01Introduction and scope
CloudCommerce Co., Ltd. and the companies in its group (together "CloudCommerce", "we" or "us") run four businesses: FastShip (international shipping), CONNEX (commerce software), CloudMall (a reseller marketplace) and KOLLAB (creator and influencer marketing). We take the protection of your personal data seriously. This policy explains how we collect, use, disclose and transfer it, in line with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and other applicable laws.
This policy applies to:
- cloudcommerce.co and the websites of our businesses, including contact forms, downloads, calculators and event registrations
- the services of our four businesses: shipping, rate comparison and tracking (FastShip); order, channel and shipment management (CONNEX); supplier and reseller accounts, listings and orders (CloudMall); and creator campaigns (KOLLAB)
- plugins and connections between our services and e-commerce platforms, marketplaces, social media or other third-party systems (see section 4)
- job applications to any of our businesses
- your contact with our sales, support and partnership teams
A business may publish its own notice with more detail about a particular service. Where that notice differs from this policy, it applies to that service.
Our role
- We are the data controller for the data of website visitors, business contacts, account users, suppliers and resellers, creators and job applicants. The company in our group that provides the service you use is the controller for that service.
- We are a data processor for end-customer data that merchants bring into our services — for example the recipients of their parcels or the buyers in their orders — which we handle only on the merchant's instructions (see section 4).
"You" in this policy means website visitors, customers and their staff, senders and recipients of parcels, suppliers and resellers, creators, business contacts and job applicants.
02Personal data we collect
Data you give us directly
- Contact details, such as name, email, phone number, address, company or shop name and job title
- Account details, such as login details, profile information and your preferences
- Contract and financial details needed for payment, payouts and invoicing, such as billing details and bank account details
- Shipment details, such as origin and destination addresses, item descriptions, values, weights and sizes, HS codes and proof of delivery
- Identity documents that customs or carriers require in some countries, such as a copy of an ID card or passport
- For creators (KOLLAB): your social media handles and profile, audience statistics, content, rates and campaign results
- For suppliers and resellers (CloudMall): shop details, product listings, prices, stock and orders
- For job applicants: your CV, education, work history and anything else you send with your application
- What you enter in forms, surveys and event registrations, and what you tell us when we talk
Data about other people that our customers give us
- Parcel recipients and buyers: name, phone number, email and delivery address
Data collected automatically
- Usage logs, such as IP address, browser and device type, pages visited, and the date, time and length of visits
- Data from cookies and similar technologies (see section 8)
- Location, when you allow it — for example to track or redirect a delivery
- Records of calls and chats with our teams, for quality control and as evidence of the service given
Other sources
- E-commerce platforms, marketplaces and systems you connect to our services
- Public social media profiles and statistics, when we consider creators for a campaign (KOLLAB)
- Carriers, payment providers and partners who serve you together with us
- Recruitment platforms and referrals, for job applicants
- Public sources and generally available business information
We do not intend to collect sensitive personal data, such as health, religion or criminal records. If you send us such data by mistake, we will delete it as far as we can.
03Why we use your data, and our legal bases
To provide our services under contract (contractual basis)
- Open and run your account, verify your identity and give you access to our services
- Compare shipping rates, create labels and customs documents, ship and track parcels
- Manage orders, sales channels and stock for your shop
- List and sell products between suppliers and resellers, and settle what is owed
- Match brands and creators, run campaigns, report results and pay creators
- Take payment, issue invoices and collect fees
- Keep senders, recipients, buyers and partners updated, and help with problems with your orders, parcels or account
- Consider your job application and, if you join us, start your employment
To comply with the law (legal obligation)
- Comply with customs, tax, anti-money-laundering and international sanctions laws
- Respond to orders of courts or authorities with legal power
For our legitimate interests (legitimate interest)
- Prevent fraud and keep our networks, systems and premises secure
- Improve and develop our products, services and user experience, including analysing how our websites are used
- Keep in touch with existing customers and people who have shown interest in our services
- Keep records of conversations for training, quality control and resolving disputes
- Run our group: share administration, accounting and customer support between our businesses where needed
- Establish, exercise or defend legal claims
With your consent (consent)
- Send news, offers and marketing through the channels you have agreed to
- Use non-essential cookies and your location, where the law requires consent
- Keep your job application on file for future roles
You can withdraw consent at any time. This does not affect processing done before you withdraw it. You can unsubscribe through the link in our emails or by contacting us.
04Plugins and connections to other platforms
This section applies when you install one of our plugins, or connect our services to your online shop, a marketplace, a social media account or another third-party system you use.
Data we can access (only with the permissions you grant when you connect)
- Shop details, such as shop name, domain, contact email, country and currency
- Orders, such as order number, items, prices, shipping fees and delivery status
- End-customer details in orders: name, phone number, email and delivery address
- Products, such as name, SKU, weight, size, price and HS code
- For creators who connect a social account: profile, audience and content performance statistics
What we use it for
- Show your orders, compare shipping rates, and create labels and customs documents
- Send tracking numbers and delivery status back to your shop, and to your customers as you choose
- Measure campaign results for brands and creators
- Give support and solve problems
Roles and limits
- The merchant is the controller of its own customers' data; we process it only on the merchant's instructions and for the purposes the merchant sets
- We ask only for the access the service needs
- We do not sell merchants' or end customers' data, and we do not use end customers' data for our own marketing
- We share end customers' data only with the carriers, customs authorities and providers needed to deliver (see section 6)
Deletion and disconnection
- End customers who want to exercise rights over their data can contact the shop they bought from, or contact us directly
- When you uninstall a plugin or disconnect, we stop accessing that shop's or account's data, and delete or anonymise it once we no longer need to keep it under section 9 — except what the law requires us to keep, such as customs documents and proof of delivery
05Parcel checks, customs and failed deliveries
This section applies mainly to FastShip and to shipments made through CONNEX.
- Parcel checks: we may check that item details and values are accurate and lawful, look for prohibited or restricted goods, and screen against lists of people and organisations that may not be dealt with. If we see a risk, we may hold a shipment and ask for identity documents.
- Customs: some destination countries require an ID number or passport copy of the sender or recipient. We disclose these only as far as the destination's law requires.
- Failed deliveries: if a parcel cannot be delivered, it may be returned or destroyed under the destination country's rules and the carrier's terms, which can require the sender's and recipient's details.
- CCTV: we use CCTV in our buildings and warehouses for security, access control and reviewing how work is done.
- Service points and payment partners: some service points are run by third parties. We give them only the data that service needs.
07International transfers
Because our businesses work across borders, your data may be sent abroad — for example to a parcel's destination country, to where a carrier, marketplace or social media platform is based, or to where our cloud providers' servers are.
When we transfer data to a country whose data protection may not match Thailand's, we do so as the law requires — for example under standard contractual clauses or other appropriate safeguards, or with your consent where needed.
Where a transfer is necessary to perform a contract you asked us to carry out, such as delivering your parcel, we may make the transfer that contract needs.
09How long we keep data
We keep personal data only as long as needed for the purposes in this policy:
- Account, order and shipment data: while you are our customer, and up to 3 years after the contract ends, as evidence for accounting, tax, customs and disputes — unless the law requires or allows otherwise
- Marketing data: until you withdraw consent or unsubscribe (we may keep your contact on a suppression list so we don't contact you again)
- Job applications: for the recruitment process, and afterwards only with your consent so we can consider you for future roles
- Website logs: deleted once no longer needed
- Data from connections you make: as needed under section 4
When the period ends, we delete or anonymise the data.
10Data security
We use appropriate technical and organisational measures to protect personal data against loss and unauthorised access, use, change or disclosure, including:
- Encryption in transit (HTTPS) and at rest
- Firewalls, intrusion detection and application monitoring
- Role-based access, given only to those who need it
- Pseudonymisation where appropriate
- Requiring our providers to keep data confidential and secure
No way of sending or storing data over the internet is completely secure. Please keep your password private and sign out on shared devices. If a personal data breach happens, we will notify the regulator and the people affected as the law requires.
11Your rights
Under the PDPA you have the right to:
- Access — ask for access to and a copy of your data, and to know what kinds we hold, why, and who receives it
- Correction — ask us to correct data that is wrong or incomplete
- Erasure — ask us to delete or anonymise your data, where the law provides
- Withdraw consent — at any time, for anything you consented to
- Object — to processing based on legitimate interest, or for direct marketing
- Restriction — ask us to suspend processing for a time
- Portability — receive your data in a machine-readable form and have it sent to another controller
- Complaint — complain to Thailand's Personal Data Protection Committee (PDPC) if you think we have broken the law
Some rights may be limited by law — for example where we must keep data to meet a legal duty. We will tell you why, and we may need to verify your identity before acting.
To exercise a right, contact us as in section 16. We will reply within 30 days of receiving your request.
Users in the European Union, the United Kingdom and California may have further rights under local laws such as the GDPR, the UK GDPR and the CCPA/CPRA, including the right to complain to the regulator in your country. We do not sell your personal data.
12Automated processing and artificial intelligence (AI)
We may use automated systems and AI to support our services — for example to suggest shipping rates, screen for risk and fraud, suggest creators for a campaign, sort and answer customer questions, and summarise conversations.
We do not make decisions with legal or similarly significant effects on a person by automated processing alone, without review by our staff. We do not allow AI providers to use your personal data to train models for third parties.
13Minors
Our services are for businesses and people aged 18 or over. We do not knowingly collect personal data from minors. If you are a parent or guardian and find that a child has given us their data, please contact us and we will delete it.
14Links to other websites
Our websites may link to third-party websites, apps or services, such as e-commerce platforms, carriers and social media (Facebook, Instagram, TikTok, YouTube, LINE). This policy covers only our own websites and services. We do not control, and are not responsible for, how those third parties handle privacy — please read their policies before using them.
15Changes to this policy
We may update this policy as our services and the law change. We will post the updated version on this page with its effective date, and tell you by email or in our services when a change is significant. Please check this policy from time to time.
This policy is effective from 12 October 2026.
16Contact us
For questions about this policy, or to exercise your rights over your personal data, please contact us:
- CloudCommerce Co., Ltd. (data controller)
- 1/269 Soi Chaeng Watthana 14, Thung Song Hong, Lak Si, Bangkok 10210, Thailand
- Email: hello@cloudcommerce.co
- Website: www.cloudcommerce.co
For a specific business, you can also contact it directly: FastShip and CONNEX customer service at cs@fastship.co or 02-080-3999. We will reply within 30 days of receiving your request.