Privacy policy

Last updated 23 October 2026

Use the contents to find collected data, purposes and retention, recipients, and how to request access, correction or deletion. Full details follow below.

Sixty Sip collects personal data necessary for customer accounts, points, orders, delivery and customer support. This policy describes the data collected, its purposes, retention periods and customer rights under Thailand's Personal Data Protection Act B.E. 2562 (2019), or PDPA.

Data controller

The sole proprietor operating as Sixty Sip Coffee is the data controller for this service. Contact LINE ID @sixtysip.coffee or email support@sixtysip.com as listed on the Contact

Information collected and its purposes

Information	Purpose	Retention period
Phone number	Verify customer identity by SMS OTP, link access to the Member ID, provide order updates and enable delivery personnel to contact the customer	Throughout the period of account use
Member ID, display name and date of birth	Create and manage member profiles, identify the points owner and show the account name for checking after phone verification. The account check before sign-in does not display the date of birth.	Throughout the period of account use
Email address provided by the customer and its verification status	Send email OTPs for email verification, account security, Member ID recovery following a phone number change, and verification before orders or reward redemption	Until the account is changed or deleted. Security evidence may be retained where there is a lawful reason.
OTP request and verification records, including time, channel and verification result	Prevent repeated code requests and unauthorised account access, and investigate verification issues	As needed for security and investigation of unusual activity
Customer delivery address and selected location	Identify the serving warehouse, calculate delivery fees and fulfil customer orders	After account closure, ordinary personal data enters deletion under the 30-day policy. Necessary transaction and internal accounting evidence, such as recipient name, delivery address in transaction documents, refund-transfer details or proof, parcel tracking, and exported or printed documents, may be retained for a minimum of 2 years from the transaction date. Access is limited to authorized staff, and this evidence is not automatically deleted at that minimum until a clearly published accounting-document disposal policy exists.
Current location	Display the menu and stock available from the warehouse serving the customer location	Used temporarily during the session; no travel history is recorded
Location shared for service-area planning (optional)	Application-opening events are recorded using the current location and selected delivery pin, without names, phone numbers, email addresses, Member IDs or device identifiers. Consent for this purpose is separate from location use for seller searches and orders. Customers may withdraw this consent through the app at any time.	Exact coordinates and event timestamps are retained for 2 calendar years from the recorded event, using Thailand time, to analyse and plan service areas. This matches the backup retention period. Location records are collected without account identifiers or other personal details. Member-linked account and delivery-address data enter deletion processing after the 30-day account recovery window, while the exact analytical coordinates and date-time remain until their original expiry. Account closure and retries do not restart this 2-year lifetime. Location records contain no name, phone number, email, Member ID or device identifier. Precise coordinates and timestamps may identify a person when combined with other information. Access is restricted, and these records are not treated as anonymous in all circumstances.
Order history and points	Provide customer access to account history, calculate points by Member ID and retain transaction evidence	Membership and points history are retained for the life of the account. Transaction records are kept further only as needed for accounting and legal purposes.
Bank account details (only when needed for a refund)	Transfer refunds for PromptPay payments or other cases requiring a direct bank transfer	Related bank-account data and refund-transfer evidence may be retained for a minimum of 2 years from the transaction date for accounting, refund review, and legal obligations. Access is limited to authorized staff and is not automatically deleted at that minimum until a clearly published accounting-document disposal policy exists
Device notification token	Send order and service notifications, and news or promotions only when the customer has opted in to marketing Push notifications	While the token remains registered and usable for the device and account; invalid tokens are removed. Account-linked records enter the account-deletion process. Turning off notification display does not itself delete Firebase installation identifiers.
Messages and photos sent to customer support	Handle complaints, product issues, refunds or account recovery	As needed to resolve the issue and retain evidence required by law

Customer registration requires a name, date of birth and verified phone number. The name is entered in one field; a first name alone is accepted and a surname is optional. An email address is optional during initial registration and is not required to earn points. A verified email address is required for orders, point redemption, coupon use and account recovery by email.

For an active account without a verified email, successful SMS OTP verification of its linked phone number signs the customer back into the same Member ID. An account with a previously verified email requires the additional email verification shown in the app. A phone-number change or ownership dispute follows the account-recovery checks; SMS verification alone does not transfer another account’s points.

Marketing SMS and marketing Push notifications are separate choices. Customers can allow or refuse each in the app’s news and notification settings. A manual campaign uses one selected channel per send and does not automatically send through both. Refusing marketing does not prevent account use; OTP and necessary service messages are handled separately.

Member IDs associate communication preferences and campaign delivery records with the account. Firebase can create installation identifiers independently of Android notification permission. Sixty Sip does not include an advertising-ID or cross-app advertising SDK in the Buyer app.

After registration, customers without a verified email are reminded to verify it to protect account recovery and points. The reminder may appear once per Thailand calendar day until verification.

Legal grounds for using data

Sixty Sip uses information necessary to fulfil customer requests and service agreements, including account creation, point calculation, order processing and delivery. Certain records are used for accounting or legal obligations. Security data is used to prevent account impersonation and investigate complaints. Access to current location requires customer permission through the device.

Information not collected

• Sixty Sip does not receive or store full card numbers or card security codes. Card details are entered through Beam.
• Sixty Sip does not collect bank account details in advance. The details are requested only when a refund is actually needed.
• Sixty Sip does not sell or rent customer personal data to third parties for marketing.

Relevant third-party providers

Account verification, payments, delivery and notifications involve the following providers. Only information needed for the selected service is sent.

Service provider	Information shared	Purpose
Beam	Payment amount and necessary order reference details	Process payments and card refunds
Lalamove	Recipient name, phone number, delivery address and coordinates	Deliver customer orders
SMSOK	Phone number and SMS content	SMS OTP, service messages and marketing SMS only with the customer’s consent
Resend	Email address and verification message	Send email verification and account-recovery codes
Google Firebase Cloud Messaging and Firebase Installations	Installation identifiers, notification token and necessary app/device metadata	Deliver service notifications and consented marketing Push notifications

Certain service providers may process data outside Thailand. Sixty Sip manages international data transfers in accordance with applicable requirements.

Data security

• All data is transmitted over encrypted HTTPS connections.
• Access to account and order data is restricted. OTP codes have a short lifetime and are stored in a form that does not reveal the original code.
• Bank account details can only be accessed by authorised staff in the internal system and are never sent by SMS or email.
• Event records are retained to investigate data access and refunds.

Customer rights

Customers may request access, copies, correction, deletion, restriction, objection or portability where provided by the PDPA, and may withdraw consent for processing based on consent. Requests may be submitted through LINE ID @sixtysip.coffee or support@sixtysip.com. Sixty Sip records requests and processes them within the applicable legal timeframes.

Customers can request account closure and data deletion in the app at Account → Personal information → Delete account, or contact customer support using the details on the Account and data deletion

Deletion of certain information may prevent continued use of the service. Records required for accounting and tax obligations may be retained.

Once an account closure request is accepted, access is revoked immediately. The account may be recovered within 30 days of the original request. After that deadline, associated personal data and member-linked delivery-address data are processed for deletion; retained exact analytical coordinates follow the 2-year policy above. Acceptance does not confirm completion across every source. Original backups are not modified to remove individual records and retain their original 2-year lifetime; closure and retries do not extend it. Records due for deletion must be removed from restored backups before the service resumes.

Cookies

The Sixty Sip public website does not currently use cookies to track behaviour across websites for advertising. If Sixty Sip introduces analytics or advertising tools that use cookies, Sixty Sip will update the notice and relevant choices before using them.

Policy changes

Policy revisions are identified by the updated date on this page. Changes that materially affect customer rights will be communicated through the app.