Steinhart Barcelona

Privacy Policy

Last updated: 20/7/2026

1. Introduction

IBRAND GLOBAL Co., Ltd. ("IBRAND GLOBAL", "Steinhart Barcelona", "we", "us", or "our") operates the website steinhartbarcelona.com/en (the "Website") and sells Steinhart Barcelona haircare, hair styling, and hair equipment products in Thailand through the Website and authorized marketplaces (including but not limited to TikTok Shop, Shopee, and Lazada) and retail partners.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and the rights available to you under the Personal Data Protection Act B.E. 2562 (2019) of Thailand ("PDPA") and other applicable laws.

By using the Website, placing an order, creating an account, or otherwise providing us with personal data, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data collected via the Website is:

3. Scope of This Policy

This Policy applies to personal data we collect through:

• The Website (steinhartbarcelona.com), including browsing, account creation, and checkout
• Orders placed with us directly, including via customer service (LINE OA, phone, email, chat)
• Marketing activities such as newsletter sign-ups, contests, KOL/affiliate campaigns, and promotional forms
• Cookies and similar tracking technologies used on the Website

This Policy does not cover the practices of third-party platforms such as TikTok Shop, Shopee, Lazada, Facebook, Instagram, or LINE, when you interact with our storefronts on those platforms. Please review each platform’s own privacy policy, as their collection and use of your data is governed by their terms, not ours.

4. Personal Data We Collect

4.1 Data You Provide Directly

• Identity data: full name, title
• Contact data: delivery address, billing address, phone number, email address, LINE ID (if you contact us via LINE OA)
• Order data: products purchased, order value, order history, promo/discount codes used
• Payment data: payment method type and transaction confirmation (card numbers are processed directly by our payment gateway/processor and are not stored on our servers)
• Account data: username, password (encrypted), account preferences
• Communications: messages, enquiries, reviews, and feedback you send us
• Marketing preferences: consent given for newsletters, SMS, or promotional messages

4.2 Data Collected Automatically

• Device and technical data: IP address, browser type and version, device type, operating system
• Usage data: pages viewed, time spent on pages, referring/exit pages, click patterns
• Location data: general (city/region) location inferred from IP address
• Cookie identifiers and similar technologies (see Section 6)

4.3 Data From Third Parties

• Delivery status updates from our logistics partner, Flash Express Etc.
• Order and payment confirmation data from payment gateway providers
• Aggregated engagement data from advertising and social media platforms (e.g. Meta, TikTok, Google) when you interact with our ads

We do not intentionally collect sensitive personal data (such as health data, religious belief, or biometric data) under Section 26 of the PDPA through the Website. If you voluntarily disclose such information (for example, describing a scalp condition in a customer service message), we will only use it to respond to your enquiry and will seek explicit consent where required by law.

5. Purposes of Processing and Legal Basis

We process your personal data for the following purposes, relying on the legal bases under the PDPA indicated:

6. Cookies and Similar Technologies

The Website uses cookies and similar technologies to operate correctly, remember your preferences, measure performance, and personalize marketing. Categories of cookies used include:

• Strictly necessary cookies — required for core Website functions such as the shopping cart and checkout; cannot be switched off
• Performance/analytics cookies — help us understand visitor behavior (e.g. Google Analytics)
• Functional cookies — remember choices such as language
• Marketing/advertising cookies — used by us and partners (e.g. Meta Pixel, TikTok Pixel) to deliver and measure ads

You can manage cookie preferences through the cookie consent banner on the Website and through your browser settings. Disabling certain cookies may affect Website functionality.

7. How We Share Your Personal Data

We do not sell your personal data. We share personal data only as necessary with:

• Logistics partners — Flash Express or others, for order delivery and shipment tracking
• Payment service providers — to process payments securely (they act as independent data controllers for payment data)
• Payment providers used
• Website development and hosting agency — SmoothGraph, who maintains and hosts the Website on our behalf under confidentiality obligations
• Marketing and analytics platforms — such as Meta, TikTok, LINE, and Google, for advertising, analytics, and communications, where you have given consent
• Marketplace partners — TikTok Shop, Shopee, and Lazada, only to the extent needed to fulfil orders placed through those platforms
• Professional advisors and authorities — auditors, legal advisors, or regulators, where required by law or to establish, exercise, or defend legal claims
• Corporate transactions — a successor entity in the event of a merger, acquisition, or restructuring of IBRAND GLOBAL or Steinhart Barcelona

All third-party processors are required to protect your data under contractual confidentiality and security obligations consistent with the PDPA.

8. Cross-Border Data Transfers

Steinhart Barcelona is a brand originating from Steinhart based in Barcelona, Spain. Where personal data is transferred outside Thailand — for example, to affiliated Steinhart entities in Spain (European Economic Area) for brand, product, or reporting purposes, or to cloud service providers with servers located abroad — we take appropriate steps required under Section 28 of the PDPA to ensure an adequate level of protection, such as relying on standard contractual clauses, an adequacy decision, or your explicit consent where required.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements. As a general guide:

• Order and transaction records: retained for the period required under Thai accounting and tax law (generally at least 5 years)
• Account data: retained while your account remains active, and for a reasonable period after closure in case of disputes
• Marketing consent data: retained until you withdraw consent or unsubscribe
• Cookie data: retained per the duration stated in the cookie consent tool

10. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration, including encryption of payment and account credentials, access controls, and secure hosting arrangements with our website agency. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Your Rights Under the PDPA

Subject to applicable exceptions under Thai law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion or anonymization of your personal data
• Restriction — request that we limit how we use your data in certain circumstances
• Data portability — request transfer of your data to you or another controller in a structured, machine-readable format
• Objection — object to processing based on legitimate interest or for direct marketing purposes
• Withdraw consent — withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• Lodge a complaint — file a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand if you believe your data has been processed unlawfully

To exercise any of these rights, please contact us using the details in Section 16. We will respond within the timeframe required under the PDPA and may need to verify your identity before processing your request.

12. Children’s Privacy

The Website is not directed at children under 20 years of age (the age of majority in Thailand) and we do not knowingly collect personal data from minors without appropriate parental or guardian consent. If we become aware that we have collected personal data from a minor without proper consent, we will take steps to delete it.

13. Marketing Communications

If you have opted in to receive marketing communications, you may withdraw your consent at any time by using the "unsubscribe" link in our emails, replying "STOP" to SMS messages, blocking/muting our LINE OA, or contacting us directly. Withdrawing marketing consent will not affect transactional communications relating to your orders.

14. Third-Party Links

The Website may contain links to third-party websites or social media platforms (including TikTok Shop, Shopee, Lazada, Instagram, Facebook, and LINE). We are not responsible for the privacy practices of those third parties, and we encourage you to review their respective privacy policies.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. The "Last updated" date at the top of this Policy indicates when it was last revised. Material changes will be notified through the Website or other appropriate means before they take effect.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us at: