Effective from 1 October 2026

Privacy policy

CMU Racing Team club, Chiang Mai University ("the club" or "we") cares about your personal data. This policy explains what we collect, what we use it for, who we share it with, how long we keep it and what rights you have under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA)

1. Data controller and contact

CMU Racing Team club, Chiang Mai University
Faculty of Engineering, 239 Huay Kaew Rd., Suthep, Mueang, Chiang Mai 50200, Thailand

Personal data contact: cmuracingteam@cmuracing.com

2. Personal data we collect

When	Data
Visiting the website (not logged in)	When you choose "Accept" on the recording notice: the pages you open, the time, your IP address, the kind of device / browser and a random visitor id (not who you are) · If you decline or have not answered: only the page and the time, with no IP, device or any id tied to you · IP addresses are still used briefly in memory against attacks (up to 1 hour) · requests that probe the website for weaknesses (e.g. looking for /.env or a wp-admin page that does not exist) are recorded with their IP for 90 days, for security
Creating an account	Full name, email, phone (if given), password (only a one-way hash is stored; we never see your password), the time you acknowledged this policy
Apply for club membership	Student ID, faculty, department and your introduction
Ordering merchandise	Items, amounts, delivery address, order status
Pay	Transfer slip pictures and data from the slip: sender name, partial account number (some digits hidden), bank, transfer time, amount and transaction reference
Using the members' area / project team	Documents you upload, tasks assigned to you and their progress, finance entries and receipts you record
Chat (club members)	The messages, pictures and files you send, when, in which room, the groups you are in, and the last message you have read in each room (senders see "Read") · a one-to-one chat is seen only by its two people, and a group members make only by its members admins do not see it, except a message someone reports with 🚩 (that message only) · project, department and club rooms are seen by their members and the admins
Using the website while signed in	Every page you open, with the time, your IP address, the kind of device / browser and whether it was the installed app · your last visit (not the files you download, what you search for, or codes / secret links in addresses)
Data changes by administrators	Change log (who changed what, when, and the details)

3. Purposes and legal bases

Purpose	Legal basis (PDPA)
Creating and maintaining accounts, verifying email, recovering passwords	Performance of a contract (s. 24(3))
Selling merchandise, taking payment, checking slips, delivery, contacting you about orders	Performance of a contract (s. 24(3))
Checking student status before accepting members, and running club activities	Legitimate interests (s. 24(5))
Keeping income and expense accounts and proof of payment	Legitimate interests and related legal duties (s. 24(5), 24(6))
How members use the website (pages opened, last visit, app, notifications, task updates, club-room visits) to help follow up the club’s work, keep it secure and improve the website — seen only by admins who manage users	Legitimate interests (s. 24(5))
Page-view statistics of people who are not signed in (pages, IP, device)	Consent (s. 19) — withdraw any time by clearing your browser cookies and choosing "Decline"
Preventing attacks and fraud, and auditing data changes	Legitimate interests (s. 24(5))

We don't use your data for advertising, don't sell it, don't pass it on for others' marketing, and don't collect sensitive data under section 26

Within the club — administrators access data as their duties require · the project team sees project tasks and finances · club members see name, faculty, department and level of other members on the member list
Slip verification (SlipOK) — slip pictures and amounts are checked against bank data to confirm payment and catch fake or reused slips
Email delivery — your email and name, to send verification codes, password links and order updates
Server hosting — all of the website's data is stored on a server we rent
Google Drive — files members upload to the document library are kept in the club's Google Drive account, not shared, and reachable only through the website according to permissions
Delivery services — name, address and phone, to deliver orders
Government authorities — when required by law or a lawful order

The services above process data only on our instructions and only as far as needed

5. Transfers abroad

Some server or email providers may store data outside Thailand. We choose providers with adequate personal data protection under sections 28 and 29 of the PDPA

6. Retention periods

Data	Period
Account and member data	For as long as you have an account — deleted when you delete it
Email codes / password links / logins	15 minutes / 30 minutes / 8 hours
Orders, delivery addresses, slips and slip-check data	5 years from the order date (as accounting records), then the address, slip and slip-check data are deleted automatically; only the items and amounts are kept for the club's statistics
Change log	5 years, then deleted automatically
Page views (pages, time, IP, device)	90 days, then deleted automatically · deleted at once when you delete your account · included in "Download my data"
Chat messages, pictures and files	Until the sender deletes them or the group's owner deletes the group · pictures are made smaller and their camera/location data removed before they are kept (a deleted message shows "Message deleted") · all deleted at once when the sender deletes their account · a copy of the messages you sent is in "Download my data"
Documents in the members' library	Until the uploader or an administrator deletes them (club documents)
Backups	Up to 14 days — deleted data may remain in backups until they expire

7. Cookies

The website uses only necessary cookies and its own preference cookies: a session cookie needed to sign in, for the cart and against forged requests (CSRF); it expires within 8 hours (or 30 days if you chose to stay signed in) — cookies that remember yourtheme, language and whether you opened the installed app anda cookie with your answer about recording page views (if you accept, also a random visitor id, kept 1 year; clear your browser cookies to remove it). We use no advertising cookies and no third-party tracking or analytics tools, and fonts are loaded from our own server, so no data about your visits goes to other companies

8. Security measures

HTTPS connections · one-way password hashing (bcrypt) · access limited by user level · slips and documents stored outside public areas and opened only by those allowed · limits on failed logins · a log of data changes by administrators · regular backups. If a data breach puts your rights at risk, we will notify the PDPC office within 72 hours and notify you without delay as the law requires

9. Your rights

Right of access and to a copy / data portability — log in and download it from the My account page
Right to rectification — change your name and phone yourself inthe My account page for other data, contact us
Right to erasure — delete your account yourself inthe My account page Personal data is deleted at once, except order data that must be kept as accounting records under section 6, which is no longer linked to you
Right to object and to restrict processing — contact us as in section 1
Right to complain — with the Personal Data Protection Committee office (PDPC) www.pdpc.or.th

We answer requests within 30 days of receiving them and may ask for information to confirm your identity first

10. Minors

If you are under 20 and not legally of age, please have a parent or guardian acknowledge this policy before creating an account or ordering

11. Changes to this policy

We may update this policy from time to time and show the effective date above. For important changes we will announce them on the website or by email