Privacy policy

Last updated: 9 September 2026

This policy explains what personal information MUMS collects, why we collect it, who else sees it, how long we keep it, and what you can do about it. It is written to meet our obligations under Thailand's Personal Data Protection Act B.E. 2562 (2019), the PDPA.

Who this covers. It covers our website at mumstreats.com, our shops, and people who apply for a job with us. It does not cover our own staff, who get a separate notice.

Who we are. M.U.M.S (Thailand) Co., Ltd. is the data controller for the information described here. Our details are at the bottom of this page.

What we collect

  • When you order — your name, email address, phone number, delivery address, what you bought and what you paid.
  • When you pay — your payment is handled by Omise (Opn) or PayPal, who take your card or account details directly. We never receive or store your full card number.
  • If you create an account — your login identity, saved addresses and order history.
  • If you start a checkout and don't finish it — we keep the contents of that cart and, if you were signed in or had entered your details, your identity alongside it.
  • When you sign up for our newsletter — your email address, and your name if you give it.
  • When you message us — through the contact form, our chat widget, LINE, Instagram or TikTok: whatever you tell us, plus your name and the address you wrote from.
  • When you leave a review — your name, email address and what you wrote. Your name is published publicly next to the review.
  • When you shop in one of our shops — if you give us your details at the till, we keep your name, phone number and purchase history.
  • When you apply for a job — your name, email, phone, the role and shop you are interested in, when you can start, any links you share, your letter, and the files you attach: your CV, and optionally a letter and a photo.
  • As you browse — your IP address, device and browser, and what you looked at, clicked and bought. See Cookies and tracking below.

Why we use it, and our legal basis

Under the PDPA we must have a lawful basis for everything we do with your information. Ours are:

  • To take, pack and deliver your order, and to deal with returns and refunds — because we need to in order to perform our contract with you (s.24(3)).
  • To keep accounting and tax records — because Thai law requires it (s.24(6)).
  • To answer your messages, prevent fraud, keep the site secure and stop abuse of our forms — for our legitimate interests in running the business safely (s.24(5)).
  • To send you marketing email, and to show you advertising — with your consent (s.19). You can withdraw it at any time.
  • To consider you for a job — with your consent, and because it is a step towards a possible employment contract. We ask for that consent on the application form and we record it.
  • To publish your review — with your consent, given when you submit it.

Cookies and tracking

We use cookies and similar technologies in three broad groups:

  • Essential — your cart, your session, security. The site does not work without these.
  • Analytics — how people find and move around the site, so we can improve it.
  • Advertising — measuring our ads and showing you relevant ones.

Some of this is run by other companies on our behalf, and we want to be straightforward about it. Our site currently runs a Meta (Facebook) advertising pixel, Google Analytics, a Judge.me reviews tag, an Instagram feed widget, and Bitly link attribution. The Meta pixel is configured to share the events you trigger on our site — including pages viewed, items added to the cart and purchases made — with Meta, so we can measure and target our advertising.

We are being direct about something. At present these tools load when you arrive, and our site does not yet ask you first or give you a way to turn them off from the page. We are working on that. In the meantime, if you would rather not be tracked this way, you can:

Who else sees your information

We do not exchange your personal information for money. We do share it with companies that provide services to us, and — in the case of our advertising and analytics tools — with companies that also use it for their own purposes. Some privacy laws outside Thailand classify that second kind of sharing as a "sale" or "share" of data, so we would rather describe it plainly than give you a one-word answer:

  • Shopify — runs our online shop and stores our order and customer records.
  • Omise (Opn) and PayPal — take your payment. They act for themselves, under their own privacy policies, not as our service providers.
  • Delivery companies — get your name, address and phone number so they can deliver to you.
  • Google — analytics, and our email (Google Workspace), where messages you send us arrive.
  • Meta — advertising measurement and targeting, as described above. Meta uses that data for its own purposes as well as ours.
  • Judge.me — runs our product reviews and sends review invitations.
  • Getsitecontrol — runs the Instagram feed on our site. Bitly — link attribution.
  • Supabase and Resend — store and deliver job applications.
  • StoreHub — runs the tills in our shops.

We may also share information where the law requires it, or to establish or defend a legal claim.

Sending information outside Thailand

Most of the companies above are based outside Thailand, so running our business means your information travels. Shopify, Google, Meta, Judge.me, Getsitecontrol, Bitly, Resend and PayPal all process data outside Thailand. Job application files are stored on Supabase servers in Japan. Omise (Opn) is a Thai company.

Where we send your information abroad we rely on your consent, on the transfer being necessary to perform our contract with you, or on our agreements with those companies — and the destination country's data protection standards may not be the same as Thailand's.

Children

We sell sweets, and we know children like them. If you are under 20, please ask a parent or guardian before you give us your personal information, sign up to our newsletter or apply for a job — the PDPA generally requires their consent. If you believe a child has given us their information without that consent, email hello@mumstreats.com and we will delete it.

How long we keep it

  • Orders and accounting records — 5 years from the end of the accounting year, because Thai law requires it.
  • Your account — while you use it. We delete accounts with no order and no sign-in for 3 years.
  • Newsletter — until you unsubscribe, then 12 months. We keep a scrambled record of your address after that, purely so you are not accidentally added back.
  • Messages you send us — 24 months.
  • Shop customer records — 3 years from your last purchase.
  • Job applications, including your CV, letter and photo — 12 months, then deleted automatically, so we can consider you for roles that come up later. Ask us sooner and we will remove them.

Your rights

Under the PDPA you can ask us to:

  • See the personal information we hold about you, and get a copy (s.30);
  • Correct anything that is wrong or incomplete (s.36);
  • Delete it (s.33);
  • Send it on to you or someone else in a portable form (s.31);
  • Stop using it for a particular purpose (s.32);
  • Pause our use of it while something is being checked (s.34); and
  • Withdraw your consent at any time, as easily as you gave it (s.19). Withdrawing consent does not undo what we did lawfully beforehand.

Email hello@mumstreats.com and we will respond within 30 days. We may need to check who you are first. Some of these rights have limits — for example, we cannot delete records we are legally required to keep — and we will tell you plainly if that applies.

Complaints

If you are unhappy with how we have handled your information, please tell us first — we would rather fix it. You also have the right to complain to the Office of the Personal Data Protection Committee (PDPC) in Thailand.

Keeping your information safe

Job application files are held in private storage that is not publicly reachable, and the systems we use are access-controlled. No system is perfectly secure, so please do not send us sensitive information — identity documents, financial details — by email or social media unless we have asked you to.

Changes to this policy

We update this policy when what we do changes. The date at the top tells you when it last changed. If we change something significant we will say so on this page.

Contact us

For anything about your personal information, email hello@mumstreats.com — it reaches the person responsible for data protection here. You can also message us on LINE, or find us on Instagram and TikTok at @mums.th.

M.U.M.S (Thailand) Co., Ltd.
@AREA Floor 4 / Unit 4A3, 5, 15 Nonsi Rd, Chong Nonsi, Yan Nawa, Bangkok 10120, Thailand
Company Reg no: 0105568148618