Privacy Policy

We collect information in the following ways:

• Account data — name, email address, phone number, and profile picture when you register or sign in (including via Facebook Login).
• Transaction data — order history, payment method type (not full card numbers), points balance, voucher usage, and reward redemption records.
• Device & usage data — IP address, browser type, operating system, pages visited, and session duration collected automatically through cookies and similar technologies.
• Communications — messages or feedback you send to us via the contact form or email.

We use your personal data to:

• Create and manage your Nuk Café account.
• Process orders, redemptions, and loyalty transactions.
• Send you transactional notifications (order confirmations, reward updates).
• Send marketing communications where you have opted in — you may opt out at any time.
• Analyse Service usage to improve functionality and user experience.
• Comply with legal and regulatory obligations.
• Prevent fraud and ensure the security of our Service.

We process your personal data under the following legal bases:

• Consent — for marketing communications and optional features (e.g. Facebook Login).
• Contract performance — to deliver services and process transactions you request.
• Legitimate interests — for fraud prevention and Service improvement, where your interests do not override ours.
• Legal obligation — to comply with applicable Cambodian and Hong Kong law and regulatory requirements.

We integrate with the following third-party services that may receive your data:

• Meta (Facebook Login) — if you choose to sign in with Facebook, we receive your public profile and email address from Meta Platforms, Inc. Meta's data practices are governed by the Meta Privacy Policy.
• Payment processors — we use PCI-DSS compliant payment gateways. We do not store full card details.
• Cloud infrastructure — our Service runs on Amazon Web Services (AWS) in the Asia Pacific (Singapore) region.
• Analytics — we may use aggregated, anonymised analytics tools to understand usage patterns.

We use cookies and similar technologies to:

• Keep you logged in between sessions.
• Remember preferences such as language and region.
• Analyse traffic and improve our website.

You can disable cookies in your browser settings; however, some features of the Service may not function correctly without them.

We do not sell your personal data. We may share it with:

• Service providers who help us operate the Service (hosting, payments, email delivery) under strict data processing agreements.
• Legal authorities when required by law, court order, or to protect the rights and safety of Nuk Café and its users.
• Business transfers — in the event of a merger, acquisition, or asset sale, your data may be transferred as part of the business.

We retain personal data for as long as necessary to fulfil the purposes described in this policy:

• Active account data is retained for the lifetime of your account.
• Transaction records are retained for 7 years to comply with Thai accounting and tax law.
• After account deletion, residual data is purged within 90 days except where legal obligations require longer retention.

Under applicable data protection law (and GDPR where applicable), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data (subject to legal retention requirements).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request that we limit processing of your data.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, contact us at privacy@nukcafe.co. We will respond within 30 days.

Our Service is not directed to children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

We implement industry-standard technical and organisational measures to protect your data, including TLS encryption in transit, AES-256 encryption at rest, access controls, and regular security audits. No system is perfectly secure; please use strong passwords and keep your account credentials confidential.

Your data is primarily stored and processed in AWS Asia Pacific (Singapore). If data is transferred across jurisdictions, we ensure adequate safeguards are in place in accordance with applicable data protection requirements.

We may update this policy periodically. When we make material changes we will notify you by email or via an in-app notice. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For privacy-related enquiries, complaints, or to exercise your rights:

If you are not satisfied with our response, you may lodge a complaint with the relevant data protection authority in your jurisdiction.