Privacy policy
Version 1.0Effective 12 October 2026Last updated 12 October 2026
This English version is provided for convenience. If it differs from the Thai version, the Thai version prevails.
We take care of the data of gym owners, staff, gym members and website visitors. This policy explains what we collect, what we use it for and the rights you have under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA).
Gyms own their member data
Gymgator processes member data only on the gym’s instructions
We never store card numbers
No card details are entered in the system; membership fees go straight to the gym’s account
Analytics cookies only with consent
Turn them on or off any time from “Cookie settings”
1. About this policy
This policy explains how Gymgator (“we” or “us”) collects, uses and discloses personal data when you use the Gymgator website, member app and back office.
- For gym owners, staff and website visitors, Gymgator is the “data controller”.
- For each gym’s member data, the gym is the data controller and Gymgator is a “data processor” acting on the gym’s instructions.
If you are a gym member
For requests about your member data — such as a copy, a correction or deletion — please contact your gym directly. We will help the gym act on your request.
2. Data we collect
Website visitors
- Device and usage data, such as IP address, browser type and pages visited
- Data from cookies and your cookie settings (see section 9)
- Details you give us when you request a trial or contact us, such as your name, email, phone number and gym name
Gym owners and staff
- Account data, such as name, email, phone number, role and the branches you manage
- Business and billing data, such as gym name, branch addresses, the Gymgator plan in use and payment history
- System activity records (audit log), such as sign-in times and changes made
Gym members (processed for the gym)
- Profile data, such as name, profile photo, date of birth, phone number and email
- Sign-in data: email and password. Passwords are stored with one-way encryption — we cannot read your password
- Package, class booking, trainer appointment and QR check-in history
- Emergency contacts and health notes you choose to enter in the app. Health data is sensitive data and is kept only with your explicit consent
- Transfer slips, invoices, receipts and payment history with the gym
- Notification settings and the device ID used to send you notifications
Payment card data
No card numbers are ever entered or stored in Gymgator. Members pay the gym by bank transfer or PromptPay and attach the slip, or pay at the gym’s counter. If they pay by card on the gym’s card terminal, the system only records that the payment was made by card.
3. Purposes and legal bases
We use personal data only as far as needed for the purposes below, on the legal bases set out in the PDPA.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and maintain gym accounts and provide the service | Account data, usage data | Performance of a contract |
| Record service payments and prepare accounting documents | Business and billing data | Contract · Legal obligation |
| Run the member app for the gym (booking, check-in, payments) | Member data | On the gym’s instructions (the gym sets the legal basis) |
| Help the gym keep members safe while they use its services | Health data, emergency contacts | Explicit consent (requested by the gym · can be withdrawn any time) |
| Send service notifications, such as booking confirmations, invoices and password setup | Contact details, device ID | Performance of a contract |
| Keep the service secure and prevent fraud | Usage data, IP, audit log | Legitimate interests |
| Answer questions and provide support | Contact details | Contract · Legitimate interests |
| Analyze website usage | Analytics cookies | Consent |
4. Disclosure of data
We do not sell personal data, and we disclose it only to the following, and only as far as needed:
- Service providers we engage, such as cloud and database providers and our email delivery provider, who are bound by contract to protect the data
- The gyms you are a member of, for that gym’s member data. Your name and profile photo are shared with every gym you join
- Members and staff of the same gym, who see your nickname or first name and profile photo on the attendee list of classes you book — never your last name, phone number, email or member ID
- Government authorities or courts, when the law requires it
- A successor business in a merger or transfer of business, which must protect the data in line with this policy
5. Transfers outside Thailand
Some service providers may store or process data outside Thailand, such as our email delivery provider (Resend, United States) and the cloud provider that hosts our database. We transfer data only to countries with adequate data protection standards, or put appropriate safeguards in place as required by the PDPA.
6. How long we keep data
| Type of data | Retention period |
|---|---|
| Gym owner and staff accounts | For as long as the gym uses the service, then deleted or anonymized when the account is closed, unless the law requires us to keep it |
| Invoices, receipts and slips | At least 5 years, as accounting and tax records |
| Audit log | Depending on the gym’s plan: Starter 30 days · Pro 90 days · Max 1 year |
| Gym member data | As set by the gym, for as long as the gym uses the service, then deleted or returned as agreed with the gym when it cancels |
| Member accounts deleted on request | Anonymized as soon as the deletion is confirmed in the app |
| Details you give us when you contact us | Only as long as needed to answer your question and follow up |
When these periods end, we delete, destroy or anonymize the data. System backups are deleted on the regular backup rotation.
7. Data security
We use appropriate technical and organizational measures to prevent unauthorized access to, use, change or disclosure of data, including:
- Encrypting data in transit over HTTPS and storing passwords with one-way encryption
- Keeping each gym’s data separate and limiting access by each staff member’s role
- Storing slips and receipts privately, accessible only to the member they belong to and authorized gym staff
- Keeping system activity records (audit log) and regular backups
If a personal data breach happens, we will notify the Office of the Personal Data Protection Committee and the people affected, as the law requires.
8. Your rights
Under the PDPA you have the following rights. Make a request through the channels in section 12 and we will reply within 30 days of receiving it.
Access and copy
See and get a copy of your data
Correction
Keep your data accurate, up to date and complete
Deletion or destruction
When there is no longer a reason to keep it
Restriction
Put use on hold while something is checked
Objection
To processing based on legitimate interests
Data portability
Get your data in a machine-readable format
Withdraw consent
Any time, without affecting earlier use
Complaint
To the Office of the Personal Data Protection Committee (PDPC)
Gym members can delete their account themselves in the app. See the steps on Delete your account.
10. Minors
Our service is designed for gym owners and staff who are of legal age. If a gym member is a minor, the gym is responsible for getting consent from a parent or guardian where the law requires it. If we learn that we hold a minor’s data without the required consent, we will delete it promptly.
11. Changes to this policy
We may update this policy from time to time. The latest version is always on this page with its version number and date. If we make a significant change, we will tell you by email or in the back office before it takes effect.
12. Contact us / data protection officer
- Data controller
- Gymgator
- Phone
- 081-113-9520
If you believe we have not complied with the PDPA, you have the right to complain to the Office of the Personal Data Protection Committee (PDPC).