Privacy Notice

2. Who Has the Right to Process Your Personal Data

Since we have the role and responsibility in determining the purposes and means of the processing of your personal data in accordance with the PDPA, we shall act as the data controller for your personal data.

3. What Personal Data We Collect

General Personal Data

In Case of Students

We collect the following categories and types of personal data of students, including but not limited to:

a) identity data, such as full name, nickname, signature, birth certificate, national ID number, copy of national ID card, passport number, copy of passport, visa, School ID number, School ID card, educational program’s ID, photograph, video clip;

b) profile data, such as gender, date of birth, age, nationality, native language, height, weight;

c) educational details, such as current year level, class, tutor group, previous school attended, academic performance, disciplinary records, progress information;

d) contact details, such as home address, telephone number, personal email account, School’s email account;

e) property data, such as house registration, house location map; and

f) book borrowing records, such as overdue information, non-returning information.

In case of Parents or Guardians and Related Persons

We collect the following categories and types of personal data of parents or guardians and related persons, including but not limited to:

a) identity data, such as full name, nickname, signature, national ID number, copy of ID card, passport number, School ID card for parents, copy of passport, visa, photograph;

b) profile data, such as date of birth, gender, nationality, details on relationship with the student, marital status, marriage certificate;

c) employment data, such as occupation details, physician license number;

d) financial data, such as bank account, bankbook, income;

e) property data, such as house registration, house location map; and

f) contact details, such as telephone number, address of workplace, home address, email account, fax number.

Sensitive Data

Apart from the personal data specified above, we may process the following sensitive data of students:

a) health data, including disability details, congenital disorder, allergy, dietary needs, medications, medical records, medical condition, medical certificate, medical receipt, medical report, laboratory test result, diagnostic, vaccination records, family history of inheritable disease, special education needs, injury information;

b) religious belief; and

c) racial origin.

4. How We Collect Your Personal Data

In Case of Students

We generally indirectly collect students’ personal data through parents or guardians, and thirdparties. However, in some circumstances, we may directly collect students’ personal data.

In Case of Parents or Guardians

We generally directly collect parents or guardians’ personal data in order to carry out all the processing purposes specified in this Privacy Notice.

In Case of Related Persons

For the case of other related persons, we indirectly collect related persons’ personal data through parents or guardians.

5. How We Use Your Personal Data

In Case of Students

We use students’ personal data to carry out tasks as per our scope and purposes of providing groups of activities, including but not limited to:

a) administering student's enrolment;

b) asking for consent to process personal data;

c) making contact;

d) issuing School’s ID card;

e) creating account and storing personal data on the School's information systems and other educational online platforms;

f) supporting the provision of facilities and services, such as school bus service, IT service, catering service, library service;

g) publishing online advertisement;

h) offering gifts and discounts;

i) auditing and making financial reports;

j) providing pastoral care, health care services and safety;

k) processing insurance claims;

l) supporting teaching, learning and students' special educational needs;

m) providing educational documents and certificates;

n) evaluating learning performance and enabling external examination registration for students;

o) arranging School’s events and trips;

p) collecting payments and fees;

q) reporting students' progress, attainment and incidents;

r) creating School's yearbook;

s) applying for visa;

t) applying for universities and scholarships;

u) complying with applicable laws and regulations; and

v) making or defending against legal claims.

In Case of Parents or Guardians and Related Persons

We use parents or guardians and related persons’ personal data to carry out tasks per our scope and purposes of providing groups of activities, including but not limited to:

a) administering student's enrolment;

b) making contact regarding School's related matters and in case of emergency;

c) asking for consent and approval to process own personal data and/or students personal data, and to enable participation of students regarding School's activities;

d) issuing School’s ID card for parents to pick up students from School;

e) supporting the provision of facilities and services, such as school bus service, IT service, library service;

f) creating account and storing personal data on the School's systems and other educational online platforms;

g) arranging School’s events and trips;

h) collecting payments and fees;

i) auditing and making financial reports;

j) reporting students' progress, attainment and incidents;

k) providing pastoral care, health care services and safety;

l) processing insurance claims; and

m) complying with applicable laws and regulations.

n) making or defending against legal claims.

We rely on the following legal bases and certain special conditions to process your personal data. Not all of your personal data will apply to every legal basis and certain special conditions stated below, and may be based upon one single or a combination of several legal bases.

(1) Contractual Basis

We are obligated to process your personal data to carry out the responsibilities committed according to enrolment contract. These required personal data make up most of the data stated in Clause 3. In the case where you withhold any of your personal data in respect to the specified purpose, we may not be able to meet our obligations under enrolment contract with you. For example, we may not be able to administer your enrolment and provide our service to you.

(2) Legitimate Interests

In specific situations, we require your personal data to achieve our or any third parties’ legitimate interests,such as making contact with you or offering you discounts or PR and marketing the School provided that your interests and fundamental rights and freedoms are not overridden by those interests.

(3) Legal Obligations

We are obligated to process your personal data according to any of our legal obligations, including but not limited to providing your personal data to the Ministry of Education and other relevant governmental bodies. In the case where you withhold any of your personal data in respect of this specified purpose, there might be consequences under relevant laws.

(4) Necessity for the Establishment, Compliance, Exercise or Defense of Legal Claims

In specific situations, we hold the rights to process your sensitive data in order to fulfill our necessity for establishment, compliance, exercise or defense of legal claims.

(5) Consent

In Case of Students

In limited circumstances, we require consent or explicit consent of students and/or parents or guardians to process students’ personal data and/or sensitive data.

6. Who We Will Share Your Personal Data with

In order to perform our contractual and other legal responsibilities or purposes, we may be required to disclose your personal data to external third-party organisations. These organisations may include:

a) parents or guardians;

b) association institutions, such as British Chamber of Commerce;

c) governmental bodies, such as the Ministry of Education, Office of the Private Education Commission, Immigration Office, Thai Embassies in relevant countries;

d) our service providers, such as printing companies, external trip operators, health care service providers, catering service providers, school bus service providers, photography service providers, cloud service providers, educational service providers;

e) prospect universities;

f) educational assessment institutions;

g) insurance companies;

h) legal consultants; and

i) external auditors.

For the case where your personal data is being disclosed to any of the external third-party organisations, we will ensure that the minimum amount of personal data will be disclosed. Also, all third-party service providers that process your personal data on behalf of us will be required to process your personal data within the scope and purposes specified in this Privacy Notice, and to put in place appropriate security measures in order to protect your personal data to the extent required by law.

7. Transferring Personal Data to Foreign Countries

For the purposes mentioned in this Privacy Notice, we may disclose or transfer your personal data to third parties or servers located in another country which may or may not have the same data protection standards as Thailand’s. In addition, we have taken steps and measures to ensure that your personal data is securely transferred, that the data recipients have suitable data protection standards in place, and that the transfer is in compliance with the PDPA.

8. Security Measures for Personal Data Protection

We have implemented technical and organisational measures to provide protection against loss, misuse, unauthorized access, disclosure and modification of your personal data. External third-party organisations are also required to carry out the processing of your personal data in accordance with our security policy.

9. How Long Do We Keep Your Personal Data

We will retain your personal data for as long as it is reasonably necessary to fulfill our scope and proposes set out in this Privacy Notice, and to establish, exercise or defense the legal claims. However, we may have to retain your personal data for a longer duration, if required by any applicable law.

10. Your Personal Data Rights

Subject to applicable laws and exceptions thereof, your personal data rights include:

a) Right to withdraw consent – where your consent and/or explicit consent has been obtained, you are entitled to withdraw such consent and/or explicit consent by submitting the consent withdrawal form to us;

b) Right of access – you may have the right to request a copy of all your personal data we are processing about you;

c) Right to data portability – for the case where we have an automated platform allowing you to access your personal data automatically:

(i) you may have the right to ask for your personal data to be transferred automatically to other organisations; and

(ii) you may have the right to ask for your personal data to be directly transferred to other organisations, with the exceptions of cases where there is a technological limitation;

d) Right to object – you may have the right to object to any data processing activities of your personal data in some circumstances;

e) Right to erasure – you may have the right to request for the deletion or anonymization of the personal data that we process about you, in accordance with the following cases:

(i) the personal data is no longer necessary for the processing purposes;

(ii) you have withdrawn your consent and/or explicit consent for us to process your personal data and/or sensitive data;

(iii) you object the processing of your personal data by us based on our legitimate interests and we do not have an overriding legitimate ground for the
processing; and

(iv) the processing activity is not in accordance with the law.

f) Right to restrict processing – you may have the rights to restrict any data processing activities, in accordance with the following cases:

(i) during the verification process in accordance with the rights request to rectify the personal data;

(ii) for cases related to personal data which the School has initially been asked to erase but was followed by an additional request of processing restriction instead;

(iii) for cases when the data processing terms have passed, but you have requested for processing restriction due to legal reasons; and

(iv) during the process of personal data processing objection verification;

g) Right to rectification – you may have the right to edit your personal data to be correct and up to date; and

h) Right to lodge a complaint - you may have the right to lodge a complaint to us and competent authorities in the case that we unlawfully or not in compliance with applicable laws with the processing of your personal data.

Please be informed that your above-mentioned rights are subject to the relevant factors and we may not be able to proceed with your request if we can rely on any lawful grounds to further process your personal data.

In the case where you have the intention to exercise your personal data protection rights, please contact us through channel specified above. We will process this request in a secure and timely manner.

11. Privacy Notice Revision
In order to improve the efficiency of the processing of your personal data, we may amend this Privacy Notice as we deem appropriate. We will notify you if such changes materially affect the processing of your personal data, or if we are required to do so by law.