Tiggal
Login

Privacy Policy

Last updated: October 2026Version v3

Effective Date: October 2026

Tiggal ("we," "us," "our") operates the tiggal.com platform. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the Thailand Personal Data Protection Act (PDPA) B.E. 2562 (2019).

Data Controller

Tiggal is operated from Bangkok, Thailand. Contact: privacy@tiggal.com

Data We Collect

Information You Provide

  • Account data: Name, email address, password (hashed), profile image
  • Artist data: Display name, bio, portfolio information, bank account details (for payouts)
  • Order data: Shipping address, phone number, order history
  • Payment data: Payment slips you upload for bank transfer or PromptPay payments. Card details are entered directly with our payment processor, Stripe, and never reach our servers.
  • Identity verification data: Identity documents and a selfie, only when verification is required (see Identity Verification below)
  • Communications: Messages sent through our platform, support inquiries

Information Collected Automatically

  • Device and browser data: IP address, browser type, operating system, device type
  • Usage data: Pages visited, artworks viewed, search queries, time spent on pages
  • Cookies: Session cookies, preference cookies (see our Cookie Policy)

Information from Third Parties

  • OAuth providers: If you sign in with Google, Facebook, LINE, or Apple, we receive your name and email from that provider. We do not receive your password.
  • Payment processor: Stripe tells us whether a card payment succeeded or failed.

How We Use Your Data

Purpose Legal Basis (PDPA)
Account creation and management Contractual necessity
Processing artwork purchases and orders Contractual necessity
Artist payout processing Contractual necessity
Sending order confirmations and shipping updates Contractual necessity
Identity verification for higher-value purchases and artist payouts Legal obligation and your explicit consent
Platform security (fraud prevention, rate limiting) Legitimate interest
Analytics and platform improvement Legitimate interest
Marketing communications (with consent) Consent
Legal compliance and dispute resolution Legal obligation

Data Sharing

We do not sell your personal data. We share data only with:

  • Payment processor: Stripe processes card, Apple Pay, and Google Pay payments
  • Cloud infrastructure: Amazon Web Services (AWS) hosts our platform in the Asia Pacific (Singapore) region
  • Email delivery: Resend sends our transactional emails, with Amazon Simple Email Service (SES) as a backup
  • Delivery carriers: The name, address, and phone number on your order are shared with the carrier that delivers it
  • Artists: Order details are shared with the relevant artist to fulfill purchases
  • Legal requirements: When required by Thai law or court order

Data Retention

  • Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
  • Order data: Retained for 7 years for tax and legal compliance.
  • Identity verification documents: Retained for 7 years from submission, then deleted automatically.
  • Analytics data: Aggregated and anonymized after 90 days.
  • Artist payout records: Retained for 7 years for financial compliance.

Data Security

We protect your data using:

  • Encryption at rest (AES-256) and in transit (TLS 1.2+)
  • Web Application Firewall (WAF) with bot protection
  • Rate limiting on authentication endpoints
  • Hashed passwords (bcrypt)
  • Role-based access controls

Your Rights Under PDPA

You have the right to:

  • Access your personal data we hold
  • Correct inaccurate or incomplete data
  • Delete your personal data (subject to legal retention requirements)
  • Withdraw consent for marketing communications at any time
  • Port your data in a machine-readable format
  • Object to processing based on legitimate interest
  • Lodge a complaint with the Personal Data Protection Committee (PDPC)

To exercise any of these rights, contact privacy@tiggal.com. We will respond within 30 days.

Identity Verification (KYC)

To comply with anti-money laundering rules and protect the integrity of our marketplace, Tiggal requires identity verification (Know Your Customer, or KYC) for some activities.

When Verification Is Required

  • Basic verification (email confirmation) is completed when you create an account.
  • Enhanced verification (photo ID and a selfie) is required before your next order once your account reaches the Preferred collector tier.
  • Full verification (photo ID, a selfie, and proof of address) is required at the VIP and Patron collector tiers, and before artist payouts can be processed.

Documents We Collect

Depending on the verification level, we may request:

  • Government-issued photo ID (passport, national ID card, or driver's license)
  • Proof of address (utility bill, bank statement, or government correspondence dated within 3 months)
  • Selfie or photo for identity matching
  • Tax identification documents (for artists receiving payouts)
  • Withholding tax certificates (for non-Thai artists)

How We Handle Your Documents

  • Storage: Identity documents are stored encrypted in private, access-controlled storage. They are never published on our website or through our CDN.
  • Access: Only authorized administrators can view submitted documents, through secure links that expire after 5 minutes. Every view is recorded in our audit log.
  • Retention: Identity documents are kept for 7 years from the date of submission, as required by anti-money laundering rules, and are then deleted automatically. We do not delete them before the retention period ends.

Verification Expiry

Identity verifications are valid for 3 years from the date of approval. You will receive an email notification 30 days before your verification expires. If your verification expires, your KYC level is downgraded and you may need to re-verify before continuing certain activities.

Your Rights Regarding KYC Data

In addition to the general data rights listed above, you have the right to:

  • Know what identity documents we hold about you
  • Request access to view your submitted documents
  • Withdraw consent for KYC processing (note: this may restrict your ability to make purchases above the verification threshold or receive artist payouts)
  • Request deletion of your KYC data after the mandatory 7-year retention period has passed

Consent

Before you submit identity documents, we ask for your explicit consent to collect and process them. This consent is recorded separately from your general platform consent.

International Data Transfers

Your data is stored on AWS servers in the Asia Pacific (Singapore) region. Some providers process data in other countries: our content delivery network (Amazon CloudFront) serves pages from locations near you, and Resend (email delivery) and Stripe (payments) may process data in other countries, including Japan and the United States. Data is encrypted in transit, and each provider handles it under its own security and data protection commitments.

Children's Privacy

Tiggal is not intended for users under 18 years of age. We do not knowingly collect personal data from minors.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the platform. The effective date at the top of this page indicates the latest revision.

Contact

For privacy inquiries or to exercise your data rights:

Questions?

If you have any questions about this policy, please contact us at privacy@tiggal.com