Privacy Policy
Orbis Gather Platform
1. Introduction
Orbis Gather ("Orbis Gather", "we", "us", "our platform") is a comprehensive fandom platform aggregating artist news, schedules, event seating visualization, and fan club activities. We recognize the paramount importance of your personal data and are fully committed to complying with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) as well as international data protection principles.
This Privacy Policy applies to all user categories across the Orbis Gather ecosystem, including general fandom users, fan club management teams (Fanbases), event organizers, and prospective commercial partners (Agencies/Brands).
2. Definitions
Key terms used throughout this policy are defined as follows:
| Term / Definition | Meaning & Scope |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, directly or indirectly. |
| Anonymized / Aggregated Data | Information that has undergone irreversible processing such that it can no longer be used to identify a specific individual. |
| Data Controller | Orbis Gather, as the entity that determines the purposes and means of the processing of personal data. |
| Data Processor | A third-party service provider that processes personal data on behalf of and under instructions from Orbis Gather. |
| Business Partner | Brands, agencies, event organizers, or commercial organizations utilizing Orbis Gather partner services. |
3. Data We Collect
3.1 Information You Directly Provide
- Account Details: Name, nickname, email address, telephone number, date of birth, gender, profile photo, and password (stored using one-way cryptographic hashing).
- Social Login Data: Basic authentication tokens and public profile metadata from third-party identity providers (e.g., X, Google, LINE).
- User Preferences: Favorite artists, followed fandom tags, province/location preference for nearby event recommendations.
- User Generated Content: Posts, seat pinned comments, support requests, and feedback messages.
3.2 Behavioral & Usage Data
- Artists, news updates, seat charts, and events followed or bookmarked.
- Search queries, likes, cheer battle clicks, and page interaction duration.
- RSVP status, event interest declarations, and notification response logs.
3.3 Technical & Device Data
IP Address, device type, operating system, browser version, unique device identifiers, approximate geographical location (derived from IP or user-permitted GPS for local events), and system access timestamps.
3.4 Cookies & Tracking Technologies
Cookies and local storage data as detailed in our Cookie Policy
3.5 Fanbase, Organizer & Commercial Partner Data
Official fanbase contact information, administrator verification credentials, official published notices, and commercial requirements (such as campaign briefs, venue capacity specifications, and sponsor matching criteria).
4. Purposes & Legal Bases for Data Processing
We process your personal data under the lawful bases prescribed by the PDPA as summarized below:
| Purpose | Example Usage | PDPA Legal Basis |
|---|---|---|
| Account Management & Authentication | User login, registration, authorization verification, password recovery | Contractual Necessity |
| Providing Core Platform Services | Displaying artist profiles, seat maps, event calendars, friend seat locator | Contractual Necessity |
| Notifications & Content Personalization | Pre-event reminders, updates regarding followed artists | Consent / Legitimate Interests |
| Platform Analytics & Performance Optimization | Usage analytics, error monitoring, system optimization, A/B testing | Legitimate Interests |
| Platform Security & Integrity Protection | Preventing score manipulation, bot mitigation, anomalous access detection, cyber defense | Legitimate Interests |
| Marketing & Platform Communications | Newsletters, member privileges, community promotions | Consent (Configurable / Opt-outable anytime) |
| Commercial Services & Business Intelligence | Brand-artist matching, aggregated fan insight analytics, event capacity demand forecasting | Consent / Aggregated Data |
5. Business Intelligence & Commercial Services
Orbis Gather may offer commercial analytical services for business partners, brands, agencies, and event organizers (such as brand-artist matching, aggregated demographic insights, and event capacity forecasting). These services are governed by strict data protection principles:
- No Individual Data Disclosed: We will never disclose individual personal data (such as name, phone number, email) to business partners without your prior explicit consent.
- Aggregated & Anonymized Only: Data utilized in these services is presented strictly in aggregated, anonymous formats (e.g., "X% of Artist A’s fanbase are aged 18–24 and interested in fashion").
- Explicit Consent for Special Programs: If a future feature requires identifiable data (e.g., selecting fans for exclusive brand campaigns), specific consent will be requested at that time. Declining will not affect standard platform features.
- Opt-Out Rights: You have the right to exclude your data from being calculated in commercial insights at any time via Account Privacy Settings.
6. Data Disclosure & Sharing
We only share personal data with third parties to the extent necessary and under strict confidentiality agreements:
- Data Processors: Cloud hosting providers, analytics platforms, messaging/email gateways, and payment service providers bound by Data Processing Agreements (DPA).
- Fanbases / Organizers: Only data you deliberately choose to share when joining official community projects or RSVPing to fan events.
- Legal Authorities: When mandated by statutory warrants, court orders, or lawful legal processes.
- Mergers & Acquisitions: Data may be transferred as part of business assets with advance notification provided to users.
7. International Data Transfers
Where our third-party infrastructure providers operate servers located outside Thailand (e.g., global cloud platforms), we verify that destination jurisdictions ensure adequate data protection standards or that appropriate safeguards (such as Standard Contractual Clauses) are executed in compliance with PDPA requirements.
8. Data Retention Period
We retain personal data only for as long as necessary to fulfill the stated purposes or comply with statutory requirements:
| Data Category | Retention Period | Legal / Operational Basis |
|---|---|---|
| User Account Data | Throughout active account tenure, and up to 5 years following account closure | Retained strictly for statutory compliance and dispute resolution |
| Behavioral & Usage Data | Up to 2 years, or until converted into anonymized aggregated metrics | Once anonymized, data cannot be linked back to any individual identity |
| Security & Access Logs | Not less than 90 days, and up to 2 years | In compliance with the Computer Crimes Act and cybersecurity regulations |
| Cookies & Tracking Data | As specified in the Cookie Policy | Session up to 2 years depending on cookie category |
Upon expiration of the retention periods, we securely delete or permanently anonymize your data.
9. Security Measures
- Data encryption in transit using Transport Layer Security (TLS/SSL) and encryption at rest for sensitive records.
- Role-Based Access Control (RBAC) limiting data access solely to authorized personnel on a need-to-know basis.
- Comprehensive security audit logging and continuous vulnerability assessments.
- Regular employee and developer data privacy training.
- Incident Response & Data Breach Notification procedures compliant with PDPA regulatory timelines.
10. Data Subject Rights
Under Thailand’s PDPA, you are entitled to exercise the following statutory rights regarding your personal data:
Right to Access
Request a copy of your personal data held by us.
Right to Rectification
Ensure your data is accurate, complete, and up to date.
Right to Erasure
Request deletion when data is no longer necessary.
Right to Restrict Processing
Temporarily restrict processing during verification.
Right to Object
Object to direct marketing or commercial data analysis.
Right to Data Portability
Obtain your data in machine-readable format.
Right to Withdraw Consent
Withdraw previously given consent at any time without affecting prior lawful processing.
You may exercise your rights via Account Settings or by emailing our Data Protection team. We will review and fulfill valid requests within the statutory 30-day window.
12. Children & Minors’ Data
Orbis Gather does not knowingly collect personal data from children under 13 years of age (or minors without parental consent as required by applicable laws). If we discover that a minor’s personal information has been registered without verified parental consent, we will take immediate steps to delete such records.
Parents or legal guardians who become aware that a child has provided us with personal data may contact us directly to request immediate removal.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to accommodate service expansions and statutory amendments. Significant revisions (such as introducing new commercial data models) will be proactively notified via email or prominent platform announcements.
14. Contact Channels & Regulatory Complaints
If you have questions, inquiries, or wish to exercise your data subject rights, please contact our Data Protection Team at:
You also have the statutory right to submit a complaint to the Office of the Personal Data Protection Commission (PDPC Thailand) if you believe our data processing fails to meet PDPA standards.