Privacy Policy

This policy explains what personal data Bangkok Rooftops collects, why, and the choices and rights you have. We keep data collection to the minimum needed to run this site and answer your messages.

Last updated: 15 June 2026

Who we are

Bangkok Rooftops (https://bangkok-rooftops.com) is operated by Skyframe Media Group Co., Ltd., a company registered in Thailand, which acts as the data controller for the personal data described in this policy.

Skyframe Media Group Co., Ltd.
246 Times Square Building, 11th Floor, Unit 11-01
Sukhumvit Road, Klongtoey District
Bangkok 10110, Thailand
Tax ID: 0105568207444

For any privacy question or request — including to exercise the rights set out below — contact us at [email protected], or by post at the registered address above.

What we collect

  • Contact form. When you use our contact form we collect the name, email address and message you provide. The form is delivered to our inbox by our processor Web3Forms; we use it only to read and reply to your enquiry.
  • Email correspondence. If you email us, we receive your email address and whatever you choose to include. Our email runs on Google Workspace.
  • Ticket purchases (our own events). When you buy a ticket to one of our own events directly on this site we collect your name, email, phone number, country and — optionally — gender, together with your order details (tickets bought, amount paid, payment method and status). We use this to process your order, deliver your QR e-ticket, admit you at the door, issue your receipt and handle any refund — this is processing necessary to perform our contract with you. Country and gender help us plan events; gender is always optional. We never see or store your card number — card details are tokenised in your browser and go directly to our payment provider. Order records are kept as long as Thai tax and accounting law requires. If you tick the separate marketing box (always optional, unticked by default) we'll also send you news about upcoming parties — withdraw anytime via the unsubscribe link.
  • Server logs. Like most websites, our host records standard technical logs (e.g. IP address, browser type, pages requested) for security and to keep the site running.
  • Analytics. If you accept analytics cookies, we use Google Analytics 4 to understand how visitors find and use the site — for example pages viewed, approximate location (from your IP address), device and browser, and how you arrived. We use this to improve the site, not to identify you personally or to advertise to you. We also run cookieless, privacy-first analytics — Cloudflare Web Analytics and Ahrefs Web Analytics — which report only anonymous, aggregated figures.

Cookies & consent

On your first visit we ask whether you accept analytics cookies. Nothing is set until you choose:

  • If you accept, Google Analytics 4 sets cookies (named _ga and _ga_<id>) to measure how the site is used. They last up to about two years and you can clear them at any time in your browser.
  • If you decline — or simply ignore the banner — no analytics cookies are set and Google Analytics stores nothing on your device.

You can change your choice at any time: click "Cookie settings" in the footer to reopen the banner, or clear cookies in your browser. We use Google Consent Mode, so analytics storage stays switched off until you opt in.

Cloudflare Web Analytics and Ahrefs Web Analytics are cookieless — they store nothing on your device and need no consent. The only other thing we keep in your browser is your day / night theme preference, in local storage so the site remembers your choice. It stays on your device, isn't sent to us, and isn't personal data.

Why we use your data (legal basis)

We use the data above to respond to your enquiries, to operate and secure the website, to measure and improve it, and to comply with the law. Under Thailand's Personal Data Protection Act (PDPA) and the EU GDPR (where it applies), our lawful bases are: your consent — for analytics cookies; our legitimate interest — to answer enquiries you send us and to run and secure the website; and legal obligation — where the law requires us to keep certain records. You can withdraw analytics consent at any time via "Cookie settings", with no effect on the lawfulness of processing carried out before you withdrew it.

Third parties

We share data only with the service providers that make the site work — currently Cloudflare (content delivery, security and cookieless analytics), Ahrefs (cookieless analytics), Google (Google Analytics, only if you accept analytics cookies, and Google Workspace for our email), Web3Forms (contact-form delivery) and our hosting provider — and only as needed for those services. We never sell your personal data.

For direct ticket sales to our own events, we additionally use: Supabase (our order and ticket database, hosted in Singapore), our payment providers (currently Opn Payments and/or Stripe, who process your payment — your card number goes to them directly and never touches our servers), and Resend (delivery of your QR e-ticket and receipt by email). Each processes your data only as needed to complete your order.

We may also disclose personal data to courts, regulators or law-enforcement authorities where the law requires it, or where necessary to establish or protect our legal rights.

Where we link out to third-party sites — including ticketing platforms such as Megatix and Ticketmelon, venues, or partners — those sites have their own privacy policies that govern any data you give them. We're not responsible for their practices.

International transfers

Several of our providers process data on servers outside Thailand — including Cloudflare (which serves the site from its global network), Google (Analytics and Workspace), Web3Forms and Ahrefs — typically in the United States and the EU. Where data is transferred abroad we rely on your consent (for analytics) and on the providers' own safeguards, such as standard contractual clauses, as permitted under the PDPA and the GDPR.

Data retention

We keep personal data only as long as we need it:

  • Enquiry emails and contact-form messages — up to 24 months after your enquiry is resolved, then deleted (longer only where we must keep records to meet a legal obligation).
  • Server and security logs — a short period, typically up to 90 days, held by our hosting and CDN providers.
  • Google Analytics data — retained according to our Google Analytics data-retention setting (up to 14 months), after which event-level data is deleted and only aggregated statistics remain.

Your rights

Under the PDPA (and the GDPR for visitors in the EU/EEA) you can ask us to access a copy of your personal data, correct, delete or restrict it, object to processing, withdraw consent, or receive the data you gave us in a portable format. To exercise any of these, email [email protected] (or write to us at the address above) and we'll respond as required by law.

You also have the right to complain to a regulator — in Thailand, the Office of the Personal Data Protection Committee (PDPC); in the EU/EEA, your local data protection authority.

Children

This site is intended for adults of legal drinking age and is not directed at children. We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. We'll change the "last updated" date above when we do, and significant changes will be made clear on this page.

Questions about your privacy? Email [email protected]. See also our Terms of Use.