Privacy policy

This policy explains what personal data The Sunny Day Co., Ltd. (“Heyday”, “we”, “us”) collects when you visit th.heydayhealthclub.com or buy from us, why we collect it, who we share it with and how long we keep it. We are the data controller under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

What we collect

  • Your orders: your name, email address, phone number and delivery address, what you order and, if you ask for a full tax invoice, the billing name, address and tax ID you give us.
  • Payments: cards, Apple Pay, Google Pay and PromptPay are paid on Stripe’s secure pages. We never see or keep your card number; we keep the payment reference, the method and the amount.
  • Subscribe & save: your plan, its delivery address and its renewal dates. Stripe keeps the card used for renewals.
  • Messages and sign-ups: what you send us through the contact form, and, if you join our newsletter, your email address and when you agreed.
  • Refer a friend: every customer has a personal referral code. If you order with a friend’s code, we note that it was used on your order, so we can send your friend their reward once your order ships. Your friend is never told your name or any of your details – only how many friends have ordered with their code.
  • Our earlier web shops: if you were a customer of our earlier Heyday web shops (UK, Singapore, UAE or the old Thai shop), the name, contact details and address you gave there are kept in the same customer records as this shop. Anyone whose last visit was more than 3 years ago is anonymised, and nobody was signed up for marketing.
  • Visits: anonymous page-view and page-speed statistics (Vercel Web Analytics and Speed Insights). They use no cookies and don’t identify you. If you arrive through a link with a referral code or campaign tag, your browser remembers it for 90 days and sends it with your order, so we know which partner or campaign sent you.
  • Analytics cookies, only if you accept them: Google Analytics counts visits, which pages are seen and what is added to carts and bought, using cookies and a random identifier for your browser. It gets no name, email address, phone number or address, and the parts of page addresses that could identify an order or a search are removed before anything is sent. Until you accept in our cookie banner, Google Analytics isn’t loaded at all.

Why we use it

  • To take, pack, deliver and help with your order, and to run your subscription – this is needed to carry out our contract with you.
  • To issue receipts and tax invoices and keep our accounts – we have to by law.
  • To stop fraud and misuse and keep the shop secure – our legitimate interest.
  • To send our newsletter – only with your consent, which you can withdraw at any time with the unsubscribe link in every newsletter or by emailing us.
  • To see how the shop is used, so we can improve it, with Google Analytics – only with your consent, which you can withdraw at any time with “Cookie settings” at the bottom of every page.

We don’t sell your personal data and we don’t build advertising profiles.

Who we share it with

Only with the companies that run parts of the shop for us, each of which may use it only for that job:

  • Vercel – hosts the website and its anonymous visit statistics.
  • Neon – hosts the database that holds orders and customer details.
  • Stripe – takes payments and runs Subscribe & save billing.
  • Opn Payments (Omise) – takes Thai mobile banking and instalment payments, once we offer them.
  • Packhai – our fulfilment warehouse, which receives your name, phone number, address and order to pack your parcel, and passes what is needed to the delivery company.
  • Delivery companies (such as Flash Express or Kerry Express) – receive what they need to deliver your parcel.
  • Resend – sends our order emails.
  • Mailchimp (Intuit) – keeps our newsletter list and sends the newsletter.
  • Google – runs Google Analytics, only if you accept analytics cookies.
  • Our accountant and the Revenue Department, for tax records.

Some of these companies keep data outside Thailand (in Singapore, the United States or the European Union, for example). Where they do, we rely on the safeguards in our contracts with them, as the PDPA requires.

How long we keep it

  • Orders, receipts and tax invoices: for as long as Thai tax and accounting law requires – at least five years.
  • The payment, warehouse and email notifications we receive about an order: the full messages are deleted after 90 days; the order keeps only what it needs.
  • Messages you send us: in our email inbox for as long as we need them to help you.
  • Your customer record (name, contact details and order history): for 3 years after your last order or contact with us (including chats), then anonymised, together with our notes and chat records about you – except the order, receipt and tax records the law requires us to keep.
  • Notes of chats with us that we can’t link to a customer record: deleted 3 years after the chat.
  • Newsletter: until you unsubscribe.
  • Google Analytics statistics: deleted by Google after no more than 14 months.

Cookies and your browser’s storage

We don’t use advertising cookies. Google Analytics cookies (named _ga and _ga_ followed by letters and numbers, kept for up to two years) are set only if you accept them in our cookie banner. Your choice is kept in your browser’s storage, and you can change it at any time with “Cookie settings” at the bottom of every page – rejecting deletes those cookies.

Your browser keeps your cart, your details while you check out (until you close the tab) and any referral code (for 90 days) in its own storage on your device. Small cookies with nothing personal in them – what is in your cart (for 30 days), any discount code you enter or follow a link with, and a random reference for a checkout you have started without JavaScript (both until you close your browser) – let our server price your cart and offer a checkout that works without JavaScript. Your details only reach us when you check out. Our staff get a sign-in cookie when they use our admin.

Your rights

Under the PDPA you can ask to see your personal data or receive a copy of it, have it corrected, deleted or restricted, object to how we use it, and withdraw any consent you have given. We may have to keep some data where the law says so (tax records, for example). Email hey@heydayhealthclub.com and we’ll reply within 30 days. You can also complain to Thailand’s Personal Data Protection Committee.

Security

The site only works over HTTPS. Your details are kept by providers who encrypt them, only our own staff can see them, each with their own sign-in, and every change they make is logged.

Children

We don’t knowingly collect children’s personal data. If you are under 20, please ask a parent or guardian to order for you.

Changes

If we change this policy, we’ll post the new version here with a new date.

Contact

The Sunny Day Co., Ltd. – hey@heydayhealthclub.com – +66 80 159 5247

Last updated: 16 October 2026