Privacy Policy

1. Who we are

This website is operated by Grit & Glory Martial Arts School, a business registered with the Department of Trade and Industry and trading as “Grit & Glory Taekwondo”. We run Taekwondo classes at three branches in Metro Manila: Hagonoy and Arca South in Taguig City, and Don Bosco in Parañaque City.

Under the Data Privacy Act of 2012 (Republic Act No. 10173), we are the Personal Information Controller for the processing described in this notice. That means we remain accountable for personal data handled on our behalf by the service providers named below, as required by Section 21 of the Act.

2. What this notice covers

This notice covers https://ggtkd.com — the website you are reading now.

It does not cover enrolment. When you book a trial class or enrol, you are taken to our booking platform at https://app.ggtkd.com. That platform is operated by the same business but is a separate processing activity with its own privacy notice, because it collects information this website never sees. Please read that notice before you enrol.

It also does not cover anything that happens at our branches — enrolment forms, waivers, medical disclosures and attendance records are handled in person and are governed by the documents you sign there.

3. We do not ask you for anything on this website

There are no contact forms on this website. There are no accounts, no sign-ups, no newsletter, and no comment sections. We do not ask for your name, your email address, your phone number, or any details about you or your child anywhere on this site, and we do not store any information about you in our own systems.

Every button that invites you to book a class simply sends you to our booking platform. Nothing you type is captured here first.

4. What is processed automatically when you visit

Like every website, ours cannot reach you without your device communicating with servers. Those servers automatically receive certain technical information, whether or not you interact with anything:

• Your IP address
• Your browser type and version, and your device and operating system
• The pages you view on this site, and the page or link that referred you
• The approximate region your connection is coming from

We are telling you about this rather than claiming that no personal data is involved. The National Privacy Commission has advised that information such as an IP address or a cookie identifier may be treated as personal information when combined with other information (Advisory Opinion No. 2017-63). We would rather over-explain than give you a reassuring statement that is not accurate.

We do not use this information to build a profile of you, and we do not make any automated decision about you. There is no automated decision-making or profiling on this website.

5. Who receives this information

We use three third-party services to deliver and improve this website. Each receives technical information as described below. All three process data outside the Philippines; this is permitted under the Data Privacy Act, and our accountability for your data continues regardless of where it is processed.

Each of these providers handles the information it receives under its own privacy policy. We do not sell your information, and we do not share it with advertisers. There is no advertising pixel on this website.

6. Cookies

Our own code sets no cookies at all, and stores nothing in your browser. The only cookies on this site come from Google Analytics — typically named “_ga” and “_ga_” followed by a code — which distinguish one visitor from another so that visit counts are not double-counted. Vercel's analytics do not use cookies.

Philippine law requires us to tell you about cookies clearly; it does not require us to obtain your consent before setting them, and the National Privacy Commission has advised that consent pop-ups are not required (Advisory Opinion No. 2017-47). That is why you are reading this instead of dismissing a banner.

You can block or delete cookies at any time in your browser settings, and you can install Google's official opt-out add-on to stop Google Analytics entirely. Nothing on this website will stop working if you do.

7. Why we process this, and our legal basis

We process the technical information described above for three purposes: to deliver the website to you, to keep it secure and working properly, and to understand which pages are useful so we can improve them.

Our legal basis is legitimate interest under Section 12(f) of the Data Privacy Act — our interest in running and improving a website for our academy, balanced against your rights. We do not rely on legitimate interest for any sensitive personal information, which the law does not permit.

We do not use this information for direct marketing, and we do not use it to profile you.

8. Children

Our students start at age three, so children's data matters a great deal to us — but none of it is collected on this website. This site is written for parents and guardians, and it has no form, account or feature through which a child could give us information.

Where children's data is collected — at enrolment, on our booking platform, or at a branch — it is provided by the parent or legal guardian. Philippine law does not set an age of digital consent. Instead, an unemancipated minor cannot give consent to a contract (Civil Code, Article 1327), so enrolment is undertaken by the parent or guardian, who provides the child's information and consents to its processing on the child's behalf. Where we rely on consent to process a child's sensitive personal information, such as medical or injury history, that consent is obtained from the parent or guardian, is specific to the purpose, and is obtained before processing, as Section 13(a) of the Act requires.

A child is a data subject in their own right. Their rights under the Data Privacy Act are not reduced by their lack of legal capacity to enter a contract.

9. Sensitive personal information

No sensitive personal information is processed through this website.

We mention it because the Philippine definition is broader than many people expect. Under Section 3(l) of the Data Privacy Act, sensitive personal information includes not only health information but also a person's age and their education. A student's date of birth, a medical clearance, an allergy note, and belt grading records therefore all attract the stricter protections of the Act. Those records are created at enrolment and at our branches, never here, and are handled under the enrolment documents and the booking platform's own notice.

10. How long information is kept

We hold no visitor records ourselves, so there is nothing for us to retain from your visit to this website.

Our service providers retain the technical information they receive under their own schedules. Google Analytics data is retained for a limited period set in our account configuration and is then deleted automatically. Hosting and security logs held by Vercel are kept on a short rolling basis. Records created at enrolment are kept for as long as a student is with us and afterwards only for as long as we need them for legitimate business, accounting, or legal purposes.

11. How we protect information

This website is served entirely over an encrypted connection (HTTPS). We apply security headers that instruct browsers to keep using that encrypted connection, prevent the site from being embedded by other websites, and switch off browser features the site does not need — including the camera, microphone, payment, and USB interfaces, and Google's advertising Topics interface, which we disable outright.

The content on this website is published from a database configured for read-only public access. There is no path through which a visitor can write data to our systems.

12. Your rights

The Data Privacy Act gives you the following rights over your personal data:

• The right to be informed — to know that your personal data is being processed, and how.
• The right to object — to refuse the processing of your personal data, including for direct marketing or profiling.
• The right to access — to obtain a copy of the personal data we hold about you, and details about how it is processed.
• The right to rectification — to have inaccurate or incomplete data corrected.
• The right to erasure or blocking — to have your data removed or withheld from processing in the circumstances the Act provides.
• The right to damages — to be indemnified for damage sustained through inaccurate, incomplete, unlawfully obtained or unauthorised use of your personal data.
• The right to data portability — where processing is by electronic means and based on your consent or a contract, to obtain your data in a commonly used, machine-readable format.

To exercise any of these, email us at hello@ggtkd.com. We will respond within 30 working days. If your request is complex or you have made several, we may extend this by a further 15 working days and will tell you why. We do not charge a fee, except that we may recover a reasonable cost of producing copies under the right to access. We may ask you for enough information to confirm your identity, but no more than is necessary.

If you believe your rights have been violated, you may also file a complaint with the National Privacy Commission. Nothing in this notice, and nothing in our Terms of Use, removes that right.

13. How to contact us

For any question about this notice, or to exercise any of the rights above, contact our Data Protection Officer:

Data Protection Officer — Grit & Glory Martial Arts School
Email: hello@ggtkd.com

Our Data Protection Officer's telephone number and postal address are being finalised and will be published here. In the meantime, email reaches us and we will respond within the period set out above.

14. Changes to this notice

If we change how this website handles information, we will update this page and change the effective date below. Changes apply from the date they are posted. We suggest checking this page if you are returning to the site after a long gap.

Effective date: 5 August 2026.