Privacy Policy
This page explains what spaschoolthailand.com collects, why, who receives it, how long it is kept, and how you can exercise your rights under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA).
1. Data controller and contact details
Michael Thai Massage School (โรงเรียนสอนนวดโดยหมอไมเคิล; “the school” or “we”) is the data controller for personal data collected through this website.
- Bangkok branch (Si La Salle): 152 Srinagarindra Rd., Bang Na Tai, Bang Na, Bangkok 10260, Thailand
- Pattaya branch (Nong Prue): 17/1-2 Moo 13, Sukhumvit Rd., Nong Prue, Bang Lamung, Chonburi 20150, Thailand
- Phone +66 84 398 2888
- Email [email protected]
- LINE @spaschool
2. Data we collect
2.1 What you enter in the website chat box
Your name, contact details (phone number, email, or LINE/WhatsApp ID), your message, the page you sent it from, the page language, the time, and how you reached the website, such as an ad campaign name or the domain of a referring site.
2.2 When you contact us by LINE, phone, email or WhatsApp
The information you give during the conversation, such as your name, phone number and messages. These apps are also covered by their providers’ own privacy policies.
2.3 Enrolled students
The information you give when you enrol, used to process enrolment, run classes and issue certificates.
2.4 Website usage in our own statistics system
Pages opened, buttons clicked, scroll depth, sections viewed, time on page, the referring domain, country (from the network), device type (mobile or computer) and a random visit ID. This system does not record IP addresses.
2.5 Data collected by third-party tools
Google, TikTok and Cloudflare collect usage data through their own tools, as described in section 4.
3. Purposes and legal bases
| Purpose | Legal basis under the PDPA |
|---|---|
| Answering questions, sending course information, calling you back and processing enrolment | Steps taken at your request before entering a contract, and performance of a contract (Section 24(3)) |
| Running classes, issuing and verifying certificates | Performance of a contract (Section 24(3)) and legal obligation (Section 24(6)) |
| Usage statistics, improving the website and filtering spam messages | The school’s legitimate interests (Section 24(5)) |
| Measuring advertising and showing ads again to past visitors | The school’s legitimate interests (Section 24(5)); you can object or opt out as described in sections 4, 5 and 8 |
5. Google Ads remarketing
We use Google Ads to show the school’s ads to people who have visited this website, on websites and apps in Google’s network. Google uses cookies to recognise that you visited our website. You can manage or turn off personalised ads at https://adssettings.google.com
7. How long we keep data
- People who contacted us but did not enrol: no longer than 2 years from the most recent contact
- Students: for as long as needed to issue and verify certificates, or as required by law
- Usage statistics in our own system: for as long as they are used to analyse and improve the website
- Our own cookies: the lifetimes listed in section 4.1
- Data held in third-party tools: according to each provider’s settings and policies
8. Your rights and how to use them
Under the PDPA you have the right to:
- access your data and obtain a copy
- have your data corrected and kept up to date
- have your data deleted, destroyed or made non-identifiable
- restrict the use of your data
- object to the collection, use or disclosure of your data, including for advertising
- receive your data, or have it transferred, in a machine-readable format
- withdraw consent where we rely on consent
- complain to the Personal Data Protection Committee Office (www.pdpc.or.th)
Send your request to [email protected] or through the channels in section 1. We may ask for information to confirm your identity first, and we will respond within 30 days of receiving your request.
9. Use of the Google Ads API
The school uses the Google Ads API only to manage and report on the school’s own advertising account, through a service account. This website has no Sign in with Google and does not access visitors’ Google account data.
10. Changes to this policy
We may update this policy when we change how we collect or use data. The new version will be published on this page with its update date. This version was last updated on 3 November 2026.