In short
- You can read grixfit.com without giving us any personal data. There are no accounts.
- If you join our waitlist, we keep your email only to tell you about GrixFit. You can unsubscribe at any time.
- Our server and security tools record technical data such as IP addresses to keep the Site safe.
- We don't sell your data, show ads or use tracking cookies.
- You can make a privacy request by email, by post or in person. We reply within 30 days.
This Privacy Policy explains how Grixhub collects, uses, shares and protects personal data when you visit grixfit.com (the "Site"), join our waitlist, or contact us. It is our privacy notice under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). We have also written it to meet the standards of the EU General Data Protection Regulation ("GDPR") for visitors in the European Economic Area and the UK.
The GrixFit app is a separate product. It will have its own privacy notice, which will explain how it handles health and fitness data from Apple Health, Health Connect or Huawei Health. This policy does not cover the app, and the Site does not collect any health data.
1. Who we are
Grixhub, based in Bangkok, Thailand, runs the Site and is the data controller for the personal data described here ("Grixhub", "we", "us").
Contact for all privacy matters: jade@grixhub.com. We have not appointed a data protection officer, because the PDPA does not currently require us to. If that changes, we will add their details here.
2. Personal data we collect
| Where it comes from | What we collect |
|---|---|
| Waitlist form (if offered; aged 20+ only) | Your email address, your first name if you choose to give it, your consent choice, and the date, time and page where you signed up. Our form tool may also record your IP address and browser type with the submission, to prevent spam and to prove consent |
| Emails and messages you send us | Your name, email and anything you choose to write |
| Visiting the Site | Technical data: IP address, browser and device type, page requested, referring page, and date and time. This is recorded in server logs and by our security tool, which also records failed sign-in attempts, repeated "page not found" requests and other suspicious activity, so it can block attacks |
No health data. The Site does not ask for, and does not collect, health, fitness-tracking or body data. Please do not send us health information about yourself through our forms or by email. If you do, we use it only to reply to you, and then delete it.
No analytics or ads. We do not currently use analytics, advertising or tracking tools on the Site.
3. Why we use it and our legal basis
| Purpose | Legal basis (PDPA / GDPR) |
|---|---|
| Send you GrixFit waitlist updates and launch news | Your consent (PDPA Section 19 / GDPR Art. 6(1)(a)). You can withdraw it at any time |
| Reply to your messages | Our legitimate interests in answering enquiries, or steps you ask for (PDPA Sections 24(5), 24(3) / GDPR Art. 6(1)(f), 6(1)(b)) |
| Keep the Site secure, stop spam and attacks, and fix problems | Legitimate interests (PDPA Section 24(5) / GDPR Art. 6(1)(f)); legal obligation to keep computer traffic data (PDPA Section 24(6) / GDPR Art. 6(1)(c)) |
| Keep a record of consent, comply with the law, and establish or defend legal claims | Legal obligation and legitimate interests (PDPA Sections 24(6), 24(5) / GDPR Art. 6(1)(c), 6(1)(f)) |
We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.
4. Who we share data with
We do not sell or rent personal data. We share it only with:
- Hosting: Hostinger, which hosts the Site, its database and our form submissions;
- Waitlist form: our waitlist runs on Fluent Forms, a WordPress plugin. Entries are stored in the Site's own WordPress database on our hosting with Hostinger, and are not sent to Fluent Forms' developer or to any other company. We do not currently use a third-party email service for the waitlist. If we add one, we will update this policy before we do;
- Business email: Google, which provides our business email, if you write to us;
- Professional advisers and authorities: our accountants, lawyers and insurers, and government bodies, courts or regulators when the law requires it; and
- A new owner of our business: if Grixhub's business is transferred, including to a company set up to run Grixhub, the new owner will continue to protect the data under this policy.
Our security, search-engine and speed tools (Solid Security, Yoast SEO and FlyingPress) run on our own server, so they do not send your personal data to those companies.
5. Sending data outside Thailand
Some of our providers may store or process data outside Thailand, for example in Singapore, the European Union or the United States. When we transfer personal data abroad, we do so only in the ways that PDPA Sections 28 and 29 and the PDPC's rules allow, and, for EU/UK visitors, GDPR Chapter V. For example, we rely on adequacy findings, standard contractual clauses or other appropriate safeguards. You can ask us for details.
6. How long we keep data
| Data | How long we keep it |
|---|---|
| Waitlist email | Until you unsubscribe, or until 12 months after we stop the waitlist without launching. After you unsubscribe, we keep just your email on a do-not-contact list, so we don't email you again |
| Consent records | As long as we use your email, plus up to 3 years to prove consent |
| Messages you send us | Up to 2 years after our last contact |
| Server and security logs | At least 90 days where the Computer-related Crime Act requires it, and normally no more than 12 months |
| Backups | Overwritten on a rolling cycle |
After that, we delete or anonymise the data, unless we must keep it by law or for a legal claim.
7. How we protect data
We use reasonable technical and organisational measures, including encrypted connections (HTTPS), a security tool that blocks attacks, limited access to people who need it, and providers that have their own security controls. If a personal data breach happens, we will notify the Personal Data Protection Committee within 72 hours after becoming aware of it, unless the breach is unlikely to put anyone's rights at risk. If the risk to you is high, we will tell you without undue delay.
8. Cookies
We use only the cookies the Site needs to work, and we do not use analytics, advertising or tracking cookies. Our Cookie Policy has the details. If we ever add optional cookies, we will ask for your consent first.
9. Your rights
Under the PDPA and, where it applies, the GDPR, you have the right to:
- withdraw consent at any time, without affecting what we did before;
- access your personal data and get a copy, and ask how we obtained data you did not give us;
- receive your data in a common electronic format, or have it sent to another controller (data portability);
- object to our use of your data based on legitimate interests, and to direct marketing at any time;
- ask us to delete, destroy or anonymise your data;
- ask us to restrict the use of your data;
- ask us to correct data that is wrong, out of date or incomplete; and
- complain to the Office of the Personal Data Protection Committee (pdpc.or.th), or, if you are in the EU/EEA or UK, to your local data protection authority.
How to make a request. To use your rights, email jade@grixhub.com, or make your request in writing by post or in person; email us and we will send you the postal details or arrange a time. We check your request and confirm your identity within 15 days, and we reply within 30 days of receiving it.
You don't need to use a particular form. We may ask you to confirm your identity, but only as much as we need to.
What happens next. Within 15 days of receiving your request, we will check it and tell you if we need anything more from you. We will give you our decision, and act on it, within 30 days of receiving your request. Some rights have legal limits, for example where we must keep data by law or need it for a legal claim. If we cannot fully meet your request, we will explain why in writing. Making a request is free.
You can unsubscribe from our emails at any time with the link in each email.
10. Children
The Site and the waitlist are for people aged 20 or over only. We do not knowingly collect personal data from anyone under 20. If we learn that someone under 20 has given us personal data, we will delete it. If you believe this has happened, please contact us.
11. Links to other services
The Site may link to other websites and services. Their own privacy policies apply, and we are not responsible for them.
12. Changes to this policy
We may update this policy. We will post the new version here with a new "Last updated" date. If a change is significant, we will show a notice on the Site or email the waitlist.
13. Contact us
Grixhub, Bangkok, Thailand — jade@grixhub.com