Your data

Privacy &
Cookies.

Last updated 22 October 2026

We collect only what we need to sell and deliver your stones, we never sell your data, and you can see, correct or delete it at any time.

Who we are

Colour World Gems Co., Ltd., Sita Building No.402, 4th Floor, Surawong Rd, Si Lom, Bang Rak, Bangkok 10500, Thailand, is responsible for your personal data. Contact us at [email protected] about anything on this page.

Your account: name, email address, country, phone number, password (stored only as a secure one-way hash we cannot read), and whether you want our emails.
Your shipping address, saved so checkout is quick.
Orders: the stones, reports and amounts. Payments are handled by PayPal: we never see or store your card number.
Your cart and favourites.
Security records: failed sign-in attempts, stored against a scrambled (hashed) form of your IP address, deleted after two days.
Messages you send through our forms, by email or on WhatsApp.

To run your account and fulfil your orders (a contract with you): invoicing, shipping, returns and customer service.
To meet legal duties: tax and accounting records, and customs paperwork for shipments.
To keep the site and your account secure (our legitimate interest): rate limits, fraud checks and sign-in alerts.
To email you about new stones, only if you ask us to (consent). Every email has an unsubscribe link.
Optional cookies, only with your consent.

PayPal, to take payment. FedEx or DHL, to deliver your parcel (name, address, phone). A gem laboratory, if you order a report (the stone only, not your details).
The companies that host and run the site for us: Cloudflare (hosting and database) and Resend (which sends our emails). They act on our instructions and may store data outside your country, under standard contractual safeguards.
Authorities, only where the law requires it. We never sell your data or share it for others' marketing.

Your account, until you delete it. You can do that yourself under Account, Sign-in & security.
Order and invoice records, for as long as tax and accounting law requires, even after an account is deleted.
Password reset and confirmation links expire within 30 minutes and 7 days.

You can ask for a copy of your data, have it corrected, deleted or moved, object to or limit how we use it, and withdraw consent at any time. Email [email protected]; we reply within 30 days.
You can also complain to your data protection authority: in the UK the ICO, in the EU your national authority, in Thailand the PDPC. California residents have the same rights under the CCPA; we do not sell or share personal information for advertising.

The whole site runs over encrypted HTTPS. Passwords are salted and hashed, sign-in codes are stored only as hashes, repeated wrong passwords are slowed down, and new passwords are checked against known data breaches without ever being sent anywhere.

Essential cookies make the site work and need no consent. Optional ones only load after you agree, and you can change your mind at any time.

Name	Type	What it does	How long
__Host-cwg_session	Essential	Keeps you signed in on this device. Holds a random code, not your details.	90 days after your last visit, or until the browser closes if you untick "Keep me signed in"
cwg_consent	Essential	Remembers your cookie choices.	6 months
cwg-cart, cwg-favourites	Essential (device storage)	Your cart and favourites before you sign in.	Until you sign in or clear your browser
cwg-currency	Essential (device storage)	The currency you chose for prices.	Until you clear your browser
PayPal	Essential, set by PayPal	Loaded only at checkout, to take the payment securely and prevent fraud.	Set by PayPal
Google Maps	Maps and media, only with your consent	Shows the map on the contact page.	Set by Google

The site is not meant for anyone under 18, and we do not knowingly collect their data.
If this policy changes, the new version will be posted here with a new date.