Privacy Policy

This policy explains what personal data Bangkok Rooftops collects, why, and the choices and rights you have. We keep data collection to the minimum needed to run this site and answer your messages.

Last updated: 23 October 2026

Who We Are

Bangkok Rooftops (https://bangkok-rooftops.com) is operated by Skyframe Media Group Co., Ltd., a company registered in Thailand, which acts as the data controller for the personal data described in this policy.

Skyframe Media Group Co., Ltd.
246 Times Square Building, 11th Floor, Unit 11-01
Sukhumvit Road, Klongtoey District
Bangkok 10110, Thailand
Tax ID: 0105568207444

For any privacy question or request, including to exercise the rights set out below, contact us at [email protected], or by post at the registered address above.

What We Collect

  • Contact form. When you use our contact form we collect the name, email address and message you provide. The form is delivered to our inbox by our processor Web3Forms; we use it only to read and reply to your enquiry.
  • Email correspondence. If you email us, we receive your email address and whatever you choose to include. Our email runs on Google Workspace.
  • Ticket purchases (our own events). When you buy a ticket to one of our own events directly on this site we collect your name, email, phone number, country and, optionally, gender, together with your order details (tickets bought, amount paid, payment method and status). We use this to process your order, deliver your QR e-ticket, admit you at the door, issue your receipt and handle any refund. This is processing necessary to perform our contract with you. If you start a booking but the payment isn't completed, we send you one email about that booking, with a link to finish it, and no further reminders. That single email is not marketing: it relies on our legitimate interest in helping you complete a purchase you started. Our ticket and reminder emails can show us whether they were opened and whether a link in them was clicked. Country and gender help us plan events; gender is always optional. We never see or store your card number: card details are tokenised in your browser and go directly to our payment provider. Order records are kept as long as Thai tax and accounting law requires. If you tick the separate marketing box (always optional, unticked by default) we'll also send you news about upcoming parties, and you can withdraw anytime via the unsubscribe link.
  • Server logs. Like most websites, our host records standard technical logs (e.g. IP address, browser type, pages requested) for security and to keep the site running.
  • Analytics. If you accept cookies, we use Google Analytics 4 and PostHog (hosted in the European Union) to understand how visitors find and use the site: for example pages viewed and the order you view them in, clicks, approximate location (from your IP address), device and browser, and how you arrived. We use this to improve the site, not to identify you personally. We also run cookieless, privacy-first analytics, Cloudflare Web Analytics and Ahrefs Web Analytics, which report only anonymous, aggregated figures. We also keep our own count of page views and of clicks on booking and ticket buttons, so we can tell the venues we work with how many guests we send them. It uses no cookies and records only the page, the button, the website or campaign that sent the visit, the type of device, and your browser's language and time zone. It never stores your IP address or anything that could identify you or follow you from page to page, so it runs whether or not you accept cookies.
  • Booking pages and session recording. On the booking pages for our own events, and only there, if you accept cookies, PostHog also records a replay of your on-page actions such as clicks and scrolling. We use this to find and fix problems in the booking process. Text you type into form fields is masked and is not captured, and your payment details are entered in our payment provider's own secure frame, which is never recorded.
  • Advertising measurement. We advertise our own parties on Google and on Meta (Facebook and Instagram). If you accept cookies, Google Ads and the Meta pixel record when a visit that started from one of our ads ends in a ticket purchase, along with the order value and order reference. This tells us which ads are worth paying for. We don't sell your data, we don't build advertising profiles about you, and we don't run third-party ads on this site.
  • Newsletter signup and the New Year's Eve quiz. If you give us your email address in a signup box or at the end of the New Year's Eve quiz, we store that address so we can email you about our pool parties, rooftop openings and New Year's Eve. With it we record the page you signed up on and, for spam protection, a scrambled (hashed) form of your IP address. Our list is kept in our own database and copied to a Google Sheet that only we can access. Our emails can show us whether they were opened and which links were clicked. Your welcome email links to a short, optional questionnaire: if you answer it we also store your first name, country of residence, whether you live in Bangkok or are visiting, your travel dates, whether you'll be here for New Year's Eve and for how many people, the kind of night you want, your age range and, only if you add it, your WhatsApp number. We use your answers to choose which emails you get, and your WhatsApp number only to message you about New Year's Eve tickets. We never share or sell them. Where you reached us through the quiz we also store the answers you gave (who you are coming with, what you want the night to be, which part of the city, your budget band and how high you want to be) together with the rooftops we matched you to. We use those answers for one purpose: to send you the events that actually fit, instead of everything we run. This is profiling in the narrow sense that it decides which emails you get; it has no legal or similarly significant effect on you.

    Nothing is recorded until you submit your email. Your quiz answers live only in your browser while you play. If you take the quiz and close the page, no record of it exists anywhere.

    Our legal basis is your consent, which you give by submitting the form after reading the notice shown next to it. We store the exact wording of that notice and the date alongside your entry, so it is always clear what you agreed to. You can withdraw consent at any time with the unsubscribe link in any of our emails, or by emailing us. Unsubscribing deletes your questionnaire and quiz answers, the page you signed up on and the scrambled IP address. We keep only your email address, on a do-not-email list, so you are never added back by mistake; ask us and we will delete that too.
  • Instagram and Facebook messages. When you message our Instagram account or Facebook Page, reply to one of our Stories or comment on one of our posts, an automated assistant run by our provider ManyChat may answer you. It receives your Instagram or Facebook user ID, username and display name, the public profile details Instagram or Facebook shares (such as your follower count) and the messages you send, and it adds simple labels to your contact, for example which party or which hotel list you asked about.

    Our parties. If you ask about one of our parties and choose to tell us, we also note your name, country, email address, your other social media accounts, how many people are coming, when you are in Bangkok and which parties or packages interest you. We keep these in a private Google Sheet and use them to answer you and to send you the party information you asked for. If you give us your email address in the chat, we tell you there that we will email you news about our parties, and you can unsubscribe from any of those emails. That address also joins our newsletter list (the one described above, kept in our own database and its Google Sheet), together with what you told us in the chat about when you are in Bangkok and how many people are coming, and we send you our welcome email. Unsubscribing from any of our emails takes you off that list and deletes those answers from it.

    Hotel lists. If you ask for our hotel list, we send it with affiliate links to Trip.com. If you book through one of them we may earn a commission. Trip.com never tells us who booked, and we don't store anything about your hotel booking. Hotel-list contacts are not added to our party list or our newsletter.

    We use what you tell us in the chat to answer you and, if you gave us your email address, to send you party news. When you are in Bangkok, when you first messaged us, which parties you picked and whether you have already been to one of our parties help us choose which of those emails you get. This decides only which emails you get; it has no legal or similarly significant effect on you, and we never sell it. Type TEAM in the chat at any time to reach a person, and email us to have your conversation data deleted.
  • Cruise booking requests. When you send a booking request for a cruise on this site, we collect your first and last name, email address, phone number, the cruise, date, seating and number of guests you chose, any note you add, the page you sent it from and a scrambled form of your IP address (to stop abuse). We use them to pass your request to the cruise company, which contacts you, sends you a payment link and confirms your booking, and to email you a copy of your request. We share these details with that cruise company only to arrange your booking, and we keep a private copy in our database and its Google Sheet. We take no payment, and a request does not add you to our newsletter.
  • Tips and the Wall of Contributors. When you leave a tip, Stripe processes the payment and passes us your name, email address, the amount, how you paid and any message you write. We use them to issue the tax receipt the law requires and to thank you. If you choose to appear on our Wall of Contributors, we show only the name you type for it and, if you ask, your message, after we have reviewed it. We never show your email address or the amount. You can ask us to remove your entry at any time by emailing us.

Cookies & Consent

On your first visit we ask whether you accept analytics and advertising-measurement cookies. Nothing is set until you choose:

  • If you accept, Google Analytics 4 sets cookies (named _ga and _ga_<id>) and PostHog sets one cookie (named ph_<id>_posthog) to measure how the site is used, Google Ads sets cookies (such as _gcl_*) to record whether a visit that began from one of our ads led to a ticket purchase, and the Meta pixel sets cookies (such as _fbp) to do the same for our Facebook and Instagram ads. They last up to about two years and you can clear them at any time in your browser.
  • If you decline, or simply ignore the banner, no analytics or advertising cookies are set, and Google Analytics, PostHog, Google Ads and the Meta pixel store nothing on your device.

You can change your choice at any time: click "Cookie settings" in the footer to reopen the banner, or clear cookies in your browser. We use Google Consent Mode, so both analytics storage and advertising storage stay switched off until you opt in.

Cloudflare Web Analytics, Ahrefs Web Analytics and our own visit counter are cookieless: they store nothing on your device and need no consent. The only other thing we keep in your browser is your day / night theme preference, in local storage so the site remembers your choice. It stays on your device, isn't sent to us, and isn't personal data.

Why We Use Your Data (Legal Basis)

We use the data above to respond to your enquiries, to operate and secure the website, to measure and improve it, and to comply with the law. Under Thailand's Personal Data Protection Act (PDPA) and the EU GDPR (where it applies), our lawful bases are: your consent, for analytics and advertising-measurement cookies, for our newsletter and the New Year's Eve questionnaire, and for party news emails when you give us your email address in an Instagram or Messenger chat; our legitimate interest, to answer enquiries and the Instagram and Facebook messages you send us, to run and secure the website, and to send one reminder when a booking you started isn't paid; and legal obligation, where the law requires us to keep certain records. You can withdraw your consent at any time, via "Cookie settings" for cookies or with the unsubscribe link in any of our emails, with no effect on the lawfulness of processing carried out before you withdrew it.

Third Parties

We share data only with the service providers that make the site work: our hosting, content delivery and security providers, our email and contact-form providers (our emails are sent through Resend), Google Sheets, where we keep private copies of our newsletter list and of party enquiries we receive on Instagram and Facebook and of cruise booking requests, our analytics providers, Google (Google Analytics and Google Ads conversion measurement), PostHog (site analytics, hosted in the EU) and Meta (Facebook and Instagram ad measurement), all only if you accept cookies, and ManyChat, which runs our Instagram and Facebook message assistant. Each acts on our instructions and only as needed for its service. Instagram and Facebook are run by Meta under Meta's own privacy policy. We never sell your personal data.

For ticket sales to our own events we also use: Stripe, our payment provider, who processes your payment (your card details go to Stripe directly and never touch our servers); Clubtech, the booking platform behind our interactive floorplan, which handles your booking and issues your ticket for events sold through it; and our database and email providers, which store your order and send your e-ticket and receipt. Each processes your data only as needed to complete your order, on our instructions, and none of them may use it for their own marketing.

For cruise booking requests, we pass your request to the cruise company you chose (the Alangka Cruise group runs the boats that take requests here), which uses it to contact you, take your payment and confirm your booking, under its own terms.

We may also disclose personal data to courts, regulators or law-enforcement authorities where the law requires it, or where necessary to establish or protect our legal rights.

Where we link out to third-party sites, including ticketing platforms such as Megatix and Ticketmelon, hotel booking sites such as Agoda, Booking.com, Trip.com and Klook (reached through our affiliate partners Stay22 and Travelpayouts), venues, or partners, those sites have their own privacy policies that govern any data you give them. We're not responsible for their practices.

International Transfers

Several of our providers process data on servers outside Thailand, typically in Singapore, the European Union and the United States. In particular, bookings made through our interactive floorplan are processed by Clubtech in Singapore, our product analytics are hosted in the European Union, and our Instagram and Facebook message assistant, ManyChat, runs in the United States. Where data is transferred abroad we rely on your consent (for analytics and advertising) and on contractual safeguards with each provider, including standard contractual clauses where applicable, as permitted under the PDPA and the GDPR.

Data Retention

We keep personal data only as long as we need it:

  • Enquiry emails and contact-form messages: up to 24 months after your enquiry is resolved, then deleted (longer only where we must keep records to meet a legal obligation).
  • Server and security logs: a short period, typically up to 90 days, held by our hosting and CDN providers.
  • Google Analytics data: retained according to our Google Analytics data-retention setting (up to 14 months), after which event-level data is deleted and only aggregated statistics remain.
  • PostHog data: booking-page replays are deleted after 30 days; other analytics events are deleted after one year.
  • Newsletter and quiz entries: kept until you unsubscribe or ask us to delete them. Unsubscribing deletes your answers at once and keeps only your email address on our do-not-email list. Answers are also reviewed after each New Year's Eve, so ones that no longer describe anyone's plans are not kept indefinitely.
  • Instagram and Facebook messages: contacts who only asked for our hotel list are deleted after 90 days without a new message. Party contacts are kept until you ask us to remove them, and at most 360 days after your last message.
  • Cruise booking requests: up to 24 months after your cruise date, so we can answer questions about the booking and keep the records commissions are paid on, then deleted.

Your Rights

Under the PDPA (and the GDPR for visitors in the EU/EEA) you can ask us to access a copy of your personal data, correct, delete or restrict it, object to processing, withdraw consent, or receive the data you gave us in a portable format. To exercise any of these, email [email protected] (or write to us at the address above) and we'll respond as required by law.

You also have the right to complain to a regulator: in Thailand, the Office of the Personal Data Protection Committee (PDPC); in the EU/EEA, your local data protection authority.

Children

This site is intended for adults of legal drinking age and is not directed at children. We do not knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. We'll change the "last updated" date above when we do, and significant changes will be made clear on this page.

Questions about your privacy? Email [email protected]. See also our Terms of Use.