Privacy Policy

Last updated: May 17, 2026

Rick Tew's NinjaGym ("NinjaGym", "we") values your privacy. This policy explains what information we collect through our app and at the centre, why we collect it, who has access, and how to exercise your rights.

We operate in Thailand and align our practices with the Thailand Personal Data Protection Act B.E. 2562 (2019) ("PDPA").

Who we are

Rick Tew's NinjaGym, operated by Rick Tew Co., Ltd., located at Big C Mall, Bophut, Koh Samui, Thailand.
For data inquiries, please reach us through our Contact page (select "Data / Privacy Inquiry").

What we collect

Parent / guardian: name, phone number, email address
Child(ren): first name(s), age, optional notes from you
Payment: PromptPay slip screenshot you upload, or a cash record
Membership PIN: a 4-digit code we generate for fast check-in
Attendance: each check-in (date, time, which kid, who approved)
Birthday bookings: event date, kid count, deposit
Shop orders: items purchased

We do not collect government ID numbers, banking details, health, or biometric data.

How we use it

Approve registrations and process payments
Track session balances and check in your child
Send confirmation emails for bookings and registrations
Issue tax invoices when requested
Improve the service operationally

We do not sell or rent personal data. We do not share data with third parties for marketing.

Who has access

Centre staff at the gym, gated by a per-staff PIN with audit logging
Our database is hosted by a cloud service provider in Singapore under contractual data processing terms
An email delivery service used to send booking and registration confirmations
Payment slip images kept in private storage with restricted access

Data retention

Active member registrations: kept while you remain an active member
Payment slip images: 180 days, then automatically deleted
Tax invoices and cash sale records: 5 years, as required by the Thai Revenue Code
Attendance logs: kept while you are an active member and for a reasonable period after your last visit for service continuity, then deleted on request or in routine cleanup
Encrypted backups: 30 days

Your rights under PDPA

Access: request a copy of the data we hold about you
Correction: ask us to fix inaccurate data
Deletion: ask us to delete your account and associated data
Withdrawal: withdraw consent for photo / video use
Complaint: lodge a complaint with the Thai Personal Data Protection Committee

To exercise any of these rights, send us a message through our Contact page with subject "Data / Privacy Inquiry" and include your registration name and phone number. We respond within 30 days.

Children's data

We collect minimal data about children: first name and age only. Parents register and consent on the child's behalf. We do not market directly to children.

Photos and video

During sessions we may take photos or video for marketing materials (website, social media, brochures). By registering, you consent to this use. You may withdraw consent at any time through our Contact page; we will stop using your child's image going forward.

Cookies and tracking

The app uses essential session cookies only: authentication, staff PIN session, and language preference. No third-party analytics, advertising trackers, or social-media pixels.

Security

Staff access gated by per-staff PIN with full audit log
Slip images stored in private storage
Database with platform-level encryption at rest
180-day slip retention reduces long-term exposure

Changes to this policy

We may update this policy from time to time. The "Last updated" date will reflect any change. Material changes will be emailed to active members.

Contact

Rick Tew's NinjaGym, operated by Rick Tew Co., Ltd.
Big C Mall, Bophut, Koh Samui, Thailand
Send us a message