YOUR DATA, YOUR RIGHTS

Privacy Policy

We value your personal information
and explain clearly how we use it.

Last updated and effective27 October 2026First issued 25 October 2026

Only the information needed

For your account, orders and support

Enter card details on Beam

QR and card payments are processed by Beam

You have rights over your information

Payment, visitor statistics and external service information last updated on 27 October 2026. This policy explains how JDC.CO.TH collects, uses and discloses personal information under Thailand's Personal Data Protection Act B.E. 2562 (2019) and applicable laws.

01AI-assisted search

When you use AI search, your query and public product information are sent to Tokenme.Limited to select products. Do not include personal or sensitive information. This feature does not send member accounts, orders, addresses or payment information, and JDC does not retain query text in its logs. Regular search remains available. Provider processing is subject to its own policies.

02Data controller

JDC.CO.TH is operated by J Distribution Co., Ltd. which is the data controller under this policy for our customers, members, contacts, quotation applicants and website users.

88/1343 Artisan Ratchada, 1st Floor, Soi Yot Suwan, Pracha Uthit Road, Huai Khwang, Bangkok 10310, Thailand

For personal information matters, contact contact@jdc.co.th Use the subject “Personal information request”, or call 02-402-5404 Monday–Saturday, 09:00–17:00

03Information we collect

Membership and contact details: Name, email, telephone number, membership number and tier, account status, benefits and cumulative purchases.
Authentication information: Hashed passwords, email verification information, sessions and a Google account reference when you choose that service.
Order information: Products, quantities, prices, discounts, delivery or pickup method, recipient, phone number, address for delivery only, order status and tracking number.
Payment and tax information: Evidence you submit and tax invoice details such as name, address, tax ID and branch, when requested.
Service information: Questions, company and contact details, quotation requests, after-sales history, purchase evidence, serial numbers and images necessary for verification.
Technical information: IP address, device, browser, access time, security event logs, cookies and browser storage.

Do not send unnecessary sensitive information, such as religion, health or biometric data. You may redact unrelated information in documents before sending them.

04Sources of information

We receive information directly from you when you register, order or contact us, and from buyers naming you as recipient, organizational representatives, Google when chosen for sign-in, carriers and providers involved in your transaction. If we obtain information elsewhere, we give the notice required by law unless an applicable exemption applies.

05Purposes and legal bases

We use information to	Relevant legal basis
Register and manage memberships, authenticate users, manage benefits, cumulative totals, orders, payments and delivery.	Performance of a contract or steps requested before entering a contract.
Answer questions, provide quotations and coordinate with organizational contacts.	Pre-contractual steps or legitimate interests assessed for necessity and impact on your rights.
Prepare accounting and tax records and respond to competent authorities.	Compliance with legal obligations.
Provide warranties, returns, refunds and after-sales support, and handle disputes.	Contract, legal duties or legitimate interests in establishing or defending claims, as applicable.
Prevent fraud, monitor system use and maintain security.	Legitimate interests, taking your rights and freedoms into account.
Send marketing or use technologies that require consent.	Consent that is separate from registration and can be withdrawn.

If you do not provide information marked as necessary for membership or orders, we may be unable to open your account, contact you, deliver goods or provide that service. Acknowledging this policy is not consent to marketing. Verification and order emails are service messages.

06Google sign-in

If you choose Google Sign-In, we receive your Google account ID, name, email and email verification status to authenticate you and link your JDC membership. We do not receive your Google password or request access to Gmail or Google Drive. You provide your telephone number separately.

Your Google link identifier is separate from your membership contact email. After verifying a new contact email, you can change it and still use the same Google account to access your existing account and history. Unlinking Google does not automatically delete orders or legally required records.

07Payments through Beam

Thai QR Payment, credit/debit cards, e-wallets, card installments and Buy Now, Pay Later use Beam Payment Gateway, provided by Beam Data Co., Ltd. to collect payments, verify transaction results and coordinate payment or refund matters.

Method / information	Use and data responsibility
Thai QR Payment	JDC sends Beam the amount, currency, reference, expiry and return URL for the order to create a QR code. You confirm in your banking app. We do not request your banking app password, PIN or OTP.
Credit / debit card	JDC sends Beam the amount, currency, order number or reference, total summary, link expiry and store return URL. You enter card details on Beam and authenticate through your bank. JDC.CO.TH has no fields for a full card number, expiry, CVV or OTP, and this card integration neither sends nor stores them through the store server.
E-wallet / card installments / BNPL	JDC sends Beam the fee-inclusive total, currency, reference, order summary, expiry, return URL and selected method or term. Wallet login, identity verification, credit applications and limit assessment take place on Beam or your chosen provider's service. We do not request wallet PINs, passwords, OTPs or credit assessment documents through this payment system. Providers may request more information and assess credit under their own policies; read these before confirming.
Information received and retained by the store	Original amount, fees, total, currency, method, selected term, status, date/time, transaction ID, QR identifier or payment link and refund result, plus card network and last four digits when returned by Beam. These link orders, verify payments, prevent duplicate payments, coordinate refunds and investigate disputes.

This payment creation system does not automatically send member names, shipping addresses, phone numbers or tax invoice data from the JDC database to Beam. Information you enter on Beam is handled under the provider's policy, including device, IP and activity records generated on its service.

When a method is changed or an order is canceled or deleted, we may retain necessary references and transaction history to check later payments, prevent duplicate payments, coordinate refunds and meet legal duties. Changing methods or deleting an order does not immediately erase payment evidence. Retention follows the section on Retention and backups

JDC is responsible for the member, order, delivery and transaction information it uses under this policy. Beam, banks, card networks, wallet and BNPL providers handle information according to their roles, purposes, laws and agreements. Using Beam does not exempt JDC from its data protection duties.

Payment data use relies on contract, legal duties or legitimate interests as applicable, separately from marketing consent. Information held by Beam follows its policy and terms.

Read Beam privacy policy ↗ or contact privacy@beamcheckout.com for information handled by Beam. For JDC member or order data, contact contact@jdc.co.th We will respond or coordinate within our responsibilities.

Send only the evidence needed

For payment checks, give your order number and payment proof with unrelated details hidden. Do not send a full card number, expiry, CVV, banking password or OTP by email, LINE or any store contact channel.

08Recipients of information

We disclose only necessary information to authorized staff; hosting, email, security, sales and after-sales providers; carriers; brands, distributors or service centers handling warranty claims; banks or payment providers for the method used; accountants, legal advisers and competent authorities.

Data processors must follow instructions, agreements and appropriate safeguards. Recipients acting as independent controllers have separate policies. We do not sell personal information to others for marketing.

09Retention and backups

Membership: While the account is active and as needed for continuing obligations, orders or claims.
Orders, payments and tax: As needed for contracts, accounting, tax, warranties and claims. Legally required accounting documents are kept for at least 5 years from account closing, or longer if law or disputes require.
Questions, quotations and after-sales support: Until completed and no longer needed for business, warranty periods or related claims.
Application audit logs: Normally 60 days, unless needed for incident investigation or legal compliance. Hosting and other providers may retain logs for different periods according to their purposes and applicable terms.
Marketing: Until consent is withdrawn, you object or the purpose ends. We may keep evidence necessary to honor requests and demonstrate legal compliance.
Browser data: For the session lifetime or until you clear it. Cart and favorites storage may remain until cleared.

Hosting backups · 21 days

Hosting retains 21 days of backups solely for backup and system recovery. They are encrypted datasets not directly readable as ordinary information. Recovery is limited to authorized people and approved processes. Copies expire on the 21-day cycle and are not used for marketing or other purposes. After deletion from the main system, copies may remain until the backup cycle ends. On recovery, applicable deletion or restriction requests must be reapplied.

The 21 days applies to hosting copies, not to customer account lifetimes, business documents or copies needed for system updates. Email, sales and after-sales systems retain information according to service necessity. When no longer needed, we delete, destroy or anonymize it unless lawful grounds justify further retention.

10Cookies and browser storage

We use cookies and storage necessary for sessions, sign-in, security, carts, favorites and delivery choices. You can manage or clear them in browser settings, but may need to sign in again or lose saved items.

If we add analytics or advertising cookies requiring consent, we will ask before use and offer a way to change preferences or withdraw consent without tying it to the main service.

11External services and international transfers

Using Google Sign-In, opening YouTube videos, contacting us via LINE or using external services may disclose your IP, browser information and submitted data to those providers. The DBD Registered image from dbdregistered.dbd.go.th may contact the Department of Business Development when loaded and disclose IP and necessary request data. Embedded videos may contact their providers on loading. The footer Facebook page connects to Meta when loaded; Meta may receive IP and browser data and use cookies according to browser settings and its policies. Network security checks may send public IP addresses for country and ISP lookup. Such data is also subject to the relevant provider's policies.

For transfers or processing outside Thailand, we follow legal requirements, such as adequate destination protection, appropriate safeguards or applicable exceptions, including consent and notice when legally required.

12Security measures

We apply appropriate organizational and technical measures, including access controls, encryption of important data, password hashing, activity monitoring and backups. For a breach, we investigate, mitigate harm and notify the Personal Data Protection Committee Office or affected people within legal conditions and deadlines.

13Your rights and requests

Subject to legal conditions and exceptions, you may request access and copies, the source of information collected without consent, corrections, receipt or transfer where applicable, object to processing, request deletion or destruction, restrict use, withdraw consent and complain to Personal Data Protection Committee Office

Withdrawal does not affect lawful processing before withdrawal or retention on other legal bases. You may object to direct marketing at any time.

Send your request to contact@jdc.co.th State the right you wish to exercise and your contact details. We may request only necessary identity evidence to prevent disclosure to the wrong person. Access and copy requests are handled without delay and within 30 days of receipt; other rights follow legal deadlines. If a request is refused or limited, we explain the legal reasons.

14Minors' information

If collecting a minor's information or obtaining consent requires consent from a legal guardian, we follow age, legal capacity and applicable requirements. If you find information collected unlawfully, contact us so we can investigate and take action.

15Website visitor statistics

We use IP addresses and device, browser and bot categories identified in the User-Agent to prepare monthly visitor statistics and maintain website performance, relying on necessary legitimate interests. This statistics feature does not use advertising cookies or identify member accounts.

The same IP is counted once per month in Thai time. We store a monthly changing HMAC identifier instead of the IP, along with operating system, browser, bot, country and ISP categories. This statistics table contains no raw User-Agent or visited URL history. Data covers the latest 12 calendar months including the current month and is cleared during maintenance.

To identify country and network provider, we may send a public IP address to ipwho.is for network information only. IPs are temporarily held in an encrypted queue and cleared on success or after retries end. Queue entries expire within 24 hours, are not checked after expiry, and are removed by a Scheduled Task or when an administrator opens statistics. Statistics access is limited to Directors.

IP counts are not counts of individuals. Users sharing a network may be grouped together, and country/ISP may reflect VPNs or proxies. Bots are categorized from User-Agent text, which may be spoofed. To object or ask about statistics data use, contact contact@jdc.co.th

16Policy changes

We display the latest policy and effective date here. We notify material changes through appropriate channels. New purposes requiring consent will be subject to additional consent before use. Reading or using the website is not blanket consent to every purpose.