Privacy notice: Thailand

Updated: 10 October 2026

Panya’s Thailand store at growpanya.com is operated by Roots Agriculture Co., Ltd., the controller of the personal data described here. Contact ops@roots.ag about your data, choices or rights.

When you visit the Thailand store, a notice at the bottom of the page explains that we use cookies and share browsing and order data with Meta, Google and LINE to measure and improve our ads. This is on unless you opt out. One tap on Opt out turns all of it off, and you can still browse and buy. Visiting the website does not subscribe you to emails. We use guest checkout; you do not need a customer account or password.

What always works

We use the contact details, delivery address, products, quantities, payment status and order messages you provide to take payment, deliver your order and help with returns or enquiries. These activities support the purchase or service you request. Payment providers process payment details; we do not store full card numbers in Rootstock.

Your basket, delivery choices, privacy preferences and secure checkout use necessary storage. Hosting and security systems process technical information needed to operate the site and prevent abuse. We use order records for fulfilment, accounting, legal obligations and internal sales reporting. Declining optional tracking does not remove those records or prevent a purchase. Necessary operations and fraud prevention are separate from sending browsing activity to advertising platforms.

A postcode you enter for delivery estimates is remembered in this browser for up to 30 days. The Buy again list remembers only product identifiers and quantities from the last confirmed order opened in this browser for up to 180 days, not contact details, payment details or order access links. You can use “Forget postcode” or “Forget these products” to remove them, or clear this site’s browser storage. These shopping preferences are not advertising consent.

To keep delivery estimates and checkout working, we also count requests by service, HTTP outcome and day. These internal service-health totals have no visitor ID, contact details, postcode, IP address, page history or link to an order. They are not sent to advertising platforms. We keep a rolling 90-day window, with older totals removed by scheduled maintenance and when new totals arrive. This is operational reliability reporting, not a count of unique shoppers.

Measurement and advertising: notice and opt-out

In Thailand, website analytics and advertising measurement run by default, with the notice described above. You stay in control:

• Opt out in the notice turns off website analytics, Google Ads and Meta/LINE advertising, and basic order-source reporting. OK keeps them on and hides the notice.
• Privacy choices at the bottom of every page reopens the settings, so you can turn each option on or off at any time.
• Global Privacy Control: if your browser sends this signal, we treat you as opted out unless you later choose otherwise on this site.
• A choice you make always takes priority over the notice. Choices you made before this notice, including refusals, still apply.

What each option covers:

• Website analytics: Rootstock, PostHog and Google Analytics help us understand visits, product views, basket actions, checkout and purchases. Rootstock records selected campaign labels, referring domain, public page paths and shopping events using random visitor/session identifiers. A signup or order can link a visit to its customer record. PostHog receives a copy of these events. PostHog's script on our pages also records clicks, how far you scroll and where people click (heatmaps), and for a sample of visits a session replay: a reconstruction of how the page was used. Everything you type into forms is hidden before it leaves your browser, and all text on checkout and order pages is hidden. Order-tracking, email and receipt pages are not recorded. When you place an order or sign up for Growing notes, Rootstock connects this browser's PostHog activity (visits, clicks, campaign labels and replays) to a PostHog profile for you with your email, name, phone number, district, province and postcode, your number of orders and total spend, and the campaign labels of your first and latest visits. This shows us which ads and pages lead to orders. PostHog records only whether you arrived from an ad click, never the click identifier itself. After you opt out, nothing more is added to that profile and PostHog's browser identifier is deleted. A shared browser is not proof of the same person.
• Google Ads: Google receives campaign labels, Google click identifiers and shopping activity to measure ads and show relevant Google ads. When you order, Google also receives the order details and your email, phone number, name and postcode, which the Google tag hashes before sending. Google Signals stays off. Website analytics must be on for this option.
• Meta and LINE advertising: these platforms receive shopping activity to measure ads and show relevant advertising. Meta may match hashed contact details you enter, such as email, phone, name and city/region/postcode/country. We do not collect birth date or gender for matching. We do not send contact details to LINE or receive your LINE chat identity through its tag.

What is shared while you browse: cookies and similar identifiers, your IP address and browser details (such as the User-Agent), the pages you view, products you look at or add to your basket, searches (Meta and LINE receive only a broad category; Google Analytics receives the search words after we remove email addresses, phone numbers and long numbers), newsletter signups and LINE chat clicks. What is shared when you order: order details (order reference, products, quantities, value after discount and currency) and hashed contact details for matching. Hashing does not make personal data anonymous. Approximate location may be inferred by providers from network information; we do not ask for precise GPS location.

After you opt out: we stop sending browsing and order data to Meta and LINE, and our server stops attaching advertising identifiers to new orders. The Google tag remains in a restricted mode: it does not store Google cookies or send match data, but it may still send limited cookieless signals (such as a page or purchase event without identifiers) that Google uses to estimate total results. Email marketing has its own separate signup and confirmation.

We rely on our legitimate interest in measuring and improving our advertising, with this notice and an easy opt-out that you can use at any time. Where the law requires your consent for a specific use, we ask for it separately.

Orders and attribution

When an order is paid, or a cash-on-delivery order is accepted, our receipt page tells Google Ads, Meta and LINE about the purchase once, under the choices above. Rootstock also confirms payment on our server before sending Google and Meta a purchase, and checks your current choice again before each delivery. Server purchase reports include the order reference, product SKUs, quantities, value after discount, currency and hashed contact details for matching (such as email, phone, name and address details), plus the advertising identifiers, IP address and browser details captured at checkout. Meta does not receive your delivery address in plain text. Failed payments, cancelled orders and team orders are not counted as purchases.

LINE purchase reporting requires the same browser to return to a server-verified receipt. Browser blocking, leaving before returning or using a different device may prevent it. The LINE tag runs in an isolated measurement document without customer form fields or the private receipt URL.

Advertising credit also depends on an eligible ad interaction and the platform’s attribution rules. An order can be recorded successfully in our store without being attributed to an ad. We do not invent click identifiers or apply a later choice retroactively to an earlier order.

Growing notes and support

Growing notes requires an email signup and email confirmation. Gardening interests and preferred language are optional. Confirmed subscription choices and recorded purchases help us choose relevant messages. Buying or contacting us does not subscribe you. Each marketing email includes an unsubscribe link. Unsubscribing stops marketing email, while essential order messages continue.

Messages you send through our contact form or LINE are used to answer your enquiry. LINE chat is a separate service from the LINE Ads tag. If you follow an external link, that service’s privacy notice applies there.

Who receives information

• Rootstock / Google Cloud: order handling, consent records and permitted customer journeys.
• Vercel: website hosting and delivery.
• Stripe and delivery partners: payment and fulfilment information needed for the order.
• Resend: essential order email and confirmed marketing subscriptions.
• PostHog and Google Analytics: website measurement under the choices above, including the PostHog customer profile described above. PostHog also receives shop-level sales totals described below.
• Google Ads, Meta and LINE: advertising measurement and relevant ads under the choices above.
• Authorities or professional advisers where needed for legal obligations, claims or disputes.

Some providers process information outside Thailand. Thailand’s requirements for overseas transfers still apply. Contact ops@roots.ag for information about the providers and applicable transfer arrangements. A cookie choice is not a substitute for the safeguards required for those transfers.

Retention and withdrawal

Analytics and advertising choices and server consent subjects expire after up to 180 days. The basic-source preference lasts up to 180 days; an expired stored preference does not restart source capture automatically. Rootstock visitor cookies last up to 30 days, and session cookies expire after 30 minutes of inactivity. Scheduled cleanup removes inactive anonymous visits after 30 days and detailed website events after 90 days. PostHog session replays are kept for up to 30 days; PostHog's browser identifier is deleted when you opt out.

In our systems, ad click and browser identifiers captured at checkout (such as Meta click/browser IDs, IP address and User-Agent) are cleared within seven days, or sooner if you opt out. Google client and click identifiers are kept for up to 90 days, including the first-party cookie that remembers a Google ad click, and are removed when you turn Google Ads off. The Meta click cookie in your browser also lasts up to 90 days. LINE checkout markers expire after three days and are removed on a later visit or when you opt out. Provider cookie and data retention may differ from ours.

Order, payment, customer-linked attribution, subscription and delivery records remain for fulfilment, customer support, accounting, permission evidence and legal needs. They do not all have an automatic deletion period. You can request access or deletion; records needed for legal obligations or claims may need to be retained.

Opting out stops future sharing after the choice is saved, including queued purchases whose permission has changed. It does not recall information already sent or cancel an order. Browser tracking stops immediately; if saving to our server fails, the page asks you to retry and tries again on your next visit. Contact us if you cannot save an opt-out. Email unsubscribe and privacy choices are independent.

Your rights and contact

Under Thailand’s PDPA, you may request access, correction, deletion, restriction or portability where applicable; withdraw consent; or object to processing, including advertising measurement and direct marketing. Opting out in Privacy choices is the quickest way to object to advertising measurement. We may need to verify your identity to protect your information. You can also complain to Thailand’s Office of the Personal Data Protection Committee (PDPC).

Email ops@roots.ag, identifying the order or email concerned and the request. We use access controls and other safeguards to protect information, but no system can guarantee perfect security. The shop is not directed at children; a parent or guardian can contact us about a child’s data.

We will update this notice when practices change. A notice update does not turn a choice you declined into permission.

Basic order-source reporting

For Thailand orders, we use a limited first-party record to understand which broad channels bring sales, based on our legitimate interest in measuring our own shop. It holds only a category such as Google, Facebook, LINE, Shopee or unknown, the type of evidence and a broad medium. We do not retain the original URL, advertising click ID, IP address or browsing history in this record. A missing source is not treated as direct traffic. A campaign tag is evidence from the visit, not proof that an advertising platform credited a sale.

The record stays in this browser tab for at most 24 hours and is attached to an order only if you place one. Turn off Basic order source in Privacy choices, or choose Opt out, to stop future capture and clear the tab record. We honour earlier analytics refusals. Order-linked source data is retained for up to 90 days and restricted to authorised staff; essential order and accounting records have their own retention purposes. This record is not sent to advertising platforms and does not grant analytics or marketing permission. Contact ops@roots.ag to object or request removal of an existing source record.

We also send a daily shop-level sales summary to PostHog: date, market, currency, number of paid orders, merchandise and delivery totals, and the number of confirmed COD orders. It contains no customer, order, device, session or advertising identifiers and cannot identify which buyer or ad generated a sale. It is separate from optional person-level analytics and is not sent as an advertising conversion. With analytics permission, the PostHog customer profile described under Website analytics connects shopping events and orders from the same browser or the same email address.