context behavioral advertising as defined by some laws, we will provide the required notices and opt‑out mechanisms.
8) International Transfers
Your data may be processed in countries other than where you reside. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) to protect cross‑border transfers.
9) Data Retention
We keep personal data only as long as necessary for the purposes described, including to comply with legal, tax and accounting requirements, resolve disputes and enforce agreements. Specific retention periods vary by data type and context.
10) Security
We implement administrative, technical and physical safeguards designed to protect personal data. No method of transmission or storage is 100% secure. If we discover a security incident that affects your data, we will notify you and/or regulators as required by law.
11) Your Privacy Rights
Depending on your location, you may have rights such as:
- Access — request a copy of your personal data.
- Correct — update or rectify inaccurate data.
- Delete — ask us to delete your data.
- Portability — receive data in a structured, commonly used format.
- Restrict/Object — limit or object to certain processing (including direct marketing).
- Withdraw consent — where processing is based on consent.
Region‑Specific
Thailand (PDPA)
Rights include access, correction, deletion, portability, and withdrawal of consent. You may also lodge a complaint with the Personal Data Protection Committee (PDPC).
EEA/UK (GDPR/UK GDPR)
In addition to the above, you may object to processing based on our legitimate interests and lodge a complaint with your supervisory authority.
California (CCPA/CPRA)
Residents may request access, deletion, correction, and to opt‑out of sale/“sharing” and limit the use of sensitive personal information. We will not discriminate for exercising these rights.
How to exercise your rights
Submit your request to [email protected]. We may need to verify your identity and request details to process your request. Authorized agents may submit requests where permitted by law.
12) Do Not Track / Global Privacy Control
Your browser may offer a “Do Not Track” signal and/or Global Privacy Control (GPC). Where required by law, we will treat a valid GPC signal as a request to opt‑out of sale/“sharing” for the browser or device that sends it.
13) Changes to This Policy
We may update this policy from time to time. The “Effective” date at the top shows when it was last revised. Significant changes will be communicated via the Site or by contacting you directly, where appropriate.