Privacy Policy

Who is responsible

Tess Vegan Cafe, 152, 22 Moo 5, Na Kluea Soi 16, Pattaya City, Bang Lamung District, Chonburi 20150, Thailand.

Phone and WhatsApp: +66 93 592 5288. You are also welcome to talk to us in person at the cafe.

Hosting and server logs

Our website is hosted on Firebase Hosting, a service provided by Google. Whenever you open a page, your browser automatically sends technical data to Google's servers: your IP address, the date and time of the request, the page requested, your browser and device type and, if available, the page you came from.

This data is needed to deliver the website, keep it secure and fix errors. We do not use it to identify you. Google keeps these logs according to its own retention periods. Our fonts are served from our own domain; some images are delivered from Google Cloud Storage (Firebase Storage).

Analytics (Google Analytics 4) – only with your consent

• On your first visit we ask whether you allow analytics. Until you click “Accept”, Google Analytics is not loaded and no analytics data is sent.
• If you accept, we use Google Analytics 4 with Google Consent Mode v2. Only analytics storage is enabled; advertising storage, ad user data and ad personalisation stay switched off, and so do Google signals and ad personalisation.
• Google Analytics then sets cookies (_ga, _ga_…) and records which pages you view and certain clicks, for example on Google Maps, Grab, WhatsApp or the reservation button, together with device and browser information and an approximate location derived from your IP address. Apart from campaign tags (utm_source, utm_medium, utm_campaign), web addresses are sent without query parameters.
• Your choice is saved in your browser's local storage (key “tvc:analytics-consent:v1”), not in a cookie, and is not sent to us.
• You can change your decision at any time via “Cookie settings” at the bottom of every page. If you withdraw consent, Google Analytics is disabled and its cookies are deleted.
• Analytics is never used on the reservation, table-ordering or staff pages.

Table reservations

When you reserve a table online we process your name, email address, phone number, date, time and party size, any allergies or notes you enter and, if you tick the box, your request to receive our newsletter.

We use this data to manage your reservation, to send you a confirmation, a reminder and a link to change or cancel the booking, and to prepare your meal safely. Allergy information can be health data; we only process it because you choose to give it to us, and only for preparing your food.

The data is stored in Google Firebase (Cloud Firestore); reservation emails are sent through the email service Brevo. To protect the form against abuse we use Firebase App Check with Google reCAPTCHA Enterprise, an anonymous technical sign-in (Firebase Authentication) and rate limits based on a pseudonymised (hashed) form of your IP address.

30 days after the reserved time, name, email address, phone number and notes are automatically anonymised. You can also reserve by phone or WhatsApp instead.

Ordering at the table

When you order through the QR code at your table we process your order. You can optionally enter your email address to receive a receipt and, if you wish, to request our newsletter. If you provide an email address, we may also send you one short email asking you to review your visit.

If you choose to pay online, payment is handled by Stripe (Stripe Checkout). You enter your card details directly at Stripe; we only receive the payment status, never your full card number.

Your email address and personal order notes are deleted 30 days after the order is completed. Order totals are kept for our accounting.

Newsletter

We only send our newsletter if you ask for it and confirm your email address via a confirmation link (double opt-in; the link is valid for 48 hours). After confirmation, your email address and language are stored with Brevo. You can unsubscribe at any time using the link in every email or by telling us.

Google Maps map

On the home page and in the footer we show an embedded Google Maps map. It is loaded from Google only when you scroll close to it. Google then receives your IP address and technical data and may set its own cookies; Google's privacy policy applies. If you prefer not to load the map, simply use the address above.

Links to other services

Links to Grab, WhatsApp, Google Maps directions, Facebook, Instagram, TikTok, HappyCow and other websites are plain links. No data is sent to these services until you click a link; after that, the provider's own privacy policy applies. If you message us on WhatsApp, the messages are processed by WhatsApp (Meta); we only use them to reply and handle your request.

Service providers and transfers abroad

We use these providers only to run the services described above: Google (Firebase Hosting, Cloud Firestore, Cloud Functions in the Singapore region, Google Analytics, reCAPTCHA, Google Maps), Brevo (email, based in France) and Stripe (online payment). Your data may therefore be processed outside Thailand, for example in Singapore, the European Union or the United States.

Legal bases under Thailand's Personal Data Protection Act (PDPA)

• Performing a contract or taking steps at your request: reservations and orders.
• Your consent: analytics, newsletter and allergy information you choose to give us.
• Our legitimate interests: secure and reliable operation of the website, server logs and protection against abuse.
• Legal obligations: keeping accounting records.

Your rights

Under the PDPA you can withdraw your consent at any time, request access to and a copy of your data, receive your data in a common format, object to processing, ask for your data to be deleted or anonymised, restrict its use and have it corrected. Contact us by phone, WhatsApp or in person; we may need to confirm your identity first.

You also have the right to complain to the Office of the Personal Data Protection Committee (PDPC) of Thailand.

Visitors from the EU/EEA

If you visit us from the European Union or the European Economic Area, the GDPR may also apply. The corresponding legal bases are your consent (Art. 6(1)(a) GDPR, for allergy information Art. 9(2)(a) GDPR), the performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interests (Art. 6(1)(f) GDPR). You have the rights of access, rectification, erasure, restriction, data portability and objection and may withdraw consent at any time (Art. 7(3) and 15–21 GDPR). You may also lodge a complaint with a data protection supervisory authority, in particular in your country of residence.

Changes to this policy

We update this policy when our website or services change. The current version is always published on this page.