นโยบายความเป็นส่วนตัว
เราเก็บอะไร เก็บทำไม และวิธีขอข้อมูลคืนหรือลบข้อมูล
This policy covers leeco-furniture.com and the accounts, quotes and orders made through it. It does not cover purchases made in person at our showrooms, which are handled under the same principles but recorded separately.
อัปเดตล่าสุด 2 September 2026
1. Who we are
Leeco is the furniture brand of Heng Heng Industry Co., Ltd., a Thai company that has manufactured steel furniture since 1985. In this policy “we” and “us” mean Heng Heng Industry Co., Ltd., which is the data controller for personal data collected through this website, and “Leeco” means the brand you are shopping.
Address: 888 Moo 8 Soi Watdan, Sukhumvit Rd, Mueng, Samrong Nuer, Samut Prakan 10270, Thailand.
Privacy contact: sales@leeco-furniture.com · +66 0-2757-3328
We handle personal data in line with Thailand’s Personal Data Protection Act B.E. 2562 (PDPA). Where you contact us from outside Thailand, we apply the same standards to your data.
2. What we collect
2.1 Information you give us
| When | What we collect |
|---|---|
| Creating an account | First and last name, email address, phone number, and a password. Passwords are stored in hashed form — we never see or store the password itself. |
| Saving an address | Recipient name, company (optional), address lines, district, province, postal code, country and phone number. |
| Placing an order | Your contact and delivery details, the items and configurations ordered, the order total in Thai Baht, your chosen payment method, and any discount or partner referral code applied. |
| Requesting a quote from the configurator | First and last name, email address, and optionally phone number and company, along with the configuration you built and its calculated price. |
| Using a contact form | Name, email address, optional company, the subject you chose, and the message you write. Project enquiries may also include the showroom or product you asked about. |
2.2 Payment details
When you place an order we record the payment method you chose and the details needed to complete it. Card payments are processed by our bank. We do not store your full card number — only the last four digits are kept with your order so you can recognise the payment — and we do not retain your card security code. For QR and bank transfers we keep the transfer reference or slip you send us.
2.3 Information collected automatically
When you browse the site we receive standard technical data: IP address, browser and device type, referring page, the pages you view, and timestamps. This reaches us through our web server logs and through Google Analytics 4.
If you arrive through a partner link containing a ?ref= code, we store that code in your browser so any resulting quote or order can be attributed to that partner. The code identifies the partner, not you.
2.4 Spam protection on our forms
Our contact and enquiry forms are protected by Google reCAPTCHA v3, which tells real visitors apart from bots. When you submit a form, reCAPTCHA collects hardware and software information — device and browser data, and your interaction with the page — and sends it to Google for analysis. This happens only at the moment you submit a form: we do not load reCAPTCHA on pages you merely browse.
Use of reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service. We receive only a pass or fail result and a spam score — never the underlying data Google collects.
3. Signing in with Google
You can create or access a Leeco account using “Sign in with Google”. If you choose to, Google asks for your permission and then sends us a limited set of data from your Google Account:
- Your email address — used as the unique identifier for your Leeco account and to send order, quote and account emails.
- Your basic profile information — your name and profile picture, used to address you in the interface and on your orders.
- Your Google account identifier — an opaque ID stored so we can recognise you the next time you sign in.
That is the entire scope of what we request. We do not ask for, receive, or have any access to your Gmail messages, Google Drive files, Contacts, Calendar, or any other Google service. We never receive your Google password.
Leeco’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use this data only to provide and improve the account features described above. We do not sell it, we do not transfer it to third parties except as needed to run the site (see section 6), we do not use it for advertising, and we do not allow humans to read it except with your explicit permission, for security purposes, to comply with the law, or where the data is aggregated and anonymised.
You can disconnect Leeco from your Google Account at any time at myaccount.google.com/permissions. Doing so stops future sign-ins; to also delete the Leeco account itself and its data, see section 9.
4. Why we use your data
| Purpose | Lawful basis (PDPA) |
|---|---|
| Creating and maintaining your account, authenticating you, and letting you reset your password | Performance of a contract |
| Preparing quotes, processing and delivering orders, and providing after-sales service and warranty support | Performance of a contract |
| Answering the enquiry you sent us through a contact form | Legitimate interest / steps prior to a contract |
| Keeping accounting, tax and warranty records | Legal obligation |
| Understanding how the site is used so we can improve it | Consent (analytics cookies) |
| Marketing and remarketing tags, and partner referral attribution | Consent |
| Protecting the site against fraud, spam and abuse | Legitimate interest |
We do not sell your personal data, and we do not use it to build advertising profiles about you.
5. Cookies and local storage
Strictly necessary storage — your cart, your signed-in session, and your cookie choice — is always active, because the site cannot function without it. Everything else runs only after you accept.
| Name | Purpose | Lifetime |
|---|---|---|
leeco.marketing.consent | Remembers whether you accepted or rejected marketing tags | Until you clear your browser storage |
| Session cookie | Keeps you signed in to your account | Session / until you sign out |
| Cart storage | Keeps the items in your cart between visits | Until the cart is emptied or completed |
ref | Attributes a quote or order to the partner whose link you followed | Up to 30 days |
_ga, _ga_* | Google Analytics 4 — distinguishes visitors and sessions | Up to 2 years |
| Google Tag Manager tags | Marketing and remarketing tags — set only if you accept | Varies by tag |
You can change your mind at any time by clearing this site’s data in your browser, which brings the consent banner back. You can also block cookies entirely in your browser settings; the shop will still work, though your cart may not persist.
6. Who we share it with
We share personal data only with the service providers that let us run the site and fulfil your order, and only as far as each one needs:
- Hosting. Our website, shop backend and database run on dedicated servers we control, hosted by Hostinger International Ltd. in a data centre in Kuala Lumpur, Malaysia.
- Google Analytics 4 and Google Tag Manager (Google LLC) — site usage measurement and marketing tags. Marketing tags run only with your consent.
- Google Sign-In (Google LLC) — authentication, if you choose it. See section 3.
- Google reCAPTCHA (Google LLC) — spam and abuse protection on our forms. See section 2.4.
- Email delivery. Our mail provider transmits account, quote and order emails to you and routes enquiry notifications to our sales team.
- Delivery partners — the name, address and phone number needed to deliver your order.
- Professional advisers and authorities — our accountants, and any government body we are legally required to disclose to.
We do not sell, rent or trade personal data, and we do not pass it to advertising networks for their own use.
7. Where your data goes
Our servers are in Malaysia and our analytics and sign-in providers process data in the United States and other countries. When personal data leaves Thailand we rely on the recipient having adequate protection or on standard contractual clauses, as PDPA section 28 requires.
8. How long we keep it
| Data | Retention |
|---|---|
| Account profile and saved addresses | Until you ask us to delete the account |
| Orders, invoices, and tax and warranty records | For the period Thai accounting and tax law requires us to keep them |
| Quote requests and contact form enquiries | For as long as we need them to answer you and follow up, then deleted |
| Analytics data | For the retention period configured in Google Analytics |
| Server logs | A short rolling period, for security and troubleshooting |
9. Your rights, and how to delete your data
Under the PDPA you may ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct anything inaccurate or incomplete;
- delete your data, or your account along with it;
- stop or restrict a particular use — including withdrawing consent to analytics or marketing, which you can also do from the cookie banner;
- send your data to another provider in a machine-readable format;
- object to a use we base on legitimate interest.
To delete your account and the personal data attached to it, email sales@leeco-furniture.comfrom the address on the account, with “Delete my account” as the subject. We will confirm and complete the deletion within 30 days. Records we must keep by law — invoices, for example — are retained for the period in section 8 and then destroyed.
10. How we protect it
The site is served only over HTTPS. Passwords are stored in hashed form. Our shop administration system is not exposed to the public internet — staff reach it over an encrypted tunnel — and our database is not reachable from outside our private network. Staff are granted only the access their role requires.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify the Personal Data Protection Committee within 72 hours and tell you directly where the risk to you is high.
11. Children
This site is intended for business and adult retail customers. We do not knowingly collect data from anyone under 20 without the consent of a parent or guardian, as the PDPA requires. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We update this page when our practices change. The date at the top always reflects the current version. If a change materially affects how we use data you have already given us, we will tell you by email or with a notice on the site before it takes effect.
13. Contact us
Questions about this policy, or about any data we hold on you:
sales@leeco-furniture.com
+66 0-2757-3328
888 Moo 8 Soi Watdan, Sukhumvit Rd, Mueng, Samrong Nuer, Samut Prakan 10270, Thailand