Siamese Cat Creative Club - Privacy Policy

Effective date: 17 July 2026
Last updated: 8 August 2026

This Privacy Policy explains how Siamese Cat Creative Club ("the Club," "we," "us," or "our") collects, uses, stores, discloses, and protects personal data relating to parents, guardians, children, authorized pickup persons, emergency contacts, website and game users, and customers.

This policy is intended to support compliance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and other applicable laws.

Data Controller
Legal entity: Siamese Cat Cafe Co., Ltd. (Thailand)
Address: 46/27 Bang Na-Trat Frontage Road, Bang Kaeo, Samut Prakan 10540
Telephone: +66 095 241 3028
Email: Cafe@siamesecat.cafe

By registering a child or using our services, you acknowledge that you have read this Privacy Policy. Where consent is legally required, we request it separately.

1. Who This Policy Applies To

This policy applies to personal data relating to:

Parents and legal guardians
Children registered for Club services
Emergency contacts and authorized pickup persons
Customers purchasing sessions, packages, passes, activities, or meal care
Website users and visitors to Club premises
Players who choose to create an account for a Club game
People communicating with the Club
People appearing in CCTV, photographs, or videos where applicable

2. Personal Data We Collect

Depending on how you interact with the Club, we may collect the following information.

2.1 Parent or Guardian Information

Name
Telephone number
Email address
Relationship to the child, address, or identification details when reasonably needed
Registration, booking, communication, complaint, and customer-service records
Payment, transaction, and receipt information

2.2 Child Information

Name, nickname, date of birth, age, and gender where provided
Program or package interest
Booking, visit, check-in, check-out, attendance, and package-use records
Activity, meal, homework, participation, behavior, incident, or safety notes where relevant
Authorized pickup information
Photographs or video where separately permitted

2.3 Health and Other Sensitive Information

Where necessary for safety or service delivery, we may collect information about allergies, food restrictions, medical conditions, medication, disabilities, additional support needs, behavior, development, emergency care, or religious dietary requirements.

This information may be sensitive personal data. We process it only where necessary and where an appropriate legal basis or explicit consent applies.

2.4 Emergency Contacts and Authorized Pickup Persons

We may collect a person's name, relationship to the child, telephone number, identification details where reasonably needed, and pickup approval records.

The registering parent should tell these individuals that their information has been provided to the Club.

2.5 Payment and Operational Information

We may collect order details, payment method, amount, receipt records, payment proof, purchased products, remaining package hours or sessions, and related staff audit records.

2.6 Website and Technical Information

Our hosting and security providers may process device, browser, IP address, request, error, and security-log information. We use Google Analytics to understand website visits and usage, which may process device, browser, approximate location, interaction, referral, and identifier information. The website may also store a language preference and temporary form or selected-program information in the browser.

2.7 Game Account and Score Information

Playing the Cat vs Dog game does not require an account. If a player chooses to continue with Google, Google provides the account's stable identifier, display name, verified email address, and profile-picture URL. We do not receive or store the player's Google password.

We also store the player's language, account creation and activity dates, acceptance record, completed-game score, mode, stage, result, and duration. A display name and best score may appear on the recreational leaderboard. Google sign-in does not subscribe the player to marketing.

2.8 CCTV and Premises Information

CCTV may record images in appropriate common areas for safety, security, access control, and incident review. CCTV is not placed in toilets, private changing areas, or other areas where privacy is reasonably expected.

3. How We Collect Personal Data

We may collect information:

Directly from parents, guardians, customers, or authorized contacts
Through registration, booking, payment, and service forms
During check-in, attendance, pickup, activities, meal care, or customer support
Through our website, hosting infrastructure, and security systems
From Google Identity Services when a player chooses Google sign-in
From Club staff or service providers involved in delivering the requested service
From CCTV or incident records at the premises

4. Why We Use Personal Data

We may use personal data to:

Register parents and children
Review service interest, child readiness, and requested support
Confirm bookings, capacity, attendance, check-in, and pickup
Deliver the parent-accompanied Kids Playroom, creative activities, and After School Explorer services
Manage packages, passes, remaining access, activities, and meal care
Process payments, issue receipts, prevent misuse, and maintain accounting records
Protect children, families, staff, property, and systems
Review allergies, health information, emergency needs, and authorized pickup
Respond to questions, complaints, incidents, and privacy requests
Maintain operational, security, and audit records
Create and secure optional game accounts, save scores, operate the recreational leaderboard, and investigate misuse
Comply with legal obligations and establish, exercise, or defend legal claims
Send marketing only where consent or another lawful basis applies

If information is necessary to register a child or provide a service safely, failure to provide it may mean we cannot confirm the service.

5. Legal Bases for Processing

Depending on the purpose and applicable law, we may rely on:

Steps requested before entering into a contract
Performance of a contract
Compliance with legal obligations
Protection of vital interests
Legitimate interests that do not override the individual's rights
Establishment, exercise, or defense of legal claims
Consent or explicit consent where required
Another lawful ground available under applicable law

6. Children's Data and Parental Authority

A parent, legal guardian, or authorized person must register the child and provide accurate information.

We limit children's personal data to what is reasonably needed for registration, safety, service delivery, payment, attendance, and legal obligations. Sensitive information is available only to authorized staff or providers who need it for those purposes.

We do not use children's health or support information for advertising profiling.

7. Necessary Service Communications

We may send non-marketing communications about registration, booking confirmation, schedule changes, capacity, payment, package balance, attendance, pickup, safety, incidents, or policy updates.

These communications may be sent by telephone, email, SMS, or another channel the family uses with the Club.

8. Marketing and Media Choices

Marketing and promotional photography or video are optional. Declining either does not prevent registration or access to services.

Where consent applies, it may be withdrawn for future use by contacting the Club. Withdrawal does not affect processing that occurred lawfully before withdrawal.

Security or incident images may still be created or retained where reasonably necessary and legally permitted.

We do not sell personal data or disclose it to unrelated businesses for their own marketing.

9. Sharing Personal Data

We may share personal data only where reasonably necessary with:

Authorized Club and Siamese Cat Cafe staff supporting registration, activities, meal care, payment, safety, or customer service
Website, database, cloud-storage, security, email, and communications providers
Google as the identity provider when a player chooses Google sign-in
Banks, payment processors, accountants, auditors, insurers, and professional advisers
Medical or emergency services
Government authorities, courts, regulators, or law-enforcement bodies where legally required
Contractors supporting security, maintenance, or operations

Providers should use personal data only for authorized purposes and with appropriate safeguards.

10. International Data Transfers

Some technology providers may store or process information outside Thailand. Where an international transfer occurs, we take reasonable steps required by applicable law, such as selecting appropriate providers, using contractual safeguards, obtaining consent where required, or relying on another lawful transfer mechanism.

11. Data Retention

We retain personal data only for as long as reasonably necessary for service delivery, safety, legal obligations, accounting, dispute resolution, and legitimate business needs.

Retention depends on the type of record:

Registration and child profiles are kept while services remain active and for a reasonable period afterward
Game profiles and score history are kept while the account is active and for a reasonable period afterward, unless earlier deletion is available and requested
Booking, transaction, receipt, and tax records are kept for applicable legal and accounting periods
Incident and safety records are kept as reasonably needed for safeguarding, insurance, or claims
CCTV is kept for a limited operational period unless footage is needed for an incident, investigation, or legal matter
Marketing records are kept until consent is withdrawn or the information is no longer needed
Consent and acceptance records are kept as reasonably needed to demonstrate compliance

We may anonymize information instead of deleting it when it can no longer identify a person.

12. Data Security

We use reasonable administrative, technical, and physical safeguards, which may include role-based access, password protection, restricted access to sensitive information, audit logs, secure storage, backups, vendor controls, and incident-response procedures.

No system can be guaranteed completely secure. Please contact the Club promptly if you believe personal data has been accessed or used without authorization.

13. Personal Data Breaches

We assess suspected personal data breaches and take reasonable containment, investigation, and corrective steps. Where required by law, we notify the competent authority and affected individuals within the applicable period.

14. Privacy Rights

Subject to the PDPA, applicable exceptions, and verification of identity, a person may have the right to:

Request access to personal data
Request correction of inaccurate or incomplete data
Request deletion, destruction, or anonymization where legally available
Request restriction of processing
Object to certain processing
Request data portability where applicable
Withdraw consent for future processing based on consent
Submit a complaint to the competent personal data protection authority

A request concerning a child must be made by a person with appropriate authority. We may need information to verify identity and authority before acting.

15. Exercising Privacy Rights

To submit a privacy request, contact:

Privacy Contact / Data Controller
Siamese Cat Creative Club
Siamese Cat Cafe Co., Ltd. (Thailand)
46/27 Bang Na-Trat Frontage Road, Bang Kaeo, Samut Prakan 10540
Email: Cafe@siamesecat.cafe
Telephone: +66 095 241 3028

Please describe the request and identify the relevant parent, child, registration, or transaction. We will respond within the period required by applicable law.

16. Cookies, Local Storage, and Third-Party Links

The website may use necessary browser storage for language preferences, form flow, security, selected-program information, local game progress, and game-ad cooldown. If a player signs in, we use a secure session cookie to keep the player signed in. Hosting providers may use necessary security technologies to protect the site. Google Analytics may use cookies or similar technologies to measure visits, page usage, referral sources, and website performance. Google Identity Services and Google Analytics handle information under Google's own privacy terms and controls.

The website may link to third-party maps, email, telephone, payment, or social services. Those services apply their own privacy policies.

17. Changes to This Policy

We may update this Privacy Policy to reflect service, technology, security, or legal changes. The updated version will show a new "Last updated" date.

Material changes may be communicated through an appropriate service channel. Where new consent is legally required, we will request it.

18. Acceptance Records

The registration form asks the parent or legal guardian to confirm that they are authorized to register the child and that they acknowledge this Privacy Policy and the Terms of Service. The optional game sign-in screen asks the player to acknowledge the same documents before creating or updating a game account.

The Club may retain the accepted document version, date, time, and related registration record to document that acceptance.