Privacy Policy

01Who We Are

AVYK Diamonds Co., Ltd. ("AVYK", "we", "us") is a luxury jewellery manufacturer based in Bangkok, Thailand, and a RedExim Group brand. We are the data controller responsible for the personal information described in this policy.

This policy explains what personal information our mobile applications and related services collect, why we collect it, who we share it with, and the choices and rights you have. It applies to both of our mobile applications and to this website.

02The Applications This Policy Covers

This policy covers two separate applications built on a shared platform:

Because the two applications serve very different purposes, some of the data described below is collected by only one of them. Where that is the case, we say so explicitly.

03Information We Collect

Information you give us

• Account details — your name, email address, mobile phone number and password when you register or sign in. Passwords are never stored in readable form on our servers.
• Contact and delivery details — postal address and any other contact information you provide in order for us to fulfil an order or arrange an appointment.
• Order and enquiry information — the pieces you view, save, enquire about or order, together with any notes, specifications or requests you send us.
• Messages — the content of messages you exchange with our team through the in-app chat or support features.
• Photographs and files you choose to upload — for example an image used for visual search, a profile picture, or a screenshot or voice note attached to a support request. These are uploaded only when you actively select or record them.

Information collected automatically

• Device and app information — device name, operating system platform, and the version of the app you are running. We use this to deliver notifications correctly and to diagnose faults.
• Push notification token — a token issued by Apple or Google that lets us send notifications to your device. See section 05.
• Sign-in records — the date and time of your sign-ins, and the approximate location of the device at sign-in where you have granted location permission. We keep this as a security measure so that you and we can identify unrecognised access to an account.
• An installation identifier — a random identifier generated on first launch to distinguish your installation. It is not derived from your device's hardware identifiers and does not follow you across other apps.

Information collected in AVHUBYK only (staff)

• Attendance and work location — when an authorised employee clocks in or out, the app records the time and the device's location at that moment, and checks it against the permitted site boundary. This is used solely for attendance, payroll and workplace safety purposes, and only while the app is in use.
• Employment records — leave, helpdesk tickets, announcements and other human-resources information necessary for the employment relationship.

04Device Permissions

The applications ask for the permissions below. Each is requested only when the related feature is used, and you may decline or later withdraw any of them in your device settings — the rest of the app will continue to work.

Our applications do not request access to your contacts, your calendar, your health data, your call history or your SMS messages.

05Push Notifications

If you allow notifications, Apple or Google issues a device token which we store on our servers alongside your account, the platform (iOS or Android), your device name and the app version. We use it only to deliver notifications relating to your account, your orders and your messages.

Notification delivery necessarily involves Apple's Push Notification service or Google's Firebase Cloud Messaging, since they operate the channel to your device. You can turn notifications off at any time in your device settings; when you sign out, we delete the token associated with that device.

06Biometric and Face Sign-In

Both features are optional convenience features that you must switch on yourself.

• Fingerprint / Face ID unlock uses your operating system's own biometric check. Your fingerprint or face data never leaves the secure hardware of your device and is never accessible to us.
• Face sign-in captures a photograph with the front camera and keeps it in the app's private storage on your device only. We do not upload it to our servers, we do not share it with anyone, and we do not use it for identification beyond unlocking your own account on that device. Turning the feature off, signing out, or uninstalling the app removes it.

We do not perform facial recognition on any other image, and we do not create biometric templates from photographs you upload.

07How We Use Your Information

• To create and administer your account, and to authenticate you.
• To process, fulfil, deliver and support your orders, enquiries and appointments.
• To communicate with you about your orders, appointments and support requests.
• To take payment, and to process refunds where applicable.
• To operate our business — production planning, inventory, accounting and internal reporting.
• To administer the employment relationship, for authorised staff using AVHUBYK.
• To keep the applications secure, prevent fraud and unauthorised access, and investigate misuse.
• To meet our legal, tax, accounting and regulatory obligations.

Where the law requires a legal basis for processing, we rely on the performance of our contract with you, our legitimate interests in operating and securing our business, your consent (for optional device permissions and marketing messages), and compliance with legal obligations.

08Who We Share Information With

We share personal information only where it is necessary, and only with the following categories of recipient:

We may also transfer personal information as part of a corporate reorganisation, merger or sale of business, in which case we will ensure it remains protected under terms consistent with this policy.

09International Transfers

We operate from Thailand and serve clients in Europe, Asia, the Middle East and the United States. Your information may therefore be processed in, or accessible from, countries other than your own, including by the service providers named above. Where we transfer personal information out of a jurisdiction that restricts such transfers, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

10How Long We Keep It

We keep personal information only for as long as we need it for the purposes described above. In practice that means: account information for as long as your account is open; order, payment and tax records for the period required by Thai accounting and tax law; sign-in security records for a limited period appropriate to detecting unauthorised access; and employment records for the period required by employment law. When information is no longer needed, we delete it or irreversibly anonymise it.

11Security

We take reasonable technical and organisational measures to protect personal information, including encrypted transport for data in transit, hashed storage of passwords on our servers, role-based access controls that restrict staff access to what their role requires, and separation between customer-facing and internal administrative systems.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authority where the law requires it.

12Your Rights

Subject to the law that applies to you — including Thailand's Personal Data Protection Act, and the UK and EU GDPR where relevant — you have the right to:

• Ask for a copy of the personal information we hold about you.
• Have inaccurate or incomplete information corrected.
• Ask us to delete your personal information.
• Object to, or ask us to restrict, certain processing.
• Withdraw a consent you previously gave, including any device permission.
• Receive your information in a portable, machine-readable format.
• Complain to your local data protection authority.

To exercise any of these rights, contact us at avyk@avykdiamonds.com. We will respond within the period the applicable law allows. We may need to verify your identity before acting on a request.

13Deleting Your Account

You may delete your account and the personal information associated with it at any time. You can request deletion from within the app, or by emailing avyk@avykdiamonds.com from the address registered to the account.

When you delete your account we remove your profile, your saved pieces, your messages and your device tokens. We may need to retain a limited record of completed transactions where accounting, tax or legal obligations require it; that retained record is not used to contact you or to build a profile.

14Children

Our applications are not directed at children. AVYK One is intended for adults purchasing or enquiring about fine jewellery, and AVHUBYK is restricted to authorised employees. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

15Changes to This Policy

We may update this policy to reflect changes in our practices or the law. We will change the effective date at the top of this page, and where the change is material we will give notice in the app or by email before it takes effect.

16Contact Us