Privacy notice (PDPA)

1. Who is responsible

The data controller is the organiser of BIPAM. Contact for any privacy question or request: contact@bipam.org.

2. What we collect

Order and account: your name, email, phone (optional), language, attendee names you enter, what you bought, order and ticket numbers, check-in times at the door.

Student price: a photo or scan of your student card (JPG, PNG, WebP or PDF), only when you choose a student ticket or pass.

Payment: the payment provider (Pay Solutions / Payso) processes your card or PromptPay payment. We receive the payment result and reference number, never your full card number.

Technical: a one-way code (hash) of your IP address and your browser type at the moment you agree to this notice or make a cookie choice, so we can show when and how consent was given.

Past editions: if you took part in an earlier BIPAM, your contact details from that year may be kept to recognise you as a returning guest.

3. Why we use it (and the legal basis)

To sell, issue and check your tickets and passes, send your tickets, receipts and sign-in links, and handle refunds: performance of our contract with you.

To check that a student price is used by a student: contract, and your explicit consent for the student card image.

To keep accounting and tax records: legal obligation.

To prevent fraud and keep the event safe: our legitimate interest.

To send BIPAM news, invitations and reminders: your consent, which you can withdraw at any time with the unsubscribe link in every email.

4. Student card images

The card image is stored in a private storage area that is not public on the internet. Only authorised BIPAM staff can open it, to approve or reject the student price.

It is deleted automatically 30 days after the last show or pass date in your order. Images uploaded but not used in an order are deleted within 24 hours. We keep only the result (approved or rejected).

If a card cannot be verified, staff may ask for another proof at the door or change the ticket to the regular price.

5. Who we share it with

The payment provider (to take payment), our email provider (to send your emails), and our hosting provider Cloudflare (servers and storage). They process data only on our instructions.

Venue and door staff see your name and ticket at check-in. We do not sell your data.

6. How long we keep it

Order, ticket and receipt records: the festival year plus 5 years for accounting and tax.

Student card images: 30 days after the event (see section 4).

Consent records: as long as the related order record.

News subscription: until you unsubscribe.

Cookie choice records: 2 years.

7. Your rights

You can ask to access or get a copy of your data, correct it, delete it, restrict or object to its use, move it to another organiser, and withdraw consent at any time (this does not affect use made before). Write to contact@bipam.org; we reply within 30 days.

You may also complain to the Personal Data Protection Committee of Thailand (PDPC).

8. Cookies and similar technologies

We use cookies and similar storage in your browser. On your first visit you choose which ones we may use, and you can change your choice at any time with “Cookie settings” at the bottom of every page.

Necessary (always on, the site does not work without them): bipam_cs keeps you signed in (30 days); bipam_lang remembers your language (1 year); bipam_codes remembers discount or access codes you entered (30 days); bipam_consent remembers your cookie choice (1 year). Your browser’s local storage keeps your cart, your last order (so you can go back to it after paying) and which announcements you have already seen. The payment page of Pay Solutions (Payso) uses its own cookies to take your payment.

Statistics (only if you allow it): anonymous counts of how often our announcements are seen and clicked, so we can improve them. No cookie is set for this and no personal data is stored.

We do not use advertising or cross-site tracking cookies. Our pages load fonts from Google Fonts, so your browser connects to Google’s servers, which receive your IP address; no Google cookies are set.

Each cookie choice is recorded (a random code, the choice, the time, a one-way code of your IP address and your browser type) to show when and how you gave or changed consent. These records are deleted after 2 years.

Cookie settings

9. Changes

If this notice changes, the version number above changes. Each order records the version you agreed to.