TarmTorbThis notice explains how TarmTorb, run by [[COMPANY]] (“we”), handles personal data, as required by Thailand’s Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”).
Who is responsible
- People with an TarmTorb account, such as organizers, editors and hosts, and visitors to our website: we decide how your personal data is used, so we are its data controller.
- People who play games (“players”): the organization running the game decides what to collect from you, for example in a join form, so that organization is the data controller. We process players’ data on its behalf, under our data processing agreement. If you have a question about a game you played, ask its organizer first; we will help them answer you.
What we collect
About account holders
- Name, email address, password (stored only as a one-way hash), and preferred language
- If you sign in with Google: your name, email address and profile picture from Google
- The organizations you belong to, and your role in each
- What you make in TarmTorb: quizzes, images, brand settings, join forms and games
- Messages you send us for support, by email or LINE
About players
- The nickname you choose or are given, your answers, scores and response times
- If the game has a join form: the details it asks for, and when you agreed to its consent text and which version
- Reports you send about a game: the reason and any details you write. We don’t record who sent a report.
About everyone who uses TarmTorb
- Technical data: your IP address, your browser and phone or computer type, and measurements of your connection to a game, such as how long joining took
- Cookies and similar storage: a cookie that keeps account holders signed in, and storage in your browser that remembers your language and, for players, the game you are in. We don’t use advertising cookies or trackers.
Why we use it
| Purpose | Legal basis under the PDPA |
|---|---|
| Providing TarmTorb: accounts, organizations, quizzes, games, results and the emails about them | Performing our contract with you |
| Keeping TarmTorb secure and preventing abuse: limiting repeated attempts, handling reports, taking down content that breaks our terms, and recording staff actions in an audit log | Our legitimate interests |
| Measuring connections and usage, to make games reliable and to plan capacity and pricing | Our legitimate interests |
| Helping you when you contact us, including, with your agreement, looking at your account as you see it | Performing our contract, and our legitimate interests |
| Meeting our legal obligations | Legal obligation |
We don’t sell personal data, and we don’t use it for advertising.
Who can see it
- Your organization: members see the organization’s quizzes, games and results according to their role. Only owners and editors see attendee details from join forms.
- TarmTorb staff, only to run the service and to help you. Every staff action is recorded.
- Service providers who work for us under contract:
- [[HOSTING_PROVIDER]], whose servers in Bangkok, Thailand run TarmTorb and its database
- Cloudflare, which delivers our websites and images, protects them from attacks, and stores images and encrypted backups
- [[EMAIL_PROVIDER]], which sends our emails
- Google, if you choose to sign in with Google
- LINE, if you contact us through our LINE Official Account
- our status page and uptime monitoring provider, which sees no personal data beyond what any website visit involves
- Authorities, when the law requires it.
Where it is kept
Accounts, games, results and join-form answers are stored on servers in Bangkok, Thailand. Join-form answers are encrypted before they are stored, with keys kept apart from the database.
Images, and backups of the database, are stored by Cloudflare, possibly outside Thailand. Backups are encrypted on our servers before they leave them. Where personal data is transferred abroad, we do so as the PDPA allows, with providers bound to protect it.
How long we keep it
- Accounts: while your account exists. Delete your account at any time from your account page in the Studio, or ask us to.
- Join-form answers: for the period the organizer chose, from 7 to 365 days, then deleted automatically. Nicknames and scores stay with the game’s results.
- Games and results: while the organization keeps them.
- Images: an image no quiz, brand or game uses is deleted after 30 days.
- Backups: deleted 14 days after they are made, so deleted data leaves our backups within 14 days.
- Server logs: kept for a short time, normally no more than 30 days.
How we protect it
Connections to TarmTorb are encrypted (HTTPS). Join-form answers are encrypted when stored, and backups are encrypted before they leave our servers. Each organization’s data is kept apart from every other’s, and people see only what their role allows.
If a personal data breach happens, we tell the affected organizations without delay, and notify the Office of the Personal Data Protection Committee within 72 hours when the PDPA requires it.
Your rights
Under the PDPA, you may ask to see and get a copy of your personal data, to have it corrected, to move it, to have it deleted or anonymized, to restrict how it is used, and to object to its use. Where we rely on your consent, you may withdraw it at any time. You may also complain to the Office of the Personal Data Protection Committee.
To use these rights, write to [email protected]. Players should contact the organizer of the game first.
Children
TarmTorb accounts are for adults. When players are children, the organizer is responsible for having a lawful basis to collect any details from them, including a parent’s consent where the law requires it.
Changes to this notice
When we change this notice, we update the date at the top, and tell account holders by email about important changes.
Contact us
[[COMPANY]], [[ADDRESS]]. Email: [email protected].