Privacy Policy

1. Who we are

This website and its online booking are run by FITFAC Co., Ltd. (บริษัท ฟิตแฟค จำกัด — "FITFAC", "we"), the data controller for the personal data described here.

2. What this policy covers

The pages of this website and the online booking of private sessions (the booking, checkout and cancellation pages).

3. What we collect

3.1 When you book a session online

• Your name — split into a first name and surname for our booking system
• Your email address — for the booking confirmation
• Your phone / WhatsApp number, with its country code
• Where you are staying (optional) — so we can suggest the nearest gym

With it we record what you chose: the day and time, the number of people, the branch, the language of the page you booked in, the amount and currency, the PayPal order number and the booking reference.

3.2 When you pay

You pay in PayPal's own payment fields. Your card number and PayPal login go to PayPal, not to us; we never receive or store them. From PayPal we receive the order number, the amount, the currency and whether the payment went through.

3.3 When you ask to cancel

You give us your booking reference and the email you booked with. We look the booking up and pass its details and your request to our team.

3.4 When you message us on WhatsApp or LINE

Some buttons open WhatsApp or LINE with a message already written for you, which can include details you entered on the page. Nothing is sent until you press send yourself. From then on the conversation is under WhatsApp's or LINE's own terms.

3.5 Website and advertising measurement

We use Google Tag Manager to load these tools:

• Google Analytics — counts page views and actions such as tapping LINE / WhatsApp / call, starting a booking and completing a payment, with device, browser and approximate location
• Google Ads — measures which ads led to a message, a booking or a payment
• Meta Pixel (Facebook / Instagram) — measures Meta ads the same way

When a payment goes through, the page turns your email address and phone number into SHA-256 codes (which cannot be turned back into the email or number) and may send those codes to Google Ads to match the booking to an ad you clicked. Your actual email and number are not sent to these tools.

If the link you followed carried an ad reference (such as gclid or utm_source), the booking page sends it along with your booking.

3.6 Cookies and browser storage

• Measurement and advertising cookies — Google Analytics, Google Ads and Meta set their own cookies (such as _ga, _gcl_aw, _fbp) to recognise a returning device and the ad it came from. For visitors from the EU, the EEA, the UK and Switzerland these cookies stay off until you accept them in the cookie banner, which is shown only to visitors from those countries. For visitors from elsewhere, Thailand included, they start on and you can turn them off at any time in Cookie settings, at the foot of every page. When they are off, Google receives only cookieless signals that do not identify you, and the Meta Pixel does not run.
• Your choice — kept in your browser's local storage (fitfac_consent) so we do not ask again
• Session storage (cleared when you close the tab) — the day, time, number of people and branch you picked while booking
• Local storage — remembers that you closed the language suggestion bar

3.7 Technical data

Our host (Vercel) receives the IP address, requested page, time and browser details of every request. The booking system uses the IP address to limit repeated requests and prevent abuse.

3.8 Content from other companies

Some pages load content from other companies, such as Google Maps on the branch pages, PayPal's payment buttons and the flag images in the language menu. Those companies receive your IP address and browser details under their own policies.

4. Why we use it

• To take and manage your booking, send the confirmation, contact you about it, take payment and refund — necessary for our contract with you
• To keep accounting and tax records — a legal obligation
• To answer messages you send us — steps you asked for before a contract
• To measure the website and our advertising — as you choose in the cookie banner (3.6), which you can change or withdraw at any time
• To improve the site and prevent abuse — our legitimate interests

We do not sell personal data.

5. Who receives it

• PayPal — payments and refunds
• Bokun — the booking system our team uses: name, email, phone, where you are staying, session details
• Supabase and our email provider — record bookings and cancellation requests, and send the confirmation from booking@fitfacmuaythai.com
• Vercel — hosts the website and the booking system
• Google (Tag Manager, Analytics, Ads, Maps) and Meta — as in 3.5 and 3.8
• WhatsApp / LINE — only when you choose to message us

Some of these providers process data outside Thailand, under each provider's own data-protection safeguards.

6. Children

Online booking is for adult private sessions. Kids' courses are booked through our team by a parent.

7. How long we keep it

• Booking and contact details — as long as needed to provide the session, handle cancellations and refunds, and answer questions about that booking
• Accounting and financial records — 5 years, as Thailand's Accounting Act B.E. 2543 requires
• Measurement and advertising data — under Google's and Meta's settings; user-level data in Google Analytics is kept for no more than 14 months

8. Your rights

Under Thailand's Personal Data Protection Act B.E. 2562 you can ask us to give you access to and a copy of your data, transfer it, correct it, delete or anonymise it, restrict or object to its use, and withdraw any consent you gave. Write to booking@fitfacmuaythai.com; we reply within 30 days. You can also complain to Thailand's Personal Data Protection Committee (PDPC).

9. Turning measurement and ads off

• Open Cookie settings and turn measurement or advertising off
• Block or delete cookies in your browser settings
• Turn off personalised Google ads in My Ad Center
• Install the Google Analytics Opt-out add-on
• Manage Facebook / Instagram ads in Meta's ad preferences

10. Security

The website is served over HTTPS only. Card details are entered with PayPal and never pass through our servers. The keys to the payment and booking systems stay on the server and are never sent to the browser.

11. Changes

We will post any change on this page with a new effective date.