Thailand (ประเทศไทย) - International privacy rights
If the law where you live provides additional rights, identify them in your request.
Personal Data Protection Committee (PDPC)PDPC/GPPC contact informationPDPC Data Protection Officer portalData and content requestsLegal noticeประเทศไทยThailand (ประเทศไทย)PrivacyTermsDelete dataSupportInternational privacy rightsLegal noticeOpen app
Controller, purposes and optional processing
Alexander Goytom, established in Italy, is the personal data controller and can be contacted at ertalex@hotmail.it. Public controller address for the Thailand notice: Via delle Sequoie 38, 00172 Roma, Italy. The Thailand offer falls within Section 5 of the Personal Data Protection Act because NerdScore intentionally offers the service to people in Thailand. The Privacy Policy describes the profile, group, game, match, media and technical-security data used for the requested Free features, together with purposes, necessity, consequences of refusal, recipients and retention.
Core data is processed to provide the service requested and limited security data is processed to protect the service. Photos, notes, taunts and Firebase Analytics are optional. Analytics remains off until separate, unbundled consent and can be refused or withdrawn without losing core features. NerdScore does not require sensitive data, use photos for biometric recognition, sell personal data, show advertising or make decisions with legal or similarly significant effects.
Thai representative and Data Protection Officer assessment
The documented Section 38 assessment concludes that the current Free service is not required to appoint a representative in Thailand: the controller is not a public authority, NerdScore does not intentionally process Section 26 sensitive data and the processing is not large scale under Section 41(2). The controller remains directly reachable through the contact and rights routes on this page.
A Data Protection Officer is not required on the current facts because NerdScore is not a public authority, does not carry out large-scale regular monitoring and does not have large-scale sensitive-data processing as a core activity. Both conclusions are reviewed at least annually and before material user growth, sensitive data, systematic monitoring, precise location, public groups, Plus, Ads or another substantial change.
Hosting and transfers outside Thailand
Core profile, group, game, match, media, security-log and backup data is sent over encrypted connections to OVHcloud in Frankfurt, Germany for hosting, security, backup and support. Google/Firebase may receive limited app, device and attestation data for App Check or Play Integrity and, only after consent, an app-install identifier, limited events and an approximate region for Analytics.
The transfer register records each recipient, country, data category, purpose, retention period, contract and security measure. Necessary German hosting and integrity processing support performance of the service requested and are covered by processor contracts and enforceable safeguards; optional Analytics can be refused. NerdScore does not rely on a claim that Thailand has declared every destination adequate. A new provider, destination, purpose or change to PDPC transfer rules reopens the assessment before release.
PDPA rights and response time
A person in Thailand may request access and a copy, data portability where applicable, correction, deletion or anonymization, restriction, objection and withdrawal of optional consent. Use Support, the in-app export and deletion tools, or email ertalex@hotmail.it. A complete access request is handled without delay and normally no later than 30 days, with proportionate identity verification and a recorded explanation for any lawful restriction or refusal.
Withdrawal is as easy as giving consent and does not affect earlier lawful processing. Corrections and deletions are propagated to active records, while backups expire through the documented rotation and legal holds remain limited and recorded. A person may also contact the Thai PDPC through the official links below.
Personal-data breach procedure
A suspected loss, unauthorized disclosure, alteration or access is recorded and assessed immediately. Where notification is required, NerdScore notifies the Thai PDPC without delay and, where feasible, within 72 hours after becoming aware of the breach. Affected people are notified without delay when the breach is likely to result in a high risk to their rights and freedoms.
The incident record preserves the known data categories, affected people, timing, cause, consequences, containment, mitigation, communications and reasons for notifying or not notifying. Preliminary information is supplemented as the investigation develops, and lawful preservation is separated from ordinary product data.
Minimum age and guardian permission
NerdScore is not directed to children under 16 and does not accept them into the service. The special Thai rule requiring parental consent for a child under ten therefore cannot be used as a route around the 16+ product limit. A person below local civil majority must declare that a parent or legal guardian has read the Terms and permitted use of the current free service.
The versioned 16+ and guardian-permission declaration is recorded with the selected legal market but is not described as identity or age verification. The assessment reopens before lowering the target age, introducing payment or subscriptions, advertising, prizes, public groups or processing specifically directed at children.
Computer traffic data and lawful orders
For the Thailand market, NerdScore retains a separate minimal computer-traffic record for at least 90 days. It contains route templates rather than user-entered paths, time, client address, limited device or app information, distribution and pseudonymous account references. It excludes PINs, tokens, request bodies, photos, notes, taunts and other user content, and each record is protected by an HMAC integrity value.
Access is limited to authorized administration. The record is used only for security, legal compliance and a valid authority or court order, and is deleted after the applicable period unless a specific lawful preservation order applies. Content blocking or removal requests are handled through the formal notice, evidence-preservation, reasoned-decision and review workflow.
Platform, consumer, location and private-group scope
NerdScore records scores for physical tabletop games inside invited private groups. It does not connect sellers and buyers, host third-party offers, mediate transactions, take orders or process payments. It is therefore outside the current ETDA Royal Decree definition of a digital platform service on the documented facts. Marketplace, booking, payment or other transaction-intermediation features reopen that assessment before development.
The current release is free, with no billing, advertising, wager, prize or in-app purchase. NerdScore does not request GPS or native location permission; optional Analytics may derive only an approximate region from a masked IP address, and NerdScore does not receive coordinates or provide a location-based feature. Reports, legal notices, removal, preserved evidence and review remain available for private-group user content.
Your rights
You may request access, a machine-readable export, correction, deletion, restriction or portability, and may object where processing relies on legitimate interests. Write to ertalex@hotmail.it; identity checks may be required to protect other users.
You may withdraw analytics consent in the app at any time. You may also complain to your local supervisory authority; in Italy this is the Garante per la protezione dei dati personali.
International privacy rights
We provide every user, regardless of country, a way to request access, a copy, correction, and deletion of their data. We do not discriminate against anyone who exercises a privacy right, and we do not sell or share personal data for money or targeted behavioral advertising.
Changing NerdScore's language changes only the translation you read. It does not change your country, the law that applies, the competent authority, or any mandatory rights you have where you live.
Data controller
The data controller is Alexander Goytom. For privacy, access, export, correction, deletion or removal requests, write to ertalex@hotmail.it.
NerdScore is a scorekeeping service for private board game groups. It does not require an email account and does not sell personal data.