Privacy Policy

Who we are. Phuket King Muay Thai, Pangea Resort and Pangea Cafe ("we", "us") are run together in Kathu, Phuket, Thailand. This policy covers our website (phuketking.com), the Phuket King app (app.phuketking.com), our online shop and courses, bookings, and the messages you send us on our website chat, WhatsApp, Facebook Messenger, Instagram and email. We follow Thailand's Personal Data Protection Act B.E. 2562 (PDPA). If you are in the EU or UK, the rights in the GDPR also apply to you.

Questions or requests: [email protected], or WhatsApp +66 96 907 6150.

What we collect

• Contact details: your name, email, phone or WhatsApp number and country, when you book, buy, sign up, enquire or message us.
• Bookings and purchases: training packages, private lessons, room stays, cafe and shop orders, online courses, what you paid and what is still to pay.
• Training records: class check-ins, attendance and your training level.
• Coaching information you choose to share: goals, weight, height, fitness, food diary photos, workout logs, form check videos and any injuries or health notes. Injury and health notes are sensitive data. We only collect them with your consent, only your coaches and our managers can see them, and you can ask us to delete them at any time.
• Messages: what you send us through our website chat, Facebook Messenger, Instagram, WhatsApp or email, and our replies. For Messenger and Instagram we receive your name and profile picture from Meta so we know who we are talking to.
• Payments: card payments are handled by Stripe. We never see or store your full card number. For PromptPay or bank transfer we keep the amount and date.
• App and website use: basic technical information such as your device and browser, needed to keep you signed in and to keep the service secure. Our website does not use advertising cookies or tracking pixels.

Why we use it

• To provide what you booked or bought: training, privates, rooms, food, courses and coaching (performing our contract with you).
• To reply to your messages and enquiries.
• To send booking confirmations, welcome emails before your stay, and reminders about your package.
• To keep you safe in training, for example knowing about an injury before you arrive (with your consent).
• To keep accounts, receipts and tax records (a legal obligation).
• To send newsletters and offers, only if you agreed. Every email has an unsubscribe link, and you can tell us to stop at any time.
• Sometimes we may ask you, for example on WhatsApp, if you would like to leave us a review. You never have to.

We do not sell your personal data, and we do not share it with other gyms or businesses for their marketing.

Who we share it with

Only with the services we use to run the gym and resort, and only what they need:

• Supabase: secure hosting for our app and database (servers in Singapore).
• Stripe: card payments.
• Resend: sending our emails.
• Meta (Facebook, Instagram, WhatsApp): when you message us there, and when we reply.
• Google: our Google reviews and the fonts on our website.
• Booking platforms such as Booking.com and Agoda, if you booked a room through them. Our room calendars are shared with them without guest names.
• Anthropic: we use AI tools to help our staff write social media posts, web pages and read receipts. We do not send your coaching, health or payment information to these tools.
• Thai government authorities, when the law requires it (for example immigration reporting for overnight guests, or tax).

Some of these services store data outside Thailand. When that happens we use providers with proper safeguards in place for international transfers.

How long we keep it

• Bookings, payments and receipts: as long as Thai accounting and tax law requires, usually up to 5 years, then deleted.
• Your customer record, training and coaching information: while you train with us, and up to 3 years after your last visit, unless you ask us to delete it sooner.
• Website chat and social media messages: up to 2 years.
• Newsletter list: until you unsubscribe.

How we protect it

Your data is stored in a secure database with encrypted connections. Staff only see what their role needs: for example, coaches see their own clients' coaching information, and housekeeping cannot see payments. Our investors only ever see totals, never personal details. Everything is backed up every night.

Your rights

You can ask us to:

• see the personal data we hold about you, and get a copy;
• correct anything that is wrong;
• delete your data;
• stop using your data for something, or withdraw your consent (for example for newsletters or health notes);
• move your data to another service.

Email [email protected] and we will reply within 30 days. If you are not happy with our answer, you can complain to Thailand's Personal Data Protection Committee (PDPC), or the data protection authority where you live.

How to delete your data

To delete your data, including anything we received from Facebook or Instagram:

1. Email [email protected] with the subject "Delete my data", or message us on WhatsApp.
2. Tell us your name and the email, phone number or Facebook or Instagram name you used with us.
3. We confirm who you are, delete your data within 30 days, and let you know when it is done.

We may keep records we must legally keep, such as receipts for tax, until that period ends. You can also remove our access to your Facebook data at any time in your Facebook settings, under Apps and websites.

Children

We train children in our kids classes, but children cannot book, buy or sign up for the app themselves. A parent or guardian books for them and gives us their details.

Changes

If we change this policy we will update this page and the date at the top. If the change is important, we will also tell you by email or in the app.