TarmTorbThis notice explains how TarmTorb, provided by an individual (“we”), handles personal data, as required by Thailand’s Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”).
Who is responsible
- People with a TarmTorb account, such as organizers, editors and hosts, and visitors to our website: we decide how your personal data is used, so we are its data controller.
- People who play games (“players”): the organization running the game decides what to collect from you, for example in a join form, so that organization is the data controller. We process players’ data on its behalf. If you have a question about a game you played, ask its organizer first; we will help them answer you.
What we collect
About account holders
- Name, email address, password (stored only as a one-way hash), and preferred language
- If you sign in with LINE, Google or Apple: your name and email address from that service, your profile picture from LINE or Google, and the ID that service gives your account. LINE shares your email only if you allow it, and Apple can give us an address that forwards to yours.
- The organizations you belong to, and your role in each
- What you make in TarmTorb: quizzes, images, brand settings, join forms and games
- The days you use TarmTorb, to count how many people use it
- Messages you send us for support, by email or LINE
About players
- The nickname you choose or are given, the picture you pick or are given, your answers, scores and response times
- If the game has a join form: the details it asks for, and when you agreed to its consent text and which version
- Reports you send about a game: the reason and any details you write. We don’t record who sent a report.
About everyone who uses TarmTorb
- Technical data: your IP address, your browser and phone or computer type, and measurements of your connection to a game, such as how long joining took
- Cookies and storage in your browser: see Cookies and browser storage below
Why we use it
| Purpose | Legal basis under the PDPA |
|---|---|
| Providing TarmTorb: accounts, organizations, quizzes, games, results and the emails about them | Performing our contract with you |
| Keeping TarmTorb secure and preventing abuse: limiting repeated attempts, handling reports, taking down content that breaks our terms, and recording staff actions in an audit log | Our legitimate interests |
| Measuring connections and usage, to make games reliable and to plan capacity and pricing | Our legitimate interests |
| Helping you when you contact us, including, with your agreement, looking at your account as you see it | Performing our contract, and our legitimate interests |
| Meeting our legal obligations | Legal obligation |
We don’t sell personal data, and we don’t use it for advertising.
Who can see it
- Your organization: members see the organization’s quizzes, games and results according to their role. Only owners and editors see attendee details from join forms.
- TarmTorb staff, only to run the service and to help you. Every staff action is recorded.
- Service providers who work for us under contract:
- ReadyIDC, whose servers in Bangkok, Thailand run TarmTorb and its database
- Cloudflare, which delivers our websites and images, protects them from attacks, checks that people signing up aren’t bots, and stores images and backups
- Amazon Web Services (Amazon SES), which sends our emails
- Google or Apple, if you choose to sign in with them
- LINE, if you sign in with LINE or contact us through our LINE Official Account
- our status page and uptime monitoring provider, which sees no personal data beyond what any website visit involves
- YouTube (Google), when a quiz has a YouTube clip: TarmTorb uses YouTube API Services to play it, and YouTube’s player and preview images may receive your IP address and what you watch, and set cookies. YouTube handles this data under Google’s Privacy Policy, not for us.
- LINE (LY Corporation), through LINE’s own buttons: the Share button in the Studio’s sharing panel, and the Add friend button on our contact page. They load from LINE, which receives your IP address and the page’s address, may set cookies, and handles this data under LINE’s Privacy Policy, not for us.
- Authorities, when the law requires it.
Where it is kept
Accounts, games, results and join-form answers are stored on servers in Bangkok, Thailand. Join-form answers are encrypted before they are stored, with keys kept apart from the database.
Images, and backups of the database, are stored by Cloudflare, possibly outside Thailand. Cloudflare encrypts what it stores. Our emails are sent through Amazon SES in Singapore. Where personal data is transferred abroad, we do so as the PDPA allows, with providers bound to protect it.
How long we keep it
- Accounts: while your account exists. Delete your account at any time from your account page in the Studio, or ask us to.
- Join-form answers: for the period the organizer chose, from 7 to 365 days, then deleted automatically. Nicknames and scores stay with the game’s results.
- Games and results: while the organization keeps them.
- Images: an image no quiz, brand or game uses is deleted after 30 days.
- Backups: deleted 7 days after they are made, so deleted data leaves our backups within 7 days.
- Server logs: kept for a short time, normally no more than 30 days.
Cookies and browser storage
TarmTorb uses cookies and storage in your browser only for the purposes above, and to remember choices you make, never for advertising or other companies’ analytics. They rest on the same legal bases, performing our contract with you and our legitimate interests (PDPA section 24(3) and (5)), so TarmTorb doesn’t ask for your consent with a cookie banner. If we ever want to use cookies that need your consent, we will ask for it first.
- Signing in: a cookie keeps you signed in to the Studio until you sign out, or about 7 days after you last use TarmTorb, and lets us count the days you use it. Signing in with LINE, Google or Apple, or connecting one to your account, sets another for up to 5 minutes, to check that what comes back is what you started.
- Your choices: your browser keeps your language, whether sound effects and music are on, the picture you last picked as a player, and a few notes that help the Studio, such as how you sign in, until you delete them.
- Players: the player app keeps your place in each game you join, with a code that lets your phone carry on as the same player after a reload, until you tap Join another game. TarmTorb sets no cookies for players.
- Other companies: the companies named above whose services or content TarmTorb uses, such as to keep out bots, play video clips or share links, may set their own cookies or keep information in your browser, under their own policies.
You can block or delete cookies and stored data in your browser’s settings. Without TarmTorb’s cookies you can’t sign in to the Studio, and without its storage a reload can’t bring you back into a game.
How we protect it
Connections to TarmTorb are encrypted (HTTPS). Join-form answers are encrypted when stored, in our database and in its backups, and Cloudflare encrypts the backups it stores. Each organization’s data is kept apart from every other’s, and people see only what their role allows.
If a personal data breach happens, we tell the affected organizations without delay, and notify the Office of the Personal Data Protection Committee within 72 hours when the PDPA requires it.
Your rights
Under the PDPA, you may ask to see and get a copy of your personal data, to have it corrected, to move it, to have it deleted or anonymized, to restrict how it is used, and to object to its use. Where we rely on your consent, you may withdraw it at any time. You may also complain to the Office of the Personal Data Protection Committee.
To use these rights, write to help@tarmtorb.com. Players should contact the organizer of the game first.
Children
TarmTorb accounts are for adults. When players are children, the organizer is responsible for having a lawful basis to collect any details from them, including a parent’s consent where the law requires it.
Changes to this notice
When we change this notice, we update the date at the top, and tell account holders by email about important changes.
Contact us
Email: help@tarmtorb.com.