Privacy Policy

Template — review before publishing. This policy is a starting draft tailored to the Hillside app's current features. It is not legal advice. Before you publish, have it reviewed by a qualified lawyer and adapted to the laws that apply to you — in particular Thailand's Personal Data Protection Act (PDPA), and the GDPR if you serve members in the EU/EEA/UK. Replace every [ bracketed ] placeholder.

Who we are

This Privacy Policy explains how [ Hillside Country Club Co., Ltd. ] ("Hillside", "we", "us") collects, uses, shares and protects personal data when you use the Hillside members' application and related services (the "App"). The data controller is [ legal entity name ], [ registered address ]. You can reach us at privacy@hillsidemember.com.

The App is available to members of Hillside Country Club. By using it, you agree to this policy together with our Terms of Service.

Information we collect

Information you give us

Account and identity: your name, email address, and — where you provide them — phone number and preferred language.
Membership details: your membership number, status or tier, and related records held by the club.
Communications: messages you send us for support or enquiries.

Information from sign-in providers

When you sign in with Google or Apple, we receive a verified identifier and basic profile details (such as your name and email) from that provider, as permitted by the settings you choose with them. We do not receive your password.

Information created as you use the App

Bookings: your reservations for golf, the spa and other facilities, including dates, times and check-in records.
Privileges: loyalty points earned and redeemed, coupons collected, and your transaction history within the App.
Pro shop and purchases: items purchased and point-of-sale records associated with your account.

Payment information

Payments are processed by our payment provider, [ OPN / Omise ]. We do not collect or store your full card number; the provider handles card details under its own terms and security standards. We retain only limited records of a transaction (such as amount, date and a payment reference).

Device and technical information

Push notification token: a device token used to deliver notifications you have enabled, via Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android).
Device and app details: device type, operating system, app version, and similar technical data.
Log data: records generated when the App communicates with our servers, used for security and troubleshooting.

The App does not collect your precise (GPS) location. Check-in uses a member QR code scanned at the club, not your device's location.

How we use your information

To provide the App and your membership services — reservations, check-in, privileges and purchases.
To process payments and keep records of transactions.
To send notifications and communications you have enabled, and important service messages.
To provide support and respond to your enquiries.
To maintain the security, integrity and reliability of the App and prevent misuse.
To comply with legal obligations and enforce our Terms.
To understand and improve how the App is used, in a manner that respects your privacy.

Legal bases for processing

Where the PDPA, GDPR or similar laws apply, we rely on one or more of the following: performance of a contract with you (providing the App and your membership benefits); your consent (for example, optional notifications), which you may withdraw at any time; our legitimate interests (such as security and service improvement), balanced against your rights; and compliance with legal obligations.

We do not sell your personal data. We share it only as needed to run the App, and with providers who process data on our behalf under appropriate agreements:

Hosting & database: [ Supabase ] and [ Fly.io ], for application hosting and data storage.
Content delivery & DNS: [ Cloudflare ].
Notifications: [ Google Firebase Cloud Messaging ] (Android) and [ Apple Push Notification service ] (iOS).
Sign-in: [ Google ] and [ Apple ], when you choose those sign-in methods.
Payments: [ OPN / Omise ].
Email delivery: [ Resend ], for transactional email.

We may also disclose data where required by law or legal process, to protect our rights and the safety of others, or in connection with a corporate transaction such as a merger or transfer of assets.

International data transfers

Our servers and some providers are located outside Thailand (for example, in the Singapore region and elsewhere). Where personal data is transferred across borders, we take steps to ensure it is protected in line with applicable law, including appropriate safeguards where required.

Data retention and account deletion

We keep personal data for as long as needed to provide your membership services and for legitimate business and legal purposes, after which it is deleted or anonymised.

You can delete your account from within the App. When you do, your personal data is anonymised so that records can no longer be linked to you, and your sign-in is disabled. Certain records may be retained in anonymised or aggregated form, or where we are required to keep them by law (for example, financial records).

Your rights

Subject to applicable law, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@hillsidemember.com. You also have the right to lodge a complaint with your data protection authority — in Thailand, the Personal Data Protection Committee (PDPC).

How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls, and row-level security on our database. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.

Children

The App is intended for club members and is not directed to children under [ 18 / applicable age ]. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us so we can remove it.

Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the "last updated" date above. Where changes are significant, we will provide additional notice as required by law.

Contact us

For any question about this policy or your personal data, contact [ Hillside Country Club Co., Ltd. ] at privacy@hillsidemember.com, or by post at [ registered address ].