Privacy Policy | Thaimak Muaythai Championship

1. Who we are

This policy explains how THAIMAK EDGE PRIVATE LIMITED (“we”, “us”) collects and uses personal data when you visit this website, create an account, book and pay for an event, register as a participant, or contact us. We run the Thaimak Muaythai Championship (TMC) and its events, such as The Legendary Seminar.

We are the data fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). That means we decide why and how your personal data is used.

Company: THAIMAK EDGE PRIVATE LIMITED
CIN: U85410KL2025PTC093580
Address: 02/537 - B, Koloor, Kuruvaloor, Atholi Panchayat, Kozhikode 673323, Kerala, India
Email: thaimakofficial@gmail.com
Phone and WhatsApp: +91 95673 55344

2. What we collect

We collect only what we need for the purpose in the right-hand column. Most of it comes directly from you.

When	What we collect	Why
Visiting the website	Your IP address, browser and device type, the pages you ask for and the time, in our server logs. We use IP addresses to limit abuse, such as repeated sign-in or form attempts.	Run and secure the website.
Your account	Email address, name and, if you give it, a phone number. Sign-in links are kept only as a one-way hash and work once. While you are signed in we keep a session record with your IP address and browser type.	Sign you in, show your bookings and reach you about them.
Event registration	Full name, father’s name, date of birth, gender, nationality, country, state, district and postal address, email, phone, type and number of a government ID, blood group, T-shirt and shorts size, food preference, and whether you have a medical issue and what it is. An emergency contact (for a child, a parent or guardian) with name, phone and relationship. For international participants: passport number and expiry, country of residence and visa details.	Register participants, work out the age category, issue tickets, check identity at entry, keep the event safe and arrange first aid, kit and food.
Bookings and payments	Booking reference, pass, price, installments, amounts paid, payment method, the UTR or transaction reference, the receipt or screenshot you upload, and our review notes. Invoices, receipts and credit notes. We never receive your card details, UPI PIN or OTP: you pay by bank transfer or UPI straight into our bank account.	Check and record payments, issue invoices, and meet tax and accounting rules.
Cancellation and refund requests	Your reason, your description, any document you attach (for example a medical certificate, a death certificate or proof of cancelled travel), our decision and the bank reference of any refund.	Decide your request under our refund policy.
Tickets and entry	Ticket number, QR code, and whether and when the ticket was scanned at the gate.	Admit each ticket once and prevent duplicate entry.
Enquiries	Name, phone number, email (optional), topic and message, from our contact form, email or WhatsApp.	Reply to you.
Our own records	A log of what our staff do on bookings and payments: who, what, when and from which IP address.	Accountability, security and settling disputes.

We do not use analytics, advertising or tracking tools on this website, and we do not build profiles of visitors.

3. How we use your data

To create and protect your account and sign you in.
To hold your seat, take and check payments, issue tickets, and produce invoices, receipts and credit notes.
To run the event safely. Health information is used only to protect you and others, for example so first aid knows what to expect.
To email you about your booking: confirmation, hold and payment reminders, payment decisions, your ticket, event changes and cancellation updates.
To meet legal duties, such as GST, accounting and tax rules, and to answer lawful requests from authorities.
To prevent fraud and abuse and keep the website secure.
To answer your questions and grievances.
To plan future events from totals that do not identify you.

We do not sell your personal data and we do not use it for advertising. The booking system sends service emails only. If we ever start sending promotional email, we will ask you first.

4. Consent and your choices

We use your personal data with your consent, which you give when you create an account, submit a registration or send an enquiry. The DPDP Act also lets us use data without consent for certain legitimate uses, such as providing a service you asked for, meeting a legal obligation, preventing fraud, or responding to a medical emergency.

Health details and government ID are given voluntarily. If you choose not to give details we need for safety or entry, we may not be able to register you for a physical training event.
You can withdraw consent at any time by writing to us. Withdrawing does not undo what we did before, and we may have to keep some records because the law requires it. We may also be unable to continue a booking without the details it needs.

5. Who sees your data

We do not sell or rent your data. We share it only in these ways.

Our team. Staff see only what their job needs. Payment verifiers see payment details. Event administrators see registration details, including ID numbers. Only staff who manage bookings can open cancellation documents, and each time they do it is logged.
Service providers who handle data for us under contract: cloud hosting, database and file storage (Microsoft Azure), email delivery, and the bank that receives your payments.
Venues and partners only where an event needs it, for example a name list for entry or food preferences for catering. We share the minimum and require them to keep it confidential.
Authorities, courts, auditors and professional advisers where the law requires it or to protect our rights.
A buyer or successor if our business is transferred, on the same terms as this policy.

Other websites

Links to WhatsApp, Instagram, Facebook, X and Reddit open services run by other companies under their own privacy policies. On the fighters page, your browser fetches country flag images from flagcdn.com, which can see your IP address and browser details.

Outside India

Some of our providers may store data on servers outside India. We do this only as the DPDP Act and any government notification allow.

6. Cookies and similar storage

We set one essential cookie, __Host-tmc_session, only when you sign in. It keeps you signed in. It is HTTP-only, secure and SameSite Lax, and it lasts about two weeks unless you sign out, which removes it.

We do not use advertising, analytics or social-media tracking cookies, so there is no cookie banner. Your browser may also keep small things on your device so the site works, such as your scroll position or what you typed in a form that showed an error. These stay on your device.

7. How long we keep it

We keep personal data only as long as it is needed for the purpose it was collected for, or as the law requires.

Data	How long
Sign-in links	They work once and expire after 15 minutes.
Saved registration drafts	Details you entered but did not book are deleted automatically 30 days after you last touched them.
Abuse-limiting counters	About a day.
Bookings, payments, invoices, receipts, credit notes and tickets	For the event, then as accounting and tax law requires. Company books of account are kept at least 8 years and GST records at least 6 years.
Participant details such as ID number, medical information, blood group and emergency contact	Only as long as needed to run the event safely and deal with any incident or claim. Then we delete or anonymise them.
Cancellation and refund documents	Deleted once the request and any related accounting or legal need are closed.
Enquiries	As long as needed to answer and follow up, then deleted or anonymised.
Your account	Until you ask us to close it, subject to the records above that we must keep.

8. How we protect it

The website uses HTTPS. You sign in with a single-use email link that expires, so there is no password to leak.
Access is limited by role, and staff actions on bookings and payments are logged.
Receipts and documents you upload are kept in private storage with no public link. They open only through signed-in pages that check permission.
We limit repeated attempts on sign-in and forms to stop abuse.

No online system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.

9. Children

Under the DPDP Act a child is anyone under 18. Our seminars and events include participants under 15, who take a child pass. Accounts are for adults aged 18 or over. A parent or guardian books for a child and enters the child’s details.

By doing so, the parent or guardian confirms they are the child’s parent or lawful guardian and gives consent for the child’s data on the child’s behalf. We use a child’s data only to register, keep safe and admit the child. We do not track or monitor children’s behaviour and we do not target advertising at them.

10. Your rights

Under the DPDP Act you can:

ask for a summary of the personal data we hold about you and how it is used;
ask us to correct or complete data that is wrong or out of date;
ask us to erase data that is no longer needed, except where the law says we must keep it;
withdraw your consent;
raise a grievance with us; and
nominate another person to exercise these rights if you die or cannot act for yourself.

You can update your name and phone number in your account, and correct participant details from your booking page while it is still open for changes. For anything else, write to us at thaimakofficial@gmail.com. We may ask you to confirm who you are first, to protect your data. We acknowledge a request within 48 hours and resolve it within one month.

If you are not satisfied after raising a grievance with us, you can complain to the Data Protection Board of India.

11. Grievance Officer

For any concern about your personal data or this policy, contact our Grievance Officer.

Detail	Contact
Officer	Grievance Officer, THAIMAK EDGE PRIVATE LIMITED
Email	thaimakofficial@gmail.com
Phone and WhatsApp	+91 95673 55344
Address	02/537 - B, Koloor, Kuruvaloor, Atholi Panchayat, Kozhikode 673323, Kerala, India

We acknowledge your complaint within 48 hours and resolve it within one month.

12. Changes to this policy

We may update this policy from time to time. The new version appears on this page with a new date. If a change affects the consent you gave, we will tell you or ask you again.