Privacy Policy

1. Who we are

This website and its online booking are run by FITFAC Co., Ltd. (บริษัท ฟิตแฟค จำกัด — "FITFAC", "we"), the data controller for the personal data described here.

2. What this policy covers

The pages of this website and the online booking of private sessions (the booking, checkout and cancellation pages), and FITFAC Ads Tool, the internal software we run our own Google Ads with (section 11).

3. What we collect

3.1 When you book a session online

• Your name — split into a first name and surname for our booking system
• Your email address — for the booking confirmation
• Your phone / WhatsApp number, with its country code
• Where you are staying (optional) — so we can suggest the nearest gym

With it we record what you chose: the day and time, the number of people, the branch, the language of the page you booked in, the amount and currency, the PayPal order number and the booking reference.

3.2 When you pay

You pay in PayPal's own payment fields. Your card number and PayPal login go to PayPal, not to us; we never receive or store them. From PayPal we receive the order number, the amount, the currency and whether the payment went through.

3.3 When you ask to cancel

You give us your booking reference and the email you booked with. We look the booking up and pass its details and your request to our team.

3.4 When you message us on WhatsApp or LINE

Some buttons open WhatsApp or LINE with a message already written for you, which can include details you entered on the page. Nothing is sent until you press send yourself. From then on the conversation is under WhatsApp's or LINE's own terms.

3.5 Website and advertising measurement

We use Google Tag Manager to load these tools:

• Google Analytics — counts page views and actions such as tapping LINE / WhatsApp / call, starting a booking and completing a payment, with device, browser and approximate location
• Google Ads — measures which ads led to a message, a booking or a payment
• Meta Pixel (Facebook / Instagram) — measures Meta ads the same way
• Microsoft Clarity — records how our pages are used (scrolling, taps, and which parts of a page are seen) and shows it back to us as heatmaps and replays, so we can find what is hard to use. What you type into a form is hidden before anything leaves your browser, and we do not use Clarity to identify you

When a payment goes through, the page turns your email address and phone number into SHA-256 codes (which cannot be turned back into the email or number) and may send those codes to Google Ads to match the booking to an ad you clicked. Your actual email and number are not sent to these tools.

If the link you followed carried an ad reference (such as gclid or utm_source), the booking page sends it along with your booking.

3.6 Cookies and browser storage

• Measurement and advertising cookies — Google Analytics, Google Ads, Meta and Microsoft Clarity set their own cookies (such as _ga, _gcl_aw, _fbp, _clck) to recognise a returning device and the ad it came from. For visitors from the EU, the EEA, the UK and Switzerland these cookies stay off until you accept them in the cookie banner, which is shown only to visitors from those countries. For visitors from elsewhere, Thailand included, they start on and you can turn them off at any time in Cookie settings, at the foot of every page. When they are off, Google receives only cookieless signals that do not identify you, and neither the Meta Pixel nor Microsoft Clarity runs.
• Your choice — kept in your browser's local storage (fitfac_consent) so we do not ask again
• Session storage (cleared when you close the tab) — the day, time, number of people and branch you picked while booking
• Local storage — remembers that you closed the language suggestion bar

3.7 Technical data

Our host (Vercel) receives the IP address, requested page, time and browser details of every request. The booking system uses the IP address to limit repeated requests and prevent abuse.

3.8 Content from other companies

Some pages load content from other companies, such as Google Maps on the branch pages, PayPal's payment buttons and the flag images in the language menu. Those companies receive your IP address and browser details under their own policies.

4. Why we use it

• To take and manage your booking, send the confirmation, contact you about it, take payment and refund — necessary for our contract with you
• To keep accounting and tax records — a legal obligation
• To answer messages you send us — steps you asked for before a contract
• To measure the website and our advertising — as you choose in the cookie banner (3.6), which you can change or withdraw at any time
• To improve the site and prevent abuse — our legitimate interests

We do not sell personal data.

5. Who receives it

• PayPal — payments and refunds
• Bokun — the booking system our team uses: name, email, phone, where you are staying, session details
• Supabase and our email provider — record bookings and cancellation requests, and send the confirmation from booking@fitfacmuaythai.com
• Vercel — hosts the website and the booking system
• Google (Tag Manager, Analytics, Ads, Maps), Meta and Microsoft (Clarity) — as in 3.5 and 3.8
• WhatsApp / LINE — only when you choose to message us

Some of these providers process data outside Thailand, under each provider's own data-protection safeguards.

6. Children

Online booking is for adult private sessions. Kids' courses are booked through our team by a parent.

7. How long we keep it

• Booking and contact details — as long as needed to provide the session, handle cancellations and refunds, and answer questions about that booking
• Accounting and financial records — 5 years, as Thailand's Accounting Act B.E. 2543 requires
• Measurement and advertising data — under Google's, Meta's and Microsoft's settings; user-level data in Google Analytics is kept for no more than 14 months, and Clarity keeps replays for 30 days and summary data for up to 13 months

8. Your rights

Under Thailand's Personal Data Protection Act B.E. 2562 you can ask us to give you access to and a copy of your data, transfer it, correct it, delete or anonymise it, restrict or object to its use, and withdraw any consent you gave. Write to booking@fitfacmuaythai.com; we reply within 30 days. You can also complain to Thailand's Personal Data Protection Committee (PDPC).

9. Turning measurement and ads off

• Open Cookie settings and turn measurement or advertising off
• Block or delete cookies in your browser settings
• Turn off personalised Google ads in My Ad Center
• Install the Google Analytics Opt-out add-on
• Manage Facebook / Instagram ads in Meta's ad preferences

10. Security

The website is served over HTTPS only. Card details are entered with PayPal and never pass through our servers. The keys to the payment and booking systems stay on the server and are never sent to the browser.

11. FITFAC Ads Tool and Google user data

FITFAC Ads Tool is our own internal software for running FITFAC's Google advertising and the measurement and search presence behind it. Only FITFAC staff use it. Customers and visitors to this website never sign in to it, and it does not collect anything from them.

• What it accesses — after a FITFAC staff member signs in with FITFAC's own Google account on Google's sign-in screen, and only what FITFAC owns: its Google Ads accounts (Google Ads API), the Google Tag Manager container that loads this website's measurement tags (Tag Manager API), the settings and aggregate reports of the Google Analytics properties (Google Analytics Admin API and Google Analytics Data API) and the Search Console properties (Search Console API) of FITFAC's websites — this website and dtvvisathailand.com — the Google Business Profiles of our branches (Business Profile APIs), and the spreadsheets our team keeps in FITFAC's Google account, read-only (Google Sheets API, with the Google Drive API for their names and dates only). It does not access any other Google account, or any other Google service such as Gmail, other Drive files or contacts.
• How it uses the data — to read FITFAC's advertising reports (campaigns, keywords, the searches that showed our ads, costs, clicks and conversions) and to create, change, pause and resume FITFAC's own campaigns, ads, keywords and conversion settings; to read and publish the tags in FITFAC's Tag Manager container; to read and change the settings of FITFAC's Google Analytics property (which events count as key events, how long data is kept, audience triggers, chart annotations and linked accounts); to read aggregate Google Analytics reports of FITFAC's websites (visits, where they came from, which pages lead to a message or a booking, by country and language) — totals only, never an individual visitor's data; to read how FITFAC's websites appear in Google Search (searches, clicks, impressions, index status) and submit their sitemaps; and to read our branches' Business Profile performance and reviews, keep their business information up to date and reply to reviews; and to list FITFAC's spreadsheets and read the figures in them — it never changes, creates or deletes a file, and opens no file that is not a spreadsheet. It is not used for anything else.
• Where it is stored — on FITFAC's own computers, in the reports our team works from, and a log of the changes the tool makes is kept in FITFAC's private code repository. The key that lets the tool sign in stays on FITFAC's computers and is never published.
• Who it is shared with — no one outside FITFAC, with one exception: our staff run the tool with the help of an AI assistant, Claude by Anthropic, which processes what the tool reads only to carry out the task a staff member asked for. We do not sell this data or pass it to anyone else.
• Removing access — the owner of the Google account can remove the tool's access at any time at myaccount.google.com/permissions.

12. Changes

We will post any change on this page with a new effective date.