TarmTorbThis agreement is between the organization using TarmTorb (the “customer”) and [[COMPANY]] (“we”). It forms part of our terms of service, and applies whenever we process personal data for the customer. Business customers who need a signed copy can ask us at [email protected].
1. Roles
The customer decides what personal data to collect from its players and why, so the customer is the data controller. We process that data only to provide TarmTorb, as the customer’s data processor, under Thailand’s Personal Data Protection Act B.E. 2562 (2019).
2. The data
| People | Players of the customer’s games |
| Data | Nicknames, answers, scores and response times; the details the customer’s join forms ask for, with each player’s consent record; technical data such as IP addresses and device types |
| Purpose | Running the customer’s games and showing the customer their results |
| Duration | For join-form details, the retention period the customer chooses, from 7 to 365 days; for everything else, while the customer keeps it in TarmTorb |
3. Our commitments
We will:
- process the data only on the customer’s instructions, which are these terms and the customer’s choices in TarmTorb, unless the law requires otherwise, in which case we tell the customer first if the law allows;
- make sure everyone who can reach the data is bound to keep it confidential;
- protect it with the measures in section 8;
- use other companies (sub-processors) only as described in section 4;
- help the customer answer players’ requests to see, correct or delete their data: owners and editors can download and delete a player’s details in TarmTorb themselves;
- tell the customer about a personal data breach affecting its data without undue delay, and in any case within 24 hours of becoming aware of it, with what we know, so the customer can notify the regulator within 72 hours;
- help the customer with data protection impact assessments and with the regulator, as far as our processing is concerned;
- delete the customer’s personal data when the customer asks or leaves TarmTorb, within 30 days, except where the law requires us to keep it. Copies in our encrypted backups are deleted within a further 14 days;
- give the customer the information it needs to show that this agreement is kept, and allow reasonable audits with reasonable notice.
4. Sub-processors
The customer allows us to use these sub-processors:
| Sub-processor | What it does | Where |
|---|---|---|
| [[HOSTING_PROVIDER]] | Servers that run TarmTorb and its database | Bangkok, Thailand |
| Cloudflare | Delivers TarmTorb and protects it from attacks; stores images and encrypted backups | Worldwide |
| [[EMAIL_PROVIDER]] | Sends emails, such as results to the host | [[EMAIL_REGION]] |
We bind each sub-processor to protect the data as this agreement does. We tell customers at least 30 days before adding or replacing a sub-processor, and a customer that objects on reasonable grounds may stop using TarmTorb.
5. Where the data is
Join-form details, games and results are stored on servers in Thailand. Join-form details never leave them, except inside encrypted backups. Images and encrypted backups are stored with Cloudflare, which may be outside Thailand; we transfer data abroad only as the PDPA allows.
6. The customer’s commitments
The customer will have a lawful basis for the data it collects, give its players the notices the law requires, collect no sensitive personal data through join forms, and answer its players’ requests.
7. Liability
Each party’s liability under this agreement is as set out in our terms of service, except where the law does not allow it to be limited.
8. Security measures
- In transit: every connection to TarmTorb is encrypted (HTTPS and secure WebSockets).
- At rest: join-form details are encrypted with AES-256-GCM before they are stored, with keys kept outside the database. Backups are encrypted before they leave our servers.
- Kept apart: join-form details go only to the API that stores them, never to the game servers, other players or the big screen. Each organization’s data is separated from every other’s.
- Access: people in the customer’s organization see only what their role allows; only owners and editors see join-form details. TarmTorb staff reach customer data only to run the service or help the customer, and every staff action is recorded in an audit log.
- Deletion: join-form details are deleted automatically when their retention period ends.
- Resilience: databases are backed up every hour, and restoring from backups is tested.
9. Law
This agreement is governed by the laws of Thailand. If the Thai and English versions differ, the Thai version prevails.