Privacy Policy

1. Data controller

บริษัท โคราชแบทเทิล จำกัด

Address: 179/90 ซอยมิตรภาพ 4 ตำบลในเมือง อำเภอเมืองนครราชสีมา จังหวัดนครราชสีมา 30000

Email: [email protected]

2. What we collect, and why

Ordinary browsing — you can read about places, stays, restaurants, routes and the map without telling us who you are. We do not ask you to register in order to read.

Your account — the email address and name you give us, used to sign you in and to send you a sign-in link. We do not give you a password to remember and we store none.

Orders — recipient name, delivery address, phone number, the items ordered and proof of payment, so we can deliver goods and keep accounting records.

Event and competition entries — team name; each member's name, stage name, date of birth and role; the coordinator's name and phone number; and proof of the entry fee transfer. Used to run the draw, check age categories, produce passes, prepare the accident-insurance list, and reach you when something changes.

Team leader's proof of identity — only for categories that require it. An identity card can show sensitive data such as religion, so we ask you to cover fields we do not need before taking the photo, and we ask for consent to this document separately from the terms.

Problem reports — your email, your name if you give it, the topic, what you wrote, and the conversation with our staff, kept so we can answer and follow up.

Apps you have allowed — when you sign in to another app with VisitKorat ID we record which app, what it received, which version of its documents you agreed to, when, and when you withdrew.

Service logs — ordinary operational records such as request times and request identifiers, kept for security and troubleshooting. Full email addresses and authentication codes are never written into them.

3. Minors

Some competition categories are open to entrants under 20, which is why we collect every member's date of birth: to place them in the right category.

The team coordinator confirms that a parent or guardian has consented before they enter a minor's details into the system.

A parent or guardian may access, correct or withdraw a child's data under section 7.

4. Our legal bases

Consent for event and competition entry, and for sharing your data with another app under section 6.

Explicit consent for proof-of-identity documents that may carry sensitive data under section 26 of the Act.

Performance of a contract for your account, orders and delivery.

Legitimate interest for answering and following up problems you report, keeping the service secure, and preventing abuse.

Legal obligation for accounting and tax records.

5. How long we keep it

Account data for as long as the account is in use. You can delete the account yourself from your account page (section 7).

Orders and payment records for at least five years, as accounting and tax law requires.

Entry records for as long as they are needed to cite that edition's results and handle complaints about it. They are not deleted automatically on a fixed date: we review them after each edition and delete or anonymise them once they are no longer needed. You may ask us to delete yours sooner at any time under section 7, and they are deleted with your account when you delete it.

Proof-of-payment files and identity documents are held in closed storage, separate from ordinary files, and deleted together with the entry they belong to — on request, when you delete your account, or at the review after the event.

Problem reports for two years from the date the report was resolved or closed, then deleted automatically. A report still in progress is not deleted. If you delete your account sooner, your reports — including those made from the same email address without signing in — are deleted with it.

Records of calls made to our Partner API for 90 days from the call, then deleted automatically.

Consent records for as long as we may need to show that consent was properly obtained.

6. Who we share it with

Apps and sites you choose to sign in to with VisitKorat ID (for example the event registration forms on join.visitkorat.com) — we send only what the consent screen lists: your email address, and your display name if the app asks for it, with a random identifier that is not your account number, and only after you have agreed. We do not send your order history, delivery address or phone number. You can withdraw at any time from “Connected apps” in your account; the app can then no longer obtain your data from us, and what it received before is governed by its own policy.

Service providers we need to operate — cloud hosting, email delivery, maps, banks and payment services, and delivery couriers. All of them process data only on our instructions.

The organiser and auditor of an event you enter — only what is needed to run the competition.

Government authorities — where the law requires disclosure.

We do not sell your personal data, and we do not pass it to others for their own marketing.

7. Your rights

You may request access to and a copy of your data, ask us to correct it, delete it, restrict its use, object to processing, ask for it to be ported, and withdraw a consent you previously gave.

Withdrawing consent does not affect processing already carried out lawfully, and in some cases it will end a service — withdrawing consent for a competition entry means we cannot keep that entry.

Some of these you can exercise yourself, straight away, from your account page: download a copy of your data, correct your display name, delete your account, and withdraw what you allowed another app.

Correcting your display name is your right to have your data corrected under section 35 of the Act. The corrected name is the one we send to apps you have allowed to receive your display name, from the next time that app asks us for your data.

For anything else, or anything you cannot do yourself, write to [email protected]. We reply within 30 days.

If you believe we have got something wrong, you may complain to the Personal Data Protection Committee's office.

8. Security

Data travels over encrypted connections, staff passwords are stored one-way, and access is limited to what each role needs.

Proof-of-payment files are kept in closed storage that cannot be read from outside, and are never rendered on a page that does not require signing in.

9. Cookies

We use only the cookies the site needs to work: one that remembers you are signed in, one that remembers your basket, and one that protects against forged requests.

You can clear cookies in your browser, but clearing the sign-in cookie will sign you out.

10. Changes to this policy

When we change this policy in a way that affects what you agreed to, we change the document's version number and ask for your consent again the next time you use the service concerned.

The current version is 2026-09-28, effective 28 September 2026.