BASE PRIVACY POLICY BASE PRIVACY POLICY BASE PRIVACY POLICY

BASE PRIVACY POLICY

Concrete Jungle Co., Ltd. (operating under the brand “BASE”)

Last updated: August 10, 2026

This Privacy Policy describes how Concrete Jungle Co., Ltd. collects, uses, discloses, and protects your personal data, and the rights you have as a data subject. We are committed to protecting your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the “PDPA”) and other applicable laws. We use your personal data only where we have a lawful basis to do so, including your consent where consent is required.

1. Introduction

Concrete Jungle Co., Ltd., company registration no. 0105559036845, having its head office at 492-502 Gaysorn Amarin Building, 2nd Floor, Room No. 2F-S11-01/2, Ploen Chit Road, Lumphini Sub-district, Pathum Wan District, Bangkok 10330, Thailand, operates fitness facilities and related services under the brand “BASE” (referred to as “BASE”, “the Company”, “we”, “us”, or “our”).

This Privacy Policy applies to our website at https://basebangkok.com (the “Website”) and to the products, services, memberships, classes, and events we provide (together, the “Service”). By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Definitions

  • Personal Data means any information relating to an identified or identifiable natural person, whether directly or indirectly, but excluding the information of a deceased person.
  • Data Subject / You means the natural person to whom the Personal Data relates and who accesses or uses the Service.
  • Service refers to the Website and the products, services, memberships, classes, and events provided by BASE.
  • Cookies are small files placed on your device that record information about your browsing activity.
  • Service Provider means any natural or juristic person who processes Personal Data on behalf of BASE.
  • PDPA means the Personal Data Protection Act B.E. 2562 (2019) of Thailand.
  • PDPC means the Office of the Personal Data Protection Committee of Thailand.

3. Collection of Personal Data

We collect Personal Data that we receive directly from you, for example when you:

  • register for an account or a membership;
  • provide your telephone number and email address;
  • sign in using Facebook Login or Google Login;
  • book classes, purchase products or services, or make a payment; or
  • contact us through our Website, email, or our LINE Official Account, respond to a survey, or subscribe to our communications; or
  • undergo a fitness assessment, body-composition measurement, or personal training with us.

We also collect certain data automatically when you use the Service, as described in the sections on Usage Data and Cookies below.

4. Types of Data Collected

Personal data such as name, surname, age, date of birth, and nationality; and, where required for identity verification, identification card or passport details.

  • Contact information such as address, telephone number, and email address.
  • Account details such as username, password, and transaction history.
  • Transaction and financial information such as purchase history, payment method, and bank account details. Full payment card numbers are handled by our payment service providers and are not stored by us (see the Payment Processing section).
  • Proof of identity such as a copy of an identification card or passport, where necessary.
  • Usage and technical data such as IP address, browser type and version, the pages you visit, time and date of visit, device identifiers, Cookie ID, and activity logs.
  • Health and fitness data such as body composition, fitness assessment results, training progress metrics collected through our BASELINE technology and training services, and any injuries or health conditions you choose to disclose to us. This is sensitive personal data under the PDPA, which we collect and use only with your explicit consent or another lawful basis permitted by law.
  • Other such as photographs, video, and any other information that is considered Personal Data under applicable law.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Website, remember your preferences, and analyze how the Service is used. You can instruct your browser to refuse cookies or to indicate when a cookie is being sent; however, if you do not accept cookies, some parts of the Service may not function properly.

Where required by law, we use non-essential cookies only with your consent. You may withdraw or change your consent at any time through your browser or device settings, or through our cookie preferences tool where available. We use the following categories of cookies:

  • Necessary / Essential Cookies (session): required to provide the Website and its core features, including authentication and prevention of fraudulent use of accounts.
  • Consent / Notice Acceptance Cookies (persistent): record whether you have accepted the use of cookies and your consent choices, so we can honor them on future visits.
  • Functionality Cookies (persistent): remember choices you make, such as login details or language preference, to provide a more personal experience.
  • Analytics and Advertising Cookies (persistent): used by us and our partners to understand usage and to deliver and measure advertising, as described in the Advertising and Marketing section.

6. Children and Minors

Where we rely on consent as the lawful basis and the Data Subject is a minor who is not sui juris by marriage or does not have capacity as prescribed under the Civil and Commercial Code, we will obtain consent from the holder of parental responsibility over the child where required by the PDPA. Under Thai law, a person reaches the age of majority at 20 years.

If you are under 20 years of age, please do not provide us with your Personal Data without the involvement of your parent or guardian. If we become aware that we have collected Personal Data from a minor without the required consent, we will take steps to delete that information as soon as reasonably possible. If you believe your child has provided us with Personal Data, please contact us.

7. Use of Your Personal Data

We use the collected Personal Data for the following purposes:

  • to create and manage your account and membership;
  • to provide, operate, and maintain our products and services;
  • to process payments for products or services (see the Payment Processing section);
  • to improve our products, services, and user experience;
  • to communicate with you, including customer support and after-sales service;
  • to conduct marketing and advertising activities and promotions where permitted by law;
  • to gather feedback and conduct surveys;
  • to comply with our Terms and Conditions and our contract with you; and
  • to comply with applicable laws, rules, and requests from regulatory or public authorities.

Legal bases. Depending on the purpose, we rely on one or more of the following lawful bases: performance of a contract with you; your consent; our legitimate interests (provided they are not overridden by your rights); compliance with a legal obligation; and other bases permitted under the PDPA. Where we process sensitive personal data, such as your health and fitness data, we do so only on the basis of your explicit consent or another lawful basis permitted under the PDPA.

8. Disclosure of Personal Data

We may disclose your Personal Data to the following parties in certain circumstances:

  • Within our organization to provide and develop our products or services and to make them more relevant to you.
  • Business partners with whom we coordinate to provide our products or services, or to inform you about their availability.
  • Service Providers who process Personal Data on our behalf, for example hosting, IT, analytics, advertising, communications, and customer support providers.
  • Payment service providers to process your payments, as described in the Payment Processing section below.
  • Business transfers in connection with a merger, financing, reorganization, or sale of all or part of our business, in which case we will provide notice before your Personal Data becomes subject to a different privacy policy.
  • Legal and regulatory authorities where disclosure is required by law or in response to valid requests by public authorities, or where we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights or property, prevent wrongdoing, protect the safety of users or the public, or protect against legal liability.

9. Payment Processing

You can pay for our products and services. When you make a payment, we and our payment service providers collect and process the Personal Data necessary to complete and record your transaction. We accept and process payments through the following methods:

  • Bank Transfer. When you pay by bank transfer, we may collect your name, the transferring bank, the transaction reference, the date and amount, and any payment confirmation or slip you provide. We retain these records for accounting, tax, and legal purposes.
  • Omise (Opn Payments). Online card and related payments are processed by our third-party payment gateway, Omise, operated by Opn Payments. Your payment card details are collected and processed directly by Omise on its PCI DSS compliant infrastructure. We do not collect or store your full card number. Omise processes your data in accordance with its own privacy policy: https://www.omise.co/privacy-policy.
  • WooCommerce. Our online store and checkout are powered by WooCommerce, provided by Automattic Inc. WooCommerce processes order and checkout information, such as the products purchased, billing and contact details, and transaction status, to enable and record your purchase. WooCommerce processes your data in accordance with its privacy policy: https://automattic.com/privacy/.
  • Mindbody. Where you book classes, purchase memberships or packages, or make payments through our booking and studio-management system, your data is processed by Mindbody. Mindbody collects and processes booking, membership, and payment information, including any card payments it processes on its own PCI DSS compliant infrastructure, to enable and record your bookings and purchases. Mindbody processes your data in accordance with its privacy policy: https://co.mindbodyonline.com/legal/privacy-policy.

These payment service providers act as independent controllers or as our processors, as applicable. We encourage you to review their privacy policies to understand how they handle your Personal Data.

10. Data Retention

We retain your Personal Data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, including for the duration of your relationship with us and thereafter as required or permitted by law. We may retain Personal Data for longer where necessary to comply with our legal obligations (for example, financial and tax records), resolve disputes, and enforce our agreements and policies. When Personal Data is no longer necessary or the retention period lapses, we will erase, destroy, or anonymize it.

11. Storage and Transfer of Personal Data

We store your Personal Data in both hard copy and electronic form, and we may use third-party server and cloud service providers, including providers located outside Thailand.

Where your Personal Data is transferred to a destination outside Thailand, we will take steps to ensure that appropriate safeguards are in place and that the transfer complies with the PDPA, so that your data continues to be protected in accordance with this Privacy Policy.

12. Your Rights as a Data Subject

Subject to the PDPA and its conditions and exceptions, you may exercise the following rights:

  • Withdrawal of consent: you may withdraw your consent at any time, unless restricted by law or by a contract that benefits you.
  • Access: you may request access to and a copy of your Personal Data, and ask how we obtained it.
  • Data portability: you may request that your Personal Data be provided in a machine-readable format and, where technically feasible, transmitted to another data controller.
  • Objection: you may object to the collection, use, or disclosure of your Personal Data in certain circumstances, including for direct marketing.
  • Erasure or destruction: you may request that your Personal Data be deleted, destroyed, or anonymized where permitted by law.
  • Restriction / suspension: you may request that we suspend the use of your Personal Data in certain circumstances.
  • Rectification: you may request that your Personal Data be corrected to be accurate, current, complete, and not misleading.
  • Complaint: you may lodge a complaint with the PDPC if you believe that our processing of your Personal Data violates the PDPA.

To exercise your rights, please contact our Data Protection contact using the details in the Contact Us section. We will respond within the period required by law (generally within 30 days of receiving your request). If we decline your request, we will inform you of the reason.

13. Advertising and Marketing

We may send you news, updates, offers, and other marketing communications by email or other channels. Where consent is required by law, we will send such communications only with your consent; otherwise, we may send them until you opt out. You can opt out at any time by using the unsubscribe link in our emails or by contacting us.

We use the following third-party providers for analytics, advertising, and communications, each of which may process your data in accordance with its own privacy policy:

  • Analytics: Google Analytics, delivered through Google Tag Manager and Google Site Kit.
  • Advertising and remarketing: Google Ads and Meta (Facebook and Instagram).
  • Email communications: Mailchimp and Constant Contact.
  • Messaging: our LINE Official Account, which we use to communicate with members and send updates and offers where permitted by law.

Interest-based (remarketing) advertising. We and third-party vendors, including Google and Meta, use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the Google advertising cookie and the Meta Pixel) together to inform, optimize, and serve advertisements based on your past visits to the Website. Third-party vendors, including Google, may show our ads on websites and apps across the Internet, and may use collected data to personalize the advertising you see.

Google. Google uses cookies to serve ads based on your prior visits to the Website. You can opt out of personalized Google advertising through Google Ads Settings at https://adssettings.google.com, and you can opt out of third-party vendor cookies for personalized advertising at https://www.aboutads.info/choices.

Meta (Facebook and Instagram). We use the Meta Pixel, which allows Meta to collect information about your interactions with the Website (such as pages viewed and actions taken) in order to measure, optimize, and target advertising on Facebook and Instagram. You can manage how your data is used for ads in your Facebook and Instagram ad preferences settings. For more information, see Meta’s Privacy Policy at https://www.facebook.com/privacy/policy.

14. Security of Your Personal Data

We implement appropriate administrative, technical, and physical safeguards to protect your Personal Data against loss and unauthorized or unlawful access, alteration, disclosure, or destruction, consistent with the principles of confidentiality, integrity, and availability. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

15. Data Breach Notification

In the event of a personal data breach, we will notify the PDPC without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you and describe the remedial measures without undue delay.

16. Links to Other Websites

The Service may contain links to websites that are not operated by us. If you click a third-party link, you will be directed to that third party’s site. We have no control over, and are not responsible for, the content or privacy practices of any third-party site. We strongly advise you to review the privacy policy of every site you visit.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Privacy Policy on this page and update the “Last updated” date above. Where appropriate, we will notify you by email or through a prominent notice on the Service before the change takes effect. We encourage you to review this Privacy Policy periodically.

18. Contact Us

If you have any questions about this Privacy Policy or would like to exercise your rights, you can contact us using the following details:

Data Controller

Concrete Jungle Co., Ltd.

492-502 Gaysorn Amarin Building, 2nd Floor, Room No. 2F-S11-01/2, Ploen Chit Road, Lumphini Sub-district, Pathum Wan District, Bangkok 10330, Thailand

Email: team@basebangkok.com

Data Protection Contact

BASE Team

492-502 Gaysorn Amarin Building, 2nd Floor, Room No. 2F-S11-01/2, Ploen Chit Road, Lumphini Sub-district, Pathum Wan District, Bangkok 10330, Thailand

Email: team@basebangkok.com