Privacy Policy
Last updated: October 5, 2026
This policy explains how SweetBox (“we”, “us”) collects and uses personal data when you visit phuketcakes.com, order a cake from us or contact us through WhatsApp, Instagram or email. We follow the Personal Data Protection Act B.E. 2562 (2019) of Thailand (PDPA).
1. Who we are
The data controller is SweetBox, a home bakery in Rawai, Phuket.
- Address: Fisherman Way Garden, 5/57 D, Wiset Rd, Rawai, Phuket 83130, Thailand
- Email: info@sweetbox.delivery
- WhatsApp: +66 84 063 3741
Send any question about your data or any request under this policy to info@sweetbox.delivery.
2. What data we collect and why
When you order or ask us a question
Your name, WhatsApp number or Instagram account, the delivery address and time (for example your hotel, room number or the contact at reception), the details of your cake and celebration, reference photos you send us and our chat history. We use them to prepare and deliver your order, to agree the design, price and delivery with you, and to answer your questions.
When you pay
Payments are made by cash, a QR transfer to a Thai bank account, a bank card at our bakery, PayPal or an international bank transfer. Your bank or PayPal processes the payment; this website never sees or stores card details. We keep a record of the amount, date and method of payment.
When you use this website
Only if you allow it in the cookie banner, we use Google Analytics (visits, pages viewed, clicks on buttons such as “Order via WhatsApp”) and advertising tools from Google Ads and Meta (Facebook, Instagram) to measure which ads and pages bring orders and to show relevant ads.
When you arrive from an ad or a link with a campaign label, the website adds a short label to the WhatsApp message it prepares for you, for example
[ref: wedding / google / summer], so we know where the order came from. With your consent to advertising cookies, this label also includes the
ad click identifier (Google “gclid”, “gbraid” or “wbraid”, or Meta “fbclid”). We may later report to Google Ads or Meta that this click led to an order,
using that identifier only. You can delete the label from the message before you send it.
3. Legal basis
- Contract — to prepare, deliver and get paid for your order (PDPA Section 24(3)).
- Legitimate interest — to answer your questions, keep basic order records and protect our business (Section 24(5)).
- Consent — for analytics and advertising cookies and ad measurement (Section 19). You can withdraw consent at any time.
- Legal obligation — to keep accounting and tax records where the law requires it.
4. Who receives your data
- Meta Platforms (WhatsApp, Instagram, Facebook) — the messaging services you use to contact us.
- Google — Google Analytics, Google Ads and Google Maps (the map on this website loads only when you click “Show map”).
- PayPal and banks — to process your payment.
- The courier or taxi driver delivering your cake — only the delivery address, time, name and phone number.
- Authorities — only when the law requires it.
We do not sell your personal data.
5. Transfers outside Thailand
Google, Meta and PayPal store data on servers outside Thailand, including in the United States and the European Union. These companies apply their own safeguards for international transfers. By using WhatsApp or Instagram to order, and by allowing analytics and advertising cookies, your data is processed on those servers.
6. How long we keep data
- Order details and chat history — while we handle your order and for up to 2 years after your last order, so we can help with repeat orders and questions.
- Payment and accounting records — as long as Thai accounting and tax law requires.
- Cookies — see the table below. Your cookie choice is remembered for 12 months.
7. Your rights
Under the PDPA you can:
- get access to and a copy of your personal data;
- ask us to correct data that is wrong or incomplete;
- ask us to delete or anonymize your data, or to restrict how we use it;
- object to processing based on legitimate interest, including direct marketing;
- receive your data in a commonly used format (data portability);
- withdraw your consent at any time — use on any page of this website;
- complain to the Personal Data Protection Committee of Thailand (PDPC, pdpc.or.th).
Contact us at info@sweetbox.delivery. We answer within 30 days.
8. Cookies and similar technologies
Necessary storage is always on. Analytics and advertising cookies are set only after you click “Accept all” or switch them on in the cookie settings. Until then, Google receives only cookieless signals without identifiers (Google Consent Mode), and the Meta Pixel is not loaded.
| Name | Provider | Purpose | Kept for | Category |
|---|---|---|---|---|
| pc_consent | phuketcakes.com | Remembers your cookie choice | 12 months | Necessary |
| pc_ref, swipe hints | phuketcakes.com | Ad source of your visit for the WhatsApp label; hides the swipe hint after you have used a slider | Until you close the tab | Necessary |
| _ga, _ga_* | Google Analytics | Counts visits and button clicks | Up to 2 years | Analytics |
| _gcl_au, _gcl_aw | Google Ads | Measures which ads lead to orders | 90 days | Advertising |
| _fbp, _fbc | Meta | Measures and personalizes Facebook and Instagram ads | 90 days | Advertising |
You can also delete cookies in your browser settings at any time.
9. Children
We make many cakes for children, but we take orders from adults. If you send us a child’s name, age or photo for a cake design, we use it only to make that cake.
10. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version.