Privacy Policy

1. Who we are

CNX Sports Recovery Co., Ltd.
4 Soi Inthanin, Mahidol Rd., Suthep, Chiang Mai 50200, Thailand
Phone / WhatsApp: +66 65 035 3525
Email: cnxsportsrecovery@gmail.com

We operate a performance and sports recovery centre offering sauna, ice baths, salt pool, physiotherapy, sports massage and related services.

2. Personal data we collect

Information you give us through our advertising forms

When you respond to one of our advertisements on Facebook or Instagram and complete a lead form (also called an "instant form") hosted by Meta, we receive the information you choose to submit in that form. Depending on the form, this may include:

• Your full name
• Your phone number and/or WhatsApp number
• Your email address
• Your answers to the questions asked in the form, such as the service you are interested in, your preferred booking time, or your training and recovery goals

You provide this information voluntarily. We use it solely to contact you about your enquiry and the services you asked about.

Information you give us when you contact us directly

• Your name and contact details, and the content of your messages, when you write to us on WhatsApp, LINE, Instagram, Facebook Messenger, by email or by phone
• Booking details such as the service requested, date and time

Information we collect at the centre

• Booking and attendance records, and details of the services you purchased
• Payment information — payments are processed in person or through our payment provider; we do not store your full card details
• Health information you choose to share with our physiotherapists — injuries, medical history, pain and mobility issues, treatment notes — where this is necessary to deliver physiotherapy, massage or recovery services safely. Health data is sensitive personal data. We collect it only with your explicit consent and only to the extent needed to treat you safely

Information collected automatically on this website

Our website is a simple static site. It has no contact form, no account system, no analytics tool and no advertising or tracking pixel installed. We do not place cookies on your device and we do not build advertising profiles from your visit.

Our hosting provider (Netlify) automatically records standard technical server logs — such as IP address, browser type, pages requested and timestamps — for security, abuse prevention and to keep the site running. We also load fonts from Google Fonts, which means your browser makes a request to Google's servers when the page loads.

3. Why we use your data, and our legal basis

• To answer your enquiry and arrange a booking — because you asked us to, and to take steps at your request before entering into a contract
• To provide the services you booked — performance of our contract with you
• To deliver physiotherapy and bodywork safely — your explicit consent to process health information
• To send you information about our services, offers and packages — only where you have agreed to receive it; you can withdraw at any time
• To run and measure our advertising — our legitimate interest in promoting our business, and your consent where the law requires it
• To keep accounting, tax and business records — compliance with our legal obligations under Thai law
• To protect the security of our site, our premises and our clients — our legitimate interest in operating safely

4. Advertising on Meta platforms

We advertise on Facebook and Instagram, which are operated by Meta Platforms, Inc. When you interact with one of our ads — including when you complete a lead form — Meta processes data about that interaction under Meta's own Privacy Policy, independently of us.

The information you submit in a lead form is made available to us through Meta's advertising tools. Once we retrieve it, we handle it as described in this policy: we use it to contact you about the enquiry you made, and for nothing else unless you agree.

If you no longer wish to hear from us after submitting a form, tell us in your reply or email cnxsportsrecovery@gmail.com and we will delete your details from our records.

5. Who we share your data with

We share personal data only where it is necessary, and only with:

• Our team — therapists, physiotherapists and front-desk staff, limited to what they need to serve you. Health information is accessible only to the practitioners treating you
• Service providers acting on our behalf — our website host (Netlify), messaging and email providers (such as WhatsApp, LINE and Google), and our booking and payment tools
• Meta Platforms — in connection with the advertising described in section 4
• Professional advisers and authorities — accountants, insurers, or public authorities where we are required to disclose information by law

6. International transfers

We are based in Thailand. Some of the providers listed above store or process data on servers outside Thailand, including in the United States and the European Union. Where your data is transferred abroad, we take reasonable steps to ensure it remains protected by appropriate safeguards and by the contractual terms of those providers.

7. How long we keep your data

• Enquiries that do not lead to a booking — up to 12 months, then deleted
• Client booking and treatment records — for as long as you remain a client and up to 5 years afterwards, so that a returning client's history is available to their therapist
• Accounting and tax records — as required by Thai law, currently at least 5 years
• Marketing contact details — until you ask us to stop contacting you

When a retention period ends, we delete the data or anonymise it so it can no longer identify you.

8. How we protect your data

We apply reasonable organisational and technical measures to protect personal data against loss, misuse and unauthorised access: access to client records is limited to staff who need it, devices and accounts are password-protected, and our website is served over HTTPS. No method of transmission or storage is completely secure, but we take these obligations seriously and review them as our business grows.

9. Your rights

Under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) — and, if you are in the European Union or the United Kingdom, under the GDPR — you have the right to:

• Access the personal data we hold about you, and receive a copy of it
• Have inaccurate or incomplete data corrected
• Ask us to delete your data, where we have no overriding legal reason to keep it
• Object to, or ask us to restrict, how we use your data
• Withdraw your consent at any time, including consent to marketing messages and to the processing of health information — withdrawal does not affect processing carried out before you withdrew
• Request that your data be transferred to you or to another provider in a usable format
• Lodge a complaint with a supervisory authority — in Thailand, the Personal Data Protection Committee (PDPC)

To exercise any of these rights, email cnxsportsrecovery@gmail.com or message us on WhatsApp at +66 65 035 3525. We will respond within 30 days. We may ask you to confirm your identity before we act on a request.

10. Children

Our services are intended for adults. We do not knowingly collect personal data from anyone under 20 years of age without the consent of a parent or legal guardian. Minors may use our facilities and receive treatment when accompanied and consented to by a parent or guardian. If you believe a child's data has been collected without proper consent, contact us and we will delete it.

11. Third-party links

Our website and our advertising link to external platforms — WhatsApp, Instagram, Facebook, LINE and Google Maps among them. We are not responsible for the privacy practices of those platforms. We encourage you to read their own privacy policies before sharing information with them.

12. Changes to this policy

We may update this policy as our services or our tools change — for example if we add an online booking system, an analytics tool or an advertising pixel to this website. The revised version will always be published on this page with a new "last updated" date. Significant changes affecting how we use your data will be communicated to you directly where we are able to.

13. Contact us

For any question, request or complaint about this policy or about your personal data: