Privacy Policy

We are South East Asia (S.E.A.) Sails (Thailand) Co. Ltd (company registration 0105560022097), the sail loft trading as South East Asia Sails and SEA Sailmakers, and the operator of seasailmakers.com, based in Phuket, Thailand. We are the data controller for the personal information described in this policy. This policy explains what we collect, why, who we share it with, and what you can ask us to do about it.

We are established in Thailand and comply with Thailand's Personal Data Protection Act. Because we build sails for customers in the European Union and the United Kingdom, we also comply with the EU General Data Protection Regulation and the UK GDPR for those customers. Wherever you live, we extend the same rights to you voluntarily.

What we collect

• Information you give us. Your name, email address, phone number and delivery address when you request a quote, place an order or get in touch. Your boat and its rig measurements when you ask us to build a sail. We need this information to prepare your quote and perform our contract with you.
• Information about your order. What you ordered, what it cost, and its payment and delivery status. Card details are entered directly into Stripe and never reach our systems. We process this to perform our contract with you and to meet Thai tax and accounting law.
• Information about your visit. Which pages you looked at and how you moved through the site, collected by our analytics as described below, on the basis of our legitimate interest in improving the site.
• Technical information. Your IP address, browser and device type, and the page that sent you to us, all of which arrive automatically with any web request. We process this on the basis of our legitimate interest in delivering and securing the site.
• Error and performance reports. If a page breaks or runs slowly, our own error monitoring software records a technical report so we can fix it. The report can include your IP address, browser and device details, and the page you were on. We configure it to strip anything you typed into a form, cookies and any other sign in details before the report is stored. It stays on our own servers rather than going to an outside company. Our basis is our legitimate interest in keeping the site working.

Website analytics

We use PostHog to understand how people use the site so that we can make it better. We have set it up to be as unintrusive as we know how:

• It is cookieless. It stores nothing on your device and reads nothing from it. That is why you have not been asked to dismiss a cookie banner.
• It never builds a profile of you. Analytics is not linked to your name, your email address or your account, and never has been.
• It runs on servers in the European Union.
• It anonymises IP addresses. The last part of your address is discarded before anything is stored, so your location is never pinned down more precisely than a broad area.
• It is switched off completely for our own staff, so our team's browsing never pollutes the data.
• It records anonymous session replays so we can see where the site confuses people. Everything you type is masked before it is recorded, and card details sit inside Stripe's own secure frame, which we cannot see at all.

We do this on the basis of our legitimate interest in running and improving our website. You can object at any time by switching analytics off on our Your Privacy Choices page, which is linked in the footer of every page. If your browser sends a Global Privacy Control signal, we switch analytics off for you automatically. That signal controls analytics; the sections below explain how to control everything else.

Cookies and similar technology

We use no advertising cookies and no tracking cookies. The only things stored on your device are the ones the site needs in order to function:

• A sign in token, if you have logged in to your account or to our staff area, so that you stay signed in.
• Your shopping cart, so that it survives as you move between pages.
• Two cookies set by Stripe, on the checkout page only, used to detect payment fraud.
• A cookie set by Cloudflare, which protects the site from bots and malicious traffic.
• Your analytics preference, if you have set one, so that we can honour it.

All of these are strictly necessary, so we do not ask for consent to use them. Blocking them will stop parts of the site from working.

Advertising measurement

We advertise on Google and Meta, and we measure whether those adverts actually lead to enquiries and orders. We do this from our own servers, not from your browser, so it sets no advertising cookies on your device and builds no advertising profile of you here.

Only if you first reached us by clicking one of our Google or Meta adverts, we may send a small coded record to that platform at a few points: when you submit an enquiry, when we email you a quote, as our team updates whether your enquiry is progressing, and if you place an order. The record contains:

• The click identifier the platform itself created when you clicked its advert, which we read from the link you arrived on. Google calls this a gclid and Meta calls it an fbclid. If instead you filled in a form hosted on Facebook or Instagram, we return the lead reference Meta already holds for it.
• Your email address turned into an irreversible code, which the platform can match only against its own records.
• For an order, the order value and currency. For an enquiry, no value is sent.

We never send your name, your phone number or your postal address for advertising measurement.

If you are in the EU, the EEA or the UK, this only happens with your permission. The enquiry, sailboat measurement and checkout forms show you a checkbox asking whether we may report it. It is unticked by default, and saying no changes nothing about your quote or your order. If you ticked it and change your mind, contact us and we will stop and ask the platform to remove what was sent. If your lead reached us through a form hosted on Facebook or Instagram, telling Meta the lead exists is not gated on this permission, because Meta already holds that lead. Until you say yes, though, we add nothing else to it, including your email address.

Everywhere else, our lawful basis is our legitimate interest in understanding and improving our own advertising, weighed against your privacy. You have the right to object to this at any time and we will stop and ask the platform to remove what we have already sent: contact us using the details below.

Google and Meta receive this coded data in the United States.

Email newsletter

If you sign up to our newsletter, we use your email address to send you occasional notes on new sails, canvas work, and owner resources. Signing up is itself your consent, and every email contains an unsubscribe link that works immediately. Your address is held in our own customer records alongside our other systems, and sent from our own systems or a mailing service we use for that purpose.

Who we share it with

We do not sell your personal information and never have. We share it only with the companies that help us run the business:

• Stripe, which processes payments.
• PostHog, which hosts our website analytics in the European Union.
• Cloudflare, which delivers the site and protects it from attack.
• Freshsales, our customer relationship system, which holds a record of your enquiries, orders and newsletter subscription.
• Odoo, our accounting and order fulfilment system, which receives your name, address and order details once you place an order.
• Google Workspace, which carries our email.
• OpenAI, which our staff use to generate a short internal summary of an order or a conversation thread. This can include the text of emails or messages exchanged as part of your order.
• Shipping carriers, which receive the delivery details needed to get your sails to you.
• Google and Meta, which receive a small coded record of your enquiry or order so that we can measure whether our advertising works, as set out under Advertising measurement above.

Where your information goes

We are a Thai company and our website and database are hosted with a provider based in the United States. Some of the other companies we rely on, for payments, analytics, email and advertising measurement, are based in or operate from the United States or the European Union, so your information is transferred internationally.

Wherever we send your information outside Thailand, the EU, the EEA or the UK, we put a recognised legal safeguard in place first, such as the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum. If you want a copy of the safeguard that applies to a particular transfer, ask us using the contact details below.

We host our analytics in the EU rather than the US, and we keep the amount of information that leaves our own systems as small as we can. If you want to know where a particular piece of your information sits, ask us and we will tell you.

How long we keep it

• Orders and quotes. We keep order and quote records for as long as we need them to support the sail we built you, and in any case for the period Thai tax and accounting law requires.
• Enquiries that never became an order. We keep these for as long as there is a realistic prospect of working together, and remove them when there is not. Sailmaking is a long cycle and an enquiry can turn into a project years later, so we do not put a fixed clock on it. You can ask us to delete your enquiry at any time and we will.
• Session replays. Deleted after 30 days.
• Analytics events. The underlying event records, which carry no name, email address or account of yours, are held for up to 7 years.
• Newsletter. Your address is kept until you unsubscribe, then removed from the active list.
• Error reports. Deleted after 90 days.

If you would like your information removed sooner than any of this, ask us and we will do it unless the law requires us to keep it.

Your rights

Wherever you live, you can ask us to:

• Tell you what we hold about you and give you a copy of it (access).
• Correct anything that is wrong (rectification).
• Delete your information, unless the law requires us to keep it (erasure).
• Pause our use of your information while a question about it is resolved (restriction).
• Give you your information in a portable, machine readable format (portability).
• Stop using your information for a particular purpose, including analytics and advertising measurement (objection).
• Withdraw any consent you have given, such as for the newsletter or advertising measurement, at any time. Withdrawing consent does not affect what was lawfully done before you withdrew it.

We do not use your information to make automated decisions that have legal or similarly significant effects on you.

We will never treat you differently for exercising any of these rights. We aim to respond within 30 days; if a request is complex we may need longer, and we will tell you if so.

If you are in the EU or the EEA and our answer does not satisfy you, you can complain to your national data protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk). In Thailand, you can complain to the Personal Data Protection Committee.

Children

Our products and site are intended for adults, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, contact us and we will delete it.

Changes to this policy

If we change the way we handle your information, we will update this page and the date at the top. Where the change is significant, we will say so clearly rather than quietly revising the text.

Contact

For questions about this policy, or to exercise any of the rights above, contact SEA Sailmakers:

• Email: robert.tasker@seasailmakers.com
• Phone: +66 (0)76 604 598
• Address: The Sail Loft, 50/7 Moo 4, Ban Para, T. Pa Khlok, A. Thalang, Phuket 83110