Privacy policy
Last updated: ⟦date certified by the club⟧
1. Data controller
The data controller is the club ("the club"), whose legal name, address and contact details appear at the end of this page.
Use any of those channels for privacy matters, and say that your message concerns personal data.
2. What we collect, and when
Items about Fan ID, ticket purchases and stadium entry apply once the club switches those systems on at this site (nothing is collected before that).
| When you | We collect |
|---|---|
| Browse the site | Your chosen language · anonymous visit statistics (pages viewed · device type · country) once statistics are enabled |
| Request a one-time code or sign in | A one-way hash of your IP address (to count attempts and prevent abuse) · time and result of the request |
| Create a Fan ID | Mobile number · display name · PIN (stored as a one-way hash, never readable) |
| Buy tickets | Ticket, zone, match and price · time of purchase · payment status · the payment provider's reference |
| Enter the stadium | Scan time · gate |
| Buy a season ticket | The above + ⟦shirt size / delivery details, if any⟧ |
| Contact us | The message and the channel you used |
We do not collect national ID numbers, card or bank details (the payment provider receives those directly), or your device location.
3. Why (legal basis)
- Issuing and checking tickets · recognising you when you sign in — contract
- Telling you about postponed, cancelled or relocated matches · refunds — contract
- Preventing duplicate, forged or multi-account use — legitimate interest
- Sales and tax records required by law — legal obligation
- Improving the site from aggregate statistics — legitimate interest (not identifying anyone)
- News and promotions — only with your consent, withdrawable at any time
4. Who receives data
| Recipient | Data | Why |
|---|---|---|
| Opn Payments (Thailand) | Amount · order reference | Payments and refunds |
| ⟦SMS provider⟧ | Mobile number | Sending one-time codes |
| Gate staff | The result of scanning your ticket (the QR code carries no personal data) | Checking tickets |
| ⟦Partner shops, if discount benefits are enabled⟧ | Whether a ticket is valid (yes/no) | Granting a discount |
| Public authorities | As required by law | — |
We do not sell your data · We do not transfer it abroad ⟦confirm once the SMS provider is chosen⟧
5. How long
- Fan ID account: until you ask for deletion, or after ⟦3⟧ years without use
- Ticket and payment history: ⟦5⟧ years under accounting and tax law
- Stadium entry records: ⟦1 season⟧
- One-time codes: the code itself is never stored (only a one-way hash, expiring within ⟦5⟧ minutes) · the request record (number · time · hashed IP) is kept ⟦30⟧ days to count attempts
- Site statistics: aggregate only, kept indefinitely
6. Your rights
Access · correction · deletion · a copy · withdrawing consent · objection · complaint
Send requests through the contact details at the end of this page, saying that your request concerns personal data; we answer within 30 days · Deleting your account does not delete purchase records the law requires us to keep
You may complain to the Personal Data Protection Committee (PDPC) of Thailand.
7. Cookies and statistics
- Required cookies — the site cannot work without them:
adonis-sessionand its companion session-data cookie (random name · 2 hours) ·XSRF-TOKEN(CSRF protection) ·uttd-cookie-notice(remembers that you closed the cookie notice · 1 year) · once Fan ID is enabled:uttd-fan(sign-in · 30 days) and the cookie that remembers a device verified by SMS (90 days) - Statistics (once enabled): Umami, self-hosted on the club's own server, no cookies, nothing shared with third parties
- No advertising or cross-site tracking cookies · Embedded YouTube videos use nocookie mode and load the player only when you press play; once playing, YouTube may set its own cookies under YouTube's policy
- Adverts on the site are static images from club partners, with no tracking
8. Security
HTTPS everywhere · PIN and one-time codes stored only as one-way hashes · digitally signed tickets · staff access limited by role, and staff edits are recorded
9. Minors
People under 20 may create a Fan ID to buy tickets ⟦club decides: is parental consent required?⟧
10. Changes
When this policy changes we update the date above and announce material changes on the site.