Privacy Policy

Effective Date: 01/06/2026
Website: https://centralsdg.com
Company/Brand: SDG - Sky & Derminet Group

1. Introduction

SDG - Sky & Derminet Group (“SDG”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you access or use our websites, platforms, service center, CRM platform, e-commerce services, booking system, membership services, courses, marketing campaigns, events, partner services, and other related services.

By using our website or services, you acknowledge that we may collect, use, and disclose your personal data as described in this Privacy Policy.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data collected through:

1. SDG websites and online platforms
2. SDG Service Center
3. SDG CRM Platform
4. E-commerce and online orders
5. Booking and appointment systems
6. Membership, loyalty, rewards, and referral programs
7. Courses, workshops, academy programs, and events
8. Customer support channels
9. Marketing campaigns, surveys, and promotions
10. Partner services provided through SDG channels
11. Social media, messaging platforms, email, telephone, and offline interactions

This Privacy Policy does not apply to third-party websites or services that have their own privacy policies.

3. Personal Data We May Collect

We may collect the following categories of personal data:

3.1 Identity and Contact Information

• Full name
• Nickname
• Gender
• Date of birth or age
• Nationality
• Identification information, where necessary
• Phone number
• Email address
• Address
• Social media account or messaging ID

3.2 Account and Profile Information

• Username
• Password or encrypted login credentials
• Customer ID
• Membership ID
• Profile information
• Preferences and interests
• Communication preferences
• Loyalty points, rewards, and membership status

3.3 Order, Booking, and Transaction Information

• Product orders
• Service bookings
• Appointment history
• Course registration
• Payment status
• Purchase history
• Invoice and receipt details
• Refund, return, exchange, and cancellation records
• Shipping and delivery information

3.4 Beauty, Wellness, and Service-Related Information

Depending on the service you request, we may collect information such as:

• Skin concerns
• Beauty or wellness preferences
• Treatment interests
• Service history
• Consultation notes
• Before-and-after records, where consent is obtained
• Photos or videos submitted by you
• Health-related information that you voluntarily provide for service assessment

Some of this information may be considered sensitive personal data under applicable law. Where required, we will request your explicit consent before collecting, using, or disclosing sensitive personal data.

3.5 Course, Training, and Event Information

• Course enrollment details
• Attendance records
• Assessment or completion status
• Certificate information
• Training preferences
• Feedback and survey responses

3.6 Marketing and Communication Information

• Marketing consent status
• Campaign participation
• Referral or affiliate information
• Reviews, ratings, comments, and testimonials
• Survey responses
• Customer service communication records
• Chat, email, call, or message history

3.7 Technical and Usage Information

• IP address
• Device information
• Browser type
• Operating system
• Website usage data
• Pages viewed
• Click behavior
• Login activity
• Cookies and tracking technologies

• Approximate location derived from technical data

   

4. How We Collect Personal Data

We may collect personal data directly from you when you:

1. Visit our website
2. Create an account
3. Place an order
4. Book a service
5. Register for a course or event
6. Contact our service center
7. Join a membership, loyalty, referral, or affiliate program
8. Complete a form, survey, or consultation request
9. Subscribe to newsletters or marketing messages
10. Interact with us through social media or messaging platforms
11. Submit reviews, comments, photos, or testimonials
12. Use our CRM, booking, e-commerce, or online service features

We may also receive personal data from third parties, such as payment providers, delivery providers, marketing platforms, partner clinics, merchants, instructors, affiliates, or business partners, where permitted by law.

5. Purposes of Collection, Use, and Disclosure

We may collect, use, and disclose your personal data for the following purposes:

5.1 Service Operation

• Create and manage your account
• Provide customer support
• Process orders and payments
• Arrange shipping and delivery
• Manage bookings and appointments
• Provide products and services
• Manage courses, events, and training programs
• Issue receipts, invoices, and certificates
• Handle complaints, refunds, returns, and exchanges

5.2 CRM, Membership, and Customer Experience

• Maintain customer profiles
• Manage membership and loyalty programs
• Track service history and purchase history
• Provide personalized recommendations
• Offer rewards, vouchers, and benefits
• Improve customer service and follow-up
• Segment customers for service improvement

5.3 Marketing and Business Communication

• Send news, promotions, offers, and campaign updates
• Recommend products or services
• Conduct surveys and customer satisfaction research
• Measure marketing campaign performance
• Manage affiliate and referral programs
• Create lookalike audiences or retargeting campaigns, where permitted
• Display relevant online advertisements

You may opt out of marketing communications at any time through the unsubscribe link or by contacting us.

5.4 Safety, Security, and Fraud Prevention

• Verify identity
• Prevent fraud, abuse, spam, and unauthorized access
• Protect our systems and users
• Monitor suspicious transactions
• Maintain audit logs and security records
• Enforce our Terms & Conditions

5.5 Legal and Compliance Purposes

• Comply with applicable laws and regulations
• Respond to lawful requests from authorities
• Maintain accounting, tax, and business records
• Establish, exercise, or defend legal claims

• Comply with consumer protection, data protection, and electronic transaction requirements

   

6. Legal Bases for Processing Personal Data

Where applicable, we may process personal data based on one or more of the following legal bases:

1. Consent — where you have given consent for specific processing activities, such as marketing or sensitive personal data.
2. Contract — where processing is necessary to provide products or services you requested.
3. Legal Obligation — where processing is necessary to comply with applicable law.
4. Legitimate Interest — where processing is necessary for our legitimate business interests, provided such interests do not override your rights.
5. Vital Interest — where processing is necessary to protect life, health, or safety.

6. Public Interest or Official Authority — where required by applicable law.

    

7. Sensitive Personal Data

SDG may collect sensitive personal data only where necessary and permitted by law, such as when providing or coordinating certain beauty, wellness, healthcare-related, clinic, or treatment-related services.

Sensitive personal data may include health-related information, medical history, allergies, skin conditions, treatment records, photos related to treatment, or other information you voluntarily provide for service assessment.

We will request your explicit consent before collecting, using, or disclosing sensitive personal data, unless an exception under applicable law applies.

8. Disclosure of Personal Data

We may disclose your personal data to the following parties where necessary:

1. SDG group companies, affiliates, and related businesses
2. Partner clinics, wellness centers, merchants, academies, instructors, or service providers
3. Payment service providers and banks
4. Delivery, logistics, and courier companies
5. IT service providers, hosting providers, CRM providers, and system developers
6. Marketing, advertising, analytics, and social media platforms
7. Customer support and call center service providers
8. Accounting, tax, legal, audit, and professional advisors
9. Government agencies, regulators, courts, or law enforcement authorities
10. Business partners in the event of merger, restructuring, investment, acquisition, or business transfer

We will disclose personal data only as necessary and in accordance with applicable law.

9. International Transfer of Personal Data

Some service providers, cloud platforms, marketing platforms, payment providers, or business partners may be located outside Thailand.

Where personal data is transferred internationally, we will take reasonable steps to ensure that appropriate safeguards are in place as required by applicable data protection law.

10. Cookies and Similar Technologies

Our website may use cookies and similar technologies to support website functionality, security, analytics, personalization, advertising, and user experience.

Cookies may help us remember your preferences, improve website performance, analyze visitor behavior, and deliver relevant content or advertisements.

For more details, please read our Cookie Policy.

11. Data Retention

We will retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

1. The type of personal data
2. The purpose of processing
3. Contractual obligations
4. Legal, accounting, and tax requirements
5. Dispute resolution and legal claim requirements
6. Business operation and audit requirements

When personal data is no longer necessary, we will delete, destroy, anonymize, or securely restrict access to such data.

12. Data Security

We use reasonable administrative, technical, and physical safeguards to protect personal data from unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include access control, password protection, encryption, secure servers, system monitoring, staff training, data backup, and limited access based on business necessity.

However, no method of transmission or storage is completely secure. We cannot guarantee absolute security of information transmitted over the internet.

13. Data Breach Notification

If a personal data breach occurs, we will assess the risk and take appropriate action in accordance with applicable law.

Where required, we may notify the relevant authority and/or affected data subjects. Under Thailand’s PDPA framework, data breach notification to the regulator may be required without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

14. Your Rights as a Data Subject

Subject to applicable law and conditions, you may have the following rights:

1. Right to be informed
2. Right to access your personal data
3. Right to request a copy of your personal data
4. Right to data portability
5. Right to object to processing
6. Right to request deletion, destruction, or anonymization
7. Right to restrict processing
8. Right to request correction of inaccurate or incomplete data
9. Right to withdraw consent
10. Right to lodge a complaint with the relevant authority

Some rights may be subject to legal limitations, verification requirements, or exceptions. PDPA-related guidance recognizes that rights are not always absolute and may depend on the circumstances and legal basis for processing.

15. Withdrawal of Consent

Where we rely on your consent to process personal data, you may withdraw your consent at any time by contacting us.

Withdrawal of consent will not affect processing that was lawfully carried out before the withdrawal.

Please note that withdrawing consent may affect our ability to provide certain services, such as personalized offers, marketing communication, treatment-related assessments, or membership features.

16. Marketing Communications

If you agree to receive marketing communications, we may send you news, promotions, offers, campaigns, service updates, and personalized recommendations.

You may opt out at any time by:

1. Clicking the unsubscribe link in an email
2. Adjusting your account or cookie preferences
3. Contacting our customer service team
4. Following opt-out instructions in SMS, LINE, or other communication channels

Even if you opt out of marketing messages, we may still send service-related messages such as order confirmations, booking reminders, payment notices, policy updates, or security notifications.

17. Children’s Personal Data

Our services are generally intended for adults. If we collect personal data from minors, we will comply with applicable laws regarding parental or guardian consent.

If you believe that a minor has provided personal data to us without proper consent, please contact us so we can take appropriate action.

18. Third-Party Websites and Services

Our website or platform may contain links to third-party websites, social media platforms, payment providers, partner clinics, merchants, or external services.

We are not responsible for the privacy practices, content, security, or policies of third-party services. Please review their privacy policies before using their services.

19. Accuracy of Personal Data

You are responsible for ensuring that the personal data you provide to us is accurate, complete, and up to date.

If your personal data changes, please update your account or contact us.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business operations, technology, legal requirements, or data protection practices.

The updated Privacy Policy will be posted on our website with a revised effective date. We encourage you to review this Privacy Policy regularly.

21. Contact Us

If you have questions, requests, complaints, or concerns about this Privacy Policy or our handling of personal data, please contact us.