Privacy Policy

1. Data Controller

Ripples Commerce Co., Ltd. (“Ripples,” “we,” “us,” or “our”) is the data controller responsible for your personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

2. Information We Collect

We collect personal data through various channels on our website. The types of data collected depend on how you interact with us.

2.1 Brand Inquiries

Collected via the contact form at /contact

• Company name and contact person name
• Email address and phone number
• Job title
• Country
• Services of interest and budget range
• Launch timeline and message content

2.2 Job Applications

Collected via the careers application form

• Full name, email address, and phone number
• LinkedIn profile URL
• Resume/CV (uploaded file)
• Cover letter and work experience details

2.3 Talent Applications (Ripples Star)

Collected via the talent application form

• Full name, email address, and phone number
• Location and talent type (MC, Model, Affiliate, KOC)
• Social media handles (TikTok, Instagram, YouTube, Facebook)
• Video introduction (uploaded file)
• Portfolio materials (uploaded files)

2.4 Portal User Accounts

Collected via Google sign-in on the My Career / My Star portals

• Google account information (display name, email address, profile photo)
• Career profile data (work experience, skills, salary expectation, job search status)
• Talent profile data (talent types, availability, video introduction, portfolio)
• Application history and status

2.5 Automatically Collected Information

• IP address and approximate geographic location
• Browser type, version, and operating system
• Pages visited, time spent, and referring URLs
• Session cookies for authentication purposes

3. Lawful Basis for Processing

Under the PDPA, we process your personal data based on the following lawful bases:

4. How We Use Your Information

We use your personal data for the following purposes:

• Respond to inquiries — Process and reply to brand partnership inquiries and contact form submissions
• Process applications — Evaluate job applications for staff positions and talent applications for our Ripples Star program
• Manage portal accounts — Provide access to My Career and My Star portal features, maintain profiles, and track application statuses
• Send communications — Deliver application status updates, service-related notifications, and (with your consent) marketing communications
• Improve our website — Analyze usage patterns to enhance user experience, performance, and content relevance
• Ensure security — Detect and prevent unauthorized access, fraud, and abuse through rate limiting and audit logging
• Comply with legal obligations — Meet requirements under Thai law, including the PDPA, labor law, and tax regulations

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy. Specific retention periods are as follows:

After the retention period expires, your data will be securely deleted or anonymized. You may request earlier deletion by contacting us (subject to legal retention requirements).

6. Information Sharing

We do not sell, rent, or trade your personal data to third parties. We share your data only with trusted service providers who assist in operating our website and services:

We may also disclose your data when required by law, court order, or government authority, or to protect the rights, property, or safety of Ripples Commerce, our users, or others.

7. Cross-Border Data Transfers

Your personal data may be transferred to and processed in countries outside Thailand. We ensure adequate protection for all cross-border transfers as required by the PDPA:

• Google Cloud Platform — Our primary infrastructure is hosted in the asia-southeast1 (Singapore) region. Google maintains adequate data protection standards.
• Resend — Email delivery services are processed through servers in the United States. Standard Contractual Clauses are in place to ensure adequate protection.

In all cases, we ensure the destination country has adequate data protection standards or that appropriate safeguards (such as Standard Contractual Clauses) are in place, in accordance with Section 28 of the PDPA.

8. Your Rights Under the PDPA

Under Thailand's Personal Data Protection Act, you have the following rights regarding your personal data:

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand.

9. Consent Mechanics

We obtain your consent through the following mechanisms:

• Form submissions — Consent checkboxes on contact forms, job application forms, and talent application forms. You must actively check the consent box before submitting.
• Portal registration — By signing in with your Google account to access the My Career or My Star portals, you consent to the collection and processing of your account data as described in this policy.
• Cookie consent — Essential cookies for authentication are used by default. Non-essential cookies (if introduced in the future) will require explicit opt-in consent.

Withdrawing Consent

You may withdraw your consent at any time by contacting us at privacy@ripplescommerce.com. Portal users may also delete their accounts through the portal settings. Please note that withdrawing consent may affect our ability to provide certain services to you.

10. Cookies & Similar Technologies

Our website uses cookies and similar technologies in the following limited ways:

We do not currently use third-party tracking cookies or advertising cookies. If this changes in the future, we will update this policy and implement a cookie consent mechanism.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using portal features that require authentication.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit — All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS)
• Encryption at rest — Data stored in Firebase/Firestore and Google Cloud Storage is encrypted at rest using Google-managed encryption keys
• Access controls — Role-based access control for admin staff (Super Admin, HR, BD, Star roles); admin access restricted to @ripplescommerce.com email domain
• Audit logging — All administrative actions are logged with user identity, action type, timestamp, and affected records
• Rate limiting — API endpoints are protected against abuse through request rate limiting
• Security headers — Content Security Policy, HSTS, X-Frame-Options, and other security headers are enforced

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.

12. Children's Privacy

Our website and services are not directed at individuals under the age of 20 (as defined by the PDPA for minors in Thailand). We do not knowingly collect personal data from children under 20. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@ripplescommerce.com and we will promptly delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the “Last updated” date at the top of this page. For material changes, we may provide additional notice through our website.

We encourage you to review this policy periodically to stay informed about how we protect your data.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For general inquiries about our services, please visit our contact page.