20studio Records
Effective 24 August 2026 · Version 3
The short version: this site barely collects anything. Write to us and we keep your message so we can reply. Leave your email for a release alert and we keep it just long enough to send that one note. Say yes to cookies and Google counts you as a visitor. That is the whole story — the rest of this page is the same thing in more detail.
One boundary first: this page is about 20studiorecords.com only. Spotify, Apple Music, TIDAL and the rest collect data under their own policies when you listen there — that part is between you and them.
The person responsible for your data here is Tharin Karnjanapong (ธรินทร์ กาญจนพงษ์), who runs 20studio Records — an independent label in Bangkok. "20studio Records" is the label's trading name, not a registered company.
You can find us at 49/49 Soi Vibhavadi Rangsit 64, Yaek 19, Vibhavadi Rangsit Road, Talat Bang Khen, Lak Si, Bangkok 10210, Thailand — and for anything about your data, the direct line is privacy@20studiorecords.com.
Thailand's data-protection law (the PDPA) is the law behind this page, so the table names the legal ground for each item — but the plain reading is the middle two columns: what it is for, and when it is gone.
| What | What it is for | Legal ground (PDPA) | When it is gone |
|---|---|---|---|
| Name, email, subject and message from the contact form | So we can read your note and write back | Taking steps at your request; our legitimate interest in running the label | 24 months after your last message |
| The IP address and time recorded with that message | Spotting abuse of the form | Legitimate interest in keeping our systems safe | Same 24 months, kept with the message |
| Standard web-server logs — IP, time, page, browser, referrer | Keeping the site up and secure | Legitimate interest; legal obligation | Two months at most: logs archive daily, and last month's archives are deleted at each month's end. No other copy exists |
| The email you leave on an artist page for a release alert | One email when that release is out — that is all it is ever used for | Your consent — the line right beside the button | Deleted once the alert is sent; if the release is cancelled, deleted with it |
| Cookie identifiers and usage data (next section) | Understanding who visits the site | Your consent | Event data: 2 months. Visitor-level data: 14 months from your last visit |
Nothing here is required of you. Skip the forms and decline the cookies and the site works exactly the same.
We do not sell personal data, and there are no social-media pixels here. The analytics data sits with Google, which may also use it for its own advertising — that is Google's nature, and it is exactly why the cookies only run if you say yes. Decline, and nothing goes to Google at all.
The site needs no cookies to work, so there are no "strictly necessary" ones. There are exactly two, both from Google Analytics 4, and both only after you agree:
| Cookie | What it does | How long it lives |
|---|---|---|
_ga | Tells one browser apart from another | about 13 months |
_ga_G258J70DJ1 | Keeps the analytics session together | about 13 months |
When the analytics script loads, your IP address and browser details reach Google too.
Changed your mind? The cookie-settings link at the bottom of every page reopens the choice — declining switches the cookies off and deletes them. The change works from that moment on; it can't rewind counting that already happened while you had said yes.
One honest technical note. Your answer to the cookie banner is remembered in your own browser's local storage, under the key 20sr.consent. It holds the answer, a format version and the date — nothing that identifies you — and it never leaves your device. It stays until you clear this site's data, and its only job is making sure we don't nag you with the banner twice.
Two companies help run this site, and that is the entire list:
| Who | What reaches them | Why |
|---|---|---|
| Namecheap, Inc., 4600 E Washington St, Suite 300, Phoenix, AZ 85034, United States | Server logs; contact emails in transit and in the mailbox | They host the site and the mailbox |
| Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | Analytics data and IP address — only if you said yes | They run the analytics |
Beyond those two, we pass data to no one, except where the law requires it.
The server lives in Los Angeles and both companies above are American, so what little we hold is stored and processed outside Thailand. What protects it there is those providers' own data-protection commitments — Namecheap's policy commits to standard contractual clauses for transfers, and Google Analytics runs under Google's data-processing terms. And as always: decline the cookies and Google gets nothing.
The PDPA gives you proper rights over anything we hold about you. Ask what we have and get a copy. Have it corrected. Have it deleted or anonymised. Have its use paused. Take it with you. Object to the things we do on the "legitimate interest" ground. And withdraw consent whenever you like.
Just write to privacy@20studiorecords.com — a plain email is enough, no form needed. We answer within 30 days. We may first verify your identity before acting.
The site runs over HTTPS, everything the forms accept is checked and size-limited, submissions are rate-limited, and the mailbox is only in the hands that need it. No system is perfectly secure.
This site isn't aimed at children, and we don't knowingly keep personal data from anyone under 20 — the age of majority in Thailand. Where the PDPA wants a parent or guardian's consent for a minor, that is whose consent counts. If you think a minor has sent us something, tell us and it's gone.
When this page changes, the date at the top changes with it.
Back to the site