Privacy Policy

1. Data We Collect

We collect personal data in the following situations:

• Contact form submissions: name, email address, and optionally phone number and a message. These are submitted voluntarily when you use our website contact form.
• Programme enquiries and enrolment: name, email address, and payment-related information (handled by our payment processor — we do not store card details).
• Website usage data: approximate location, browser type, pages visited, and time spent on pages, collected via analytics cookies (subject to your consent).
• Cookies: see Section 5 and our Cookie Policy for full details.

Legal basis (Thailand PDPA): We process enquiry and enrolment data on the basis of contract performance and/or your consent. We process analytics data on the basis of consent given through our cookie preferences tool.

Retention: Contact form data is kept for up to 24 months unless a programme relationship exists, in which case records are kept for the duration of the relationship plus 3 years.

2. How We Use Your Data

• Responding to enquiries sent through our contact form
• Administering programme enrolment and ongoing programme communication
• Sending information about our programmes when you have requested it
• Understanding how the website is used so we can improve it (analytics, with consent)
• Complying with legal obligations under Thai law

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not send unsolicited marketing emails.

3. Third-Party Services

We use the following third-party services, each of which may process data according to their own privacy policies:

• Google Analytics — website traffic analysis (subject to cookie consent). Data may be processed in the United States.
• Payment processor — handles payment card data for programme fees. We do not receive or store card details.
• Email service provider — used to send and receive programme correspondence.

Where data is transferred outside Thailand, we take steps to ensure appropriate safeguards are in place consistent with the PDPA.

4. Data Protection Measures

• Website served over HTTPS with TLS encryption
• Access to personal data restricted to staff with a need to process it
• Passwords and sensitive credentials stored using strong hashing
• Data stored on servers located within the Asia-Pacific region
• In the event of a data breach affecting your rights, we will notify you as required by the PDPA within 72 hours of becoming aware

5. Cookies

We use essential cookies (required for the website to function) and optional analytics and preference cookies (subject to your consent). You can manage your cookie preferences at any time via our Cookie Policy page.

Essential cookies are set without consent as they are strictly necessary. Optional cookies are set only after you give consent through our cookie banner.

6. Your Rights

Under Thailand's Personal Data Protection Act B.E. 2562 (2019), you have the following rights in respect of personal data we hold about you:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate data.
• Right to erasure: Request deletion of your data where there is no overriding reason to retain it.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing carried out on the basis of legitimate interests.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
• Right to complain: Lodge a complaint with Thailand's Personal Data Protection Committee (PDPC) if you believe your rights have not been respected.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. We recommend reading the privacy policy of any external site you visit.

8. Children's Privacy

Our programmes are intended for adults aged 18 and over. We do not knowingly collect personal data from people under 18. If you believe we have received data from a minor, please contact us and we will delete it promptly.

9. Policy Updates

If we make material changes to this policy, we will update the "Last Updated" date at the top of the page and, where appropriate, notify programme participants by email. Continued use of our website or programmes after changes take effect constitutes acceptance of the updated policy.

10. Contact

For any privacy-related question or request: