This policy explains how BÉLIT Atelier collects, uses, and protects your personal data when you visit our website or purchase from us, in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).
Email: info@belit.studio
Bangkok, Thailand
BÉLIT Atelier (“BÉLIT”, “we”, “us” or “our”) is a jewelry house based in Bangkok, Thailand, crafting personalized natural gemstone jewelry. This Privacy Policy explains what personal data we collect when you visit our website or purchase from us, where it goes, how long we keep it, and the rights you have over it. We handle that data under the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”), and we are the Data Controller for the personal data described here. Please read this policy before using the site or placing an order; by doing either, you acknowledge the practices it describes.
We collect only the personal data we need to serve you, in these categories: Identity and contact data — your name, email address and phone number, given to us when you contact us, place an order, or ask for a Stone Finder reading. Delivery and billing data — the shipping and billing address you provide at checkout, and the recipient’s name, address, phone number and email when you have us send a piece as a gift. Payment data — what is needed to take payment. Card numbers are entered on the payment provider’s own secure form and are not stored on our systems; we keep only the transaction reference and the last digits needed to trace a payment or process a refund. Stone Finder data — the birth date, birth time and birth place you choose to share, together with your stated preferences, used to prepare your personalized gemstone recommendation and reading. Correspondence data — the messages and contact details you send us, including any photographs you send with a warranty, repair or return request. Technical data — your IP address, browser and device type, the pages you view, the site that referred you to us, and cookies, collected automatically as you use the site. We do not ask for your national ID number, your passport number or your bank account details, and we never store a full card number. If you send any of those to us anyway in a message or a photograph, please treat them as unnecessary and ask us to delete them.
Almost all of your personal data comes from you directly — when you complete a form, place an order, subscribe to updates, or write to us. Two kinds arrive without you typing them in: Technical data , which your browser sends on every request, such as your IP address and the cookies described in Clause 08. Referral information , where you reached us from a search engine, a social platform or another website, which that service passes on when a link is followed. We do not buy data about you from data brokers, and we do not assemble a profile of you from sources outside what you have given us yourself or what your browser sends automatically.
We use your personal data to: take payment, fulfill and deliver your order, and send you an invoice and order confirmation; keep you informed of the progress of your order or your Stone Finder reading, including by email, telephone or social media where you have asked us to; prepare and send the personalized reading you requested through the Stone Finder; answer your questions and handle warranty, repair and return requests; send you the newsletter and updates you have asked to receive; prevent fraud and abuse, and keep the website secure and available; understand how the site is used so that we can improve it, through aggregated analytics; and measure and improve our advertising, where you have consented to advertising cookies. Two kinds of message are not marketing, and you cannot unsubscribe from them by email: messages about a transaction you have with us — an order, a delivery, a refund or a warranty claim — and notices about changes to these terms or to this policy. We send those because they concern an arrangement you already have with us, or our legal obligations, rather than promotion. Every other message we send is marketing, and you can unsubscribe from all of it at any time.
We process your personal data on the following legal bases under the PDPA: Consent (Section 19) — for marketing communications and advertising cookies, which you may withdraw at any time; Performance of a contract (Section 24(1)) — to fulfill orders and provide the services you request; Compliance with a legal obligation (Section 24(2)) — to meet legal, tax and regulatory requirements; and Legitimate interests (Section 24(5)) — to operate, secure and improve our website and services, where those interests are not overridden by your rights and freedoms.
We share personal data only with the categories of provider below, and only to the extent each one needs it in order to serve you: Payment providers — to take payment and handle refunds; card details are entered and held on the provider’s own secure systems, not on ours. Courier and logistics partners — to deliver your order and provide tracking. Web hosting and platform providers — to host and serve the website. Content management — our website copy is managed through the Wagtail CMS. Analytics and advertising providers — to understand how the site is used and to measure campaigns, where you have consented. These providers act on our instructions and may not use your data for their own purposes. Professional advisers and public authorities — where we must disclose data to meet a legal obligation or court order, or to establish or defend our legal rights. Each provider above is bound by contract to process your data only on our instructions and to protect it. We do not sell your personal data, and we do not disclose it to anyone for their own commercial use.
Some information cannot be traced back to you. We neither treat it as personal data nor use it to identify you. This includes aggregated statistics such as which pages are most visited, which pieces are viewed, and how many orders are placed in a given period, as well as general patterns in the way visitors move through the site. We use this information in aggregate to decide what to build and what to improve. Where aggregated information is combined with personal data in a way that can identify you, we treat the result as personal data from that point on, and this policy applies to it.
Our website uses cookies and similar technologies — small text files placed on your device — to remember your preferences, keep your basket and session working, and understand how the site is used. We use three kinds. Strictly necessary cookies make the site work, such as keeping you signed in and your basket intact; these cannot be turned off without breaking the site. Analytics cookies, including those set by Google Analytics, tell us which pages are used and how visitors arrive. Advertising cookies, including those set by Meta and Google, let us measure and target campaigns, and are set only where you have consented. You can accept or decline non-essential cookies using the control offered on this site, and you can block or delete cookies through your browser settings at any time. Declining analytics and advertising cookies will not stop you shopping — it only means we learn less about how the site is used.
We keep personal data only for as long as we need it for the purposes in Clause 04, or for as long as the law requires. Order and financial records are kept for the periods required by tax and accounting law, so we can produce your invoice and answer a question about a purchase years later. Account data is kept while your account is open, then deleted or made anonymous within a reasonable period after you close it. Newsletter data is kept until you unsubscribe or ask us to delete it. Support, warranty and repair correspondence is kept for as long as needed to resolve the request and to support a later claim on the same piece. Technical logs are kept for a short, fixed period and then deleted. When a record reaches the end of its period, we delete it, or convert it into a form that can no longer be linked back to you.
We store your personal data on servers located in Thailand, operated by us and by our Thai hosting providers. Some of our service providers — payment processors, and analytics or advertising platforms — process data on servers outside Thailand. Where that happens your data leaves Thailand, which is covered by Clause 11. Only the data each provider actually needs is sent to it. We do not copy your full order history into a marketing tool, and we give a courier nothing beyond the name, address and telephone number needed to make a delivery.
Some of our providers process personal data outside Thailand. Where your data is transferred abroad, we rely on the safeguards available under the PDPA — an agreement with the provider limiting it to processing on our instructions, together with appropriate technical and organizational controls — so that your data is protected to a standard comparable to that required in Thailand. You can ask us which providers receive your data and on what basis, using the details in Clause 18.
Under the PDPA you have the following rights over your personal data: the right to be informed of what data we hold about you, how we use it, and who we share it with; the right to access that data and receive a copy of it in a readable form; the right to rectification , to have inaccurate or incomplete data corrected; the right to erasure , to have your data deleted or converted so that it can no longer identify you; the right to object to processing that rests on legitimate interests, where your interests outweigh ours; the right to restrict processing while a question of accuracy or a pending request is settled; the right to data portability , where you gave us the data and you would move it to another provider; the right to withdraw consent at any time, without affecting anything we did lawfully before you withdrew it; and the right to lodge a complaint with the Office of the Personal Data Protection Committee. To exercise any of these, email us at the address in Clause 18 and tell us which right you want to exercise and how to find your record. We will confirm receipt, and we will respond within 30 days of receiving your request. If we cannot meet a request in full, we will tell you what we can do instead. If we refuse a request, we will explain why in writing. We do not charge for making a request. We may ask you to confirm your identity before we release data, so that we do not disclose your information to the wrong person.
Our website and services are intended for people who are at least 20 years old, the age of majority in Thailand. We do not knowingly collect personal data from anyone younger. If you are under 20, please ask the parent or guardian who placed an order to contact us instead. If you believe a child has given us personal data, tell us and we will delete it.
We protect personal data against loss, misuse, unauthorized access, alteration and disclosure through measures covering the three properties that matter: Confidentiality — access is limited to staff and providers who need it, under confidentiality obligations. Integrity — access to customer and order records is restricted and logged, so that changes can be traced. Availability — data is backed up and protected so that it remains accessible and recoverable. In practice that means administrative safeguards, such as limiting who can open an order; technical safeguards, such as encryption in transit and access control; and physical safeguards, such as controlled access to any location where data is held. No method of storage or transmission is completely secure, so we cannot promise absolute security. If a breach occurs we handle it as described in Clause 15.
If personal data is lost, accessed, used or disclosed without our permission, we will notify the Office of the Personal Data Protection Committee without delay, and in any case within 72 hours of becoming aware of it. Where a breach is likely to affect your rights or freedoms — for example where your contact or payment data has been exposed — we will also tell you without undue delay, tell you what happened, and describe the steps you can take to protect yourself. We record every breach and the steps we took in response, whether or not notification was required, so that we can learn from it.
If you are unhappy with how we have handled your personal data, please contact us first using the details in Clause 18 — most issues are resolved quickly that way. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC), which is the authority responsible for the PDPA in Thailand.
We may update this Privacy Policy from time to time, to reflect a change in our practices, in the law, or in what we offer. The latest version is always the one on this page, with the date of the last update shown above. Where a change materially affects how we use data you have already given us — particularly a new purpose that was not set out in this policy when you provided it — we will ask for your consent again before we begin that new use.
BÉLIT Atelier is the Data Controller for the personal data described in this policy. If you have a question about this policy, or wish to exercise any of the rights in Clause 12, contact us: Email: info@belit.studio Post: BÉLIT Atelier, Bangkok, Thailand Please write “Privacy” in the subject line so your message reaches the right person. Every request about personal data is handled through this one address.