Privacy Policy

1. Who We Are

RYTM Shop is operated by Light Mandalas Co., Ltd., registered in Thailand (138/1 Soi 10 Moo 9, 50220 Doi Saket, Chiang Mai, Thailand). We sell supplements, frequency devices, and wellness programs through our online store at rytm.shop.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website or place an order.

2. Data We Collect

When you browse or purchase from our store, we may collect:

• Identity data: first name, last name
• Contact data: email address, phone number
• Delivery data: shipping address, country, postal code
• Transaction data: order details, payment method (we do not store card numbers)
• Technical data: IP address, browser type, device type, pages visited, time spent
• Marketing preferences: whether you have opted in to receive promotional emails

3. How We Use Your Data

We use your personal data to:

• Process and fulfil your orders, including shipping and delivery notifications
• Handle returns, refunds, and customer support requests
• Send transactional emails (order confirmation, shipping updates)
• Send marketing communications, if you have opted in (you can unsubscribe at any time)
• Improve our website and product offerings through analytics
• Comply with legal obligations

4. Legal Basis for Processing

We process your data under the following legal bases:

• Contract performance: processing necessary to fulfil your order
• Legal obligation: retaining transaction records as required by tax and accounting law
• Legitimate interests: fraud prevention, website security, service improvement
• Consent: marketing emails (you can withdraw consent at any time)

5. Cookies and Tracking

Our website uses cookies and similar technologies for:

• Essential site functions (cart, session management)
• Analytics (understanding how visitors use our site)
• Marketing (retargeting ads, where applicable)

You can control cookie preferences through your browser settings. Disabling certain cookies may affect site functionality.

6. Sharing Your Data

We share your personal data only with:

• Shipping partners: to deliver your order (name, address, phone)
• Payment processors: to process your payment securely (we do not see or store card details)
• Email service providers: to send transactional and marketing emails
• Analytics providers: aggregated, anonymised data only

We do not sell your personal data to third parties.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy. Order and financial records are kept for a minimum of 7 years in accordance with Thai accounting law. You may request deletion of your account data at any time, subject to legal retention requirements.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Data portability — receive your data in a machine-readable format
• Withdraw consent for marketing at any time

To exercise any of these rights, contact us at bright@rytm.health. We will respond within 30 days.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data is transmitted over HTTPS. Payment processing is handled by PCI-DSS compliant third-party providers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our website after changes constitutes acceptance of the updated policy.