Privacy policy

Who we are

This site is operated by Sor. Dechaphant Co., Ltd. (Head Office), a company registered in Thailand. Under the PDPA, we are the Data Controller for personal data collected through MuayThai.Tickets.

• Registered office: 168 Soi Sannibat Thetsaban, Chan Kasem Subdistrict, Chatuchak District, Bangkok 10900, Thailand
• Registration / Tax ID: 0105568018692
• Phone: 088-294-6464
• General contact: info@muaythai.tickets

What data we collect

We group the personal data we collect into five categories.

• Account data. Your name, email address, and phone number when you create an account or sign in with a magic link. If you are an organizer, we additionally collect the company details you submit to list events.
• Order data. Your order reference, the event and ticket type you purchased, the quantity, the total paid, the buyer name on the order, and any delivery fields the organizer requires for gate entry.
• Payment metadata. A payment-provider token, payment method type, last four card digits, card brand, and provider charge identifier. We never collect or store your full card number, card expiry, CVV, or banking credentials. Card details go directly from your browser to Omise or Stripe.
• Communication data. The content of emails you send us, our replies, and support notes added while handling your request.
• Technical data. IP address, user agent, timestamps, and anonymous request identifiers captured for security, rate limiting, and fraud detection.

Why we collect it

The lawful basis under the PDPA differs by category.

• Account data and order data are processed for contract performance (PDPA §24(3)). We cannot sell or deliver a ticket or provide ticket history without this data.
• Marketing emails about upcoming events are sent only with separate explicit consent (PDPA §24(1)). Marketing opt-in is optional and unchecked by default, and you can withdraw consent at any time.
• Payment metadata, tax invoice data, and refund records are retained for legal obligation (PDPA §24(6)), principally the Thai Revenue Code and Accounting Act, which require seven years of financial records.
• Technical data is processed for legitimate interest (PDPA §24(5)) to secure the platform, prevent fraud, and diagnose outages, balanced against your rights.

How long we retain it

We retain each category only as long as its purpose or a legal obligation requires.

• Account data: kept while your account is active. After an eligible deletion request, we erase it within 30 days.
• Order, payment, refund, and tax invoice records: retained for 7 years from the transaction under Thai accounting and tax law. This overrides deletion for those records.
• Consent records: retained for 7 years from the latest recorded event as evidence of lawful processing under PDPA §30.
• Communication data: retained for 24 months from the last message in a thread.
• Technical data: retained for 12 months for security review, then purged.
• Session tokens and abandoned carts: retained for 30 days, then purged automatically.

Who we share it with

We use a small number of processors. Each receives only the data it needs and is bound by a data-processing agreement. We do not sell data or share it with advertisers or data brokers.

• Omise / Opn Payments (Thailand). Processes card and PromptPay transactions and holds tokenised card details.
• Stripe (United States). Processes Google Pay and Apple Pay wallet payments and holds the wallet token.
• Postmark (United States and European Union). Sends order confirmations, ticket emails, and support replies.
• Neon (United States). Hosts the production database containing accounts, orders, and tickets.
• Railway (United States). Hosts the web application and background workers.
• Cloudflare (global edge). Provides content delivery, DDoS protection, and the web-application firewall.
• Google (United States) — Tag Manager, Analytics 4, Ads. Loads only after analytics or marketing consent. It receives browsing events and device and approximate-location data. Enhanced conversion identity is SHA-256 hashed in your browser before transmission.
• Meta (United States) — Facebook Pixel and Conversions API. Loads only after marketing consent. Purchase events may include hashed email, phone, and name; plaintext identity is never sent.
• TikTok (United States) — Pixel and Events API. Loads only after marketing consent. Purchase events may include hashed email, phone, and name; plaintext identity is never sent.
• Reddit (United States) — Pixel and Conversions API. Loads only after marketing consent. Purchase events may include hashed email and a Reddit click identifier; plaintext email is never sent.
• Event organizers. The organizer receives the minimum data needed for gate entry and event operations. Organizer obligations are covered in theTerms and conditions.
• Thai tax and regulatory authorities. We disclose buyer data only where a specific law compels it.

Your rights under the PDPA

PDPA §§30 to 37 give you the following rights. You can exercise them free of charge, and we verify ownership before acting.

• Right to access (§30). Request a copy of your profile, orders, tickets, refunds, and consent records at./my/data-export.
• Right to data portability (§31). Your export is provided as machine-readable JSON.
• Right to object (§32). Object to processing based on legitimate interest, including fraud-detection and security processing.
• Right to erasure (§33). Request deletion within 30 days at the address below. Records required by Thai law remain and are pseudonymised where possible:./my/account/delete.
• Right to restriction (§34). Ask us to pause processing while a correction or objection is reviewed.
• Right to rectification (§35). Correct inaccurate or incomplete data in your account or by contacting us.
• Right to withdraw consent (§36). Withdraw consent at any time without affecting ticket delivery or order history.
• Right to lodge a complaint (§37). Complain to Thailand's Personal Data Protection Committee atpdpc.or.th.

Cookies and tracking

We group cookies and similar technologies into three tiers shown in the consent banner.

• Essential cookies. Always on for sessions, carts, checkout, and security such as CSRF protection.
• Analytics cookies. Off until you opt in. They collect aggregated product-usage data; no analytics script loads before consent.
• Marketing cookies. Off until you opt in. They load Meta, TikTok, Reddit, and Google Ads measurement; no marketing script loads before consent.

You can change cookie choices at any time from the cookie banner or account settings. Withdrawing consent stops the corresponding scripts on your next visit.

International transfers

Some processors operate outside Thailand, including infrastructure in the United States and European Union. Google, Meta, TikTok, and Reddit process consented analytics or marketing data in the United States.

Under PDPA §28, transfers rely on binding contractual commitments and processor protection programs. Each processor is bound by a data-processing agreement requiring equivalent protection and restricting onward transfer. We review the processor roster at least annually.

Security

We operate under PCI DSS SAQ-A scope. Card data is collected by provider-hosted fields and tokenised before reaching us; we never log card numbers, expiry dates, or CVV.

Every card payment is processed under Thailand's 3D Secure 2 requirement. Your bank may ask you to confirm the payment.

Data in transit uses TLS. Database, application hosts, and queues use restricted production access, and access is limited and logged.

Privacy contact

To ask about personal data or exercise a PDPA right, contact the person responsible for data protection using these details.

• Email: info@muaythai.tickets
• Postal address: 168 Soi Sannibat Thetsaban, Chan Kasem Subdistrict, Chatuchak District, Bangkok 10900, Thailand

You can also complain to Thailand's Personal Data Protection Committee (PDPC), which publishes contact details at pdpc.or.th.

Changes to this policy

We review this policy at least annually and whenever processors, retention, or data use changes. Material changes are announced before they take effect.

Effective date

This policy is effective from 31 May 2026.