| PRIVACY POLICY | |||||||||||||
|
SPGS International School, including Leading Education Company Limited (collectively referred to as “the School” or “We”) values the privacy of anyone interacting, communicating and providing Personal Data to the School (“Data Subject”). The School and all its staff members are committed to treat all Personal Data with security, confidentiality and strive to comply with our legal obligations. This privacy policy (“Privacy Policy”) sets out the School’s practices and security measures with respect to Personal Data and applies to any individuals whom the School engages or whose Personal Data is in the possession of the School. Data Subject may review this Privacy Policy together with other privacy statements which the School may additionally provide on this website or on specific occasions when the School collects Personal Data of the Data Subject, i.e. Privacy Statement for the current, former and prospective (i) students (ii) parents (iii) employees or any individuals employed by the School, including full-time and part-time employees and (iv) stakeholders (“Privacy Statements”). This Privacy Policy supplements to other Privacy Statements and will not cancel, replace, or override any provision in the Privacy Statements. If there are any conflict between the two documents, the Privacy Statements shall prevail. 1. Key Summary of this Privacy
Policy We have engaged with the Data
Subject for several purposes, and therefore have a number of the personal data
under the collection. In this regard, we ensure that the personnel, business
operations, and performances of the School shall be complied with this Privacy
Policy, the Privacy Statements (if applicable) and the Personal Data Protection
Act B.E 2562 (“PDPA”) and other applicable laws, in order to protect the
privacy and security of the Data Subject, including to avoid unauthorized or
unlawful acts, to prevent violation of laws, and to mitigate any potential
risks from penalty imposed by the PDPA and applicable laws. 2. Types of Personal Data “Personal Data” means any data relating to an individual which can identify such individual, directly or indirectly excluding the data of a deceased individual. We may collect the Personal Data in relation to the Data Subject as follows: a) Identity data such as name, title, gender, age, nationality, country of residence, marital status, date of birth, occupation, identification card, passport, other government-issued identification data, photo, and any other identity data with the similar nature. b) sensitive data such as religion, ethnicity, dietary, sexual preference, allergy data, health data, disability, child safeguarding records, criminal records, special education needs and biometric data. c) Contact details such as address, phone number, email, messaging application accounts, for example, Line, WhatsApp and other social media accounts, such as Facebook and Instagram. d) Financial data such as credit/debit card information, bank account details, source of fund and assets list. e) Employee data such as social security information, tax information, educational background, work experience, salary rate, work performance, working hours and leaves. f) Preference and lifestyle information, such as interest, hobby, likes and dislikes. g) Transactional data such as information of services or products sold or provided to the Data Subject, correspondence information, enquiries, feedback and purchase history. h) Technical information such as cookies, IP address, log files, location, mobile network data, hardware model, operation system. i) Security & loss prevention data, including images, audio and video recordings (such as security camera footage and license plate data). j) Parent and Stakeholder information. k) Public data which is available on both online and offline channels such as social media data, photos, posts, locations, friend list and liked pages. If the Data Subject wishes to use
any services or products of the School, work with the School or otherwise
engage in any business arrangements with the School, the School needs to
collect and process the Data Subject’s Personal Data in order to provide such
services or products, enter into a contract with the Data Subject, perform any
obligations thereunder, meet any of the Data Subject’s requests or comply with
applicable laws. If the Data Subject do not provide Personal Data to the School,
we may not be able to provide such services or products, enter into a contract
with the Data Subject, perform any obligations thereunder and it might result
to a breach of contract with the School by the Data Subject, breach of
applicable laws, or the event that the Data Subject’s requests are fully
rejected. If you provide Personal Data about other persons to the School, you affirm that this Privacy Policy and the Privacy Statements (if applicable) have been reviewed by such persons and that such persons have given their consents regarding the processing of their Personal Data (if required). The Data Subject have to present the documents evidencing that the above actions have been carried out as may be requested by the School. 3. Collection of the Personal
Data The School may collect Personal Data provided by the Data Subject from any engagements or interactions with the Data Subject either via online or offline means, such as through the websites or applications owned or controlled by the School (“the School’s Websites & Applications”), phone call, email, messaging applications, including when the Data Subject use the School’s services or products, apply for a position at the School, engage in any transactions or business arrangement with the School. The School may also collect Personal Data from other sources, such as from family members or related persons of the Data Subject, referrers, marketing companies, recruitment agencies, corporate customers, vendors, or stakeholders and other publicly available sources in either online or offline database. 4. Retention Period All Personal Data is securely stored in accordance with the PDPA and applicable regulatory requirements. We retain your Personal Data only for legitimate purposes, relying on one or more of the lawful basis, and only for so long as necessary for those purposes, or as required by applicable laws. The period we retain your Personal Data will correspond to the applicable prescription period or the period under the relevant laws and regulations (e.g. accounting, tax, labor and other laws to which we are subject, both in Thailand and in other relevant countries). 5. Purpose of Personal Data
Processing Personal Data shall be collected, used or disclosed only for the purposes and the lawful basis stated below, including any purposes and the lawful basis stated in the Privacy Statements, any other purposes that the Data Subject have given their consents to the School from time to time, and any other purposes as permitted or required under the PDPA and/or any applicable laws. 5.1 Legal Obligation We are regulated by laws, rules, regulations, and government regulatory authorities. To fulfill our legal and regulatory requirements with these authorities it is necessary to collect, use or disclose your Personal Data for the following purposes, which include but are not limited to: a) Compliance with the PDPA and any amendment to the law thereafter; b) Compliance with laws (e.g. school child safeguarding laws, and other laws to which we are subject both in Thailand and in other relevant countries), including conducting identity verification, criminal background checks, other checks and screenings (including screening against publicly available database of regulatory authorities and/or official sanctions lists), and ongoing monitoring that may be required under any applicable laws; c) Compliance with regulatory obligations and/or orders of authorities (e.g. orders by any court of competent jurisdiction or of governmental, supervisory or regulatory authorities or authorized officers). 5.2 Contractual Basis We will process Personal Data with the request and/or agreement made with you, for purposes including but not limited to the following: a) To review, evaluate and asses the Data Subject for entering into contract with the School, including communicating with and interviewing them, e.g., employees, vendors, students and parents. b) To enter into any agreement and fulfill the obligations thereunder. c) To carry out the instructions of the Data Subject (e.g. responding to enquiries, processing fee payments, providing access to online training, and other online learning platforms). d) To maintain and manage relationship and communicate with the Data Subject. e) To track record and generate report of your transactions, either as requested by you or for internal purpose. f) To make or process payment, refund, or issue invoices and receipts. g) To carry out any actions related to insurance policies or claims for compensation (e.g. proceed with or monitor any claim under an insurance policy or claim against third party). h) To notify you of transaction alerts or any beneficial to you. 5.3 Legitimate Interest We may process Personal Data based on our legitimate interests for the following purposes: a) To administer and safeguard the security of the School’s and its students. b) To authenticate and verify the Data Subject in connection with relevant transactions. c) To prevent any loss, criminal activity, fraud or any unlawful acts. d) To conduct an investigation of anti-money laundering and transaction failure. e) To conduct internal audits. f) To proceed with debt collections. g) To administer and resolve technical issues on the School’s Websites & Applications and to improve its services. h) To exchange data within the School’s group of entities for regular operational purposes. i) To allow advisors, service providers, vendors, suppliers, contractors, and sub-contractors to provide products or services to the School. j) To carry out, manage and improve day-to-day operations and to implement good corporate governance practices. k) To recruit and evaluate potential any of the directors, employees, vendors or others to work with the School. l) To manage current and future recruitment for a vacant positions. m) To communicate with the Data Subject’ reference (e.g. former employers) for background verification prior to entering into any agreement. n) To contact a related person in the event of an emergency. o) To enter into contract or communicate with corporate customers, vendors or stakeholders through their representatives such as directors or employees. p) To take a photos or video footage of the Data Subject at the School events and publish or display such materials on the School’s Websites & Applications or other platforms, without being a targeted advertisement. q) To share the Personal Data of the Data Subject on a need-to-know basis for the purpose of merger and acquisition, business reorganization, insolvency, rehabilitation or similar proceedings involving the School. r) To assess any potential risk of investment. s) To collect the Personal Data of witness to a contract as an evidence. 5.4 Consent We will request your explicit consent before processing your Personal Data for the following purposes: a) To maintain and enhance relationship between the School and the Data Subject such as to provide gifts or hold a birthday party according to the Data Subject’s preferences. b) To conduct targeted and/or direct marketing, including providing updates, promotions and information on the School-related products, services, or events that may match the Data Subject’s preferences and lifestyle, including events the Data Subject might be interested in attending. c) To conduct data analytics and market research, in order to learn about the products and/or services that the Data Subject might be interested in receiving. d) To take a photos or video footage of the Data Subject at School facilities or events, and to publish or display such media on the School’s Websites & Applications or other platforms, with the Data Subject’s consent. e) To provide meals and/or other facilities pursuant to the Data Subject’s food allergy or religion. f) To evaluate the suitability of the Data Subject for entering into a contract with the School, where this involve processing sensitive data such as criminal records and health data. g) To collect and use sensitive data as necessary, e.g. to use your identification card (which contains your religion and/or blood type and/or for verification of your identity before continuing the transaction). 5.5 Other lawful basis Apart from the lawful basis mentioned earlier, the School may collect, use or disclose Personal Data based on lawful basis below. a) To prepare historical
documents or archives for the public interest, or for purposes relating to
research or statistics. b) To prevent or suppress a danger to a person’s life, body or health. c) To carry out a public task, or for exercising official authority. 6. To Whom Personal Data is disclosed We may be required to disclose Personal Data in relation to the Data Subject to the third parties, including without limitation to: a) Companies or entities within the School’s group or under its affiliation, ifany. b) Governmental authorities such as the Ministry of Education, Revenue Department, Department of Business Development, Stock Exchange of Thailand, Securities and Exchange Commission Thailand, Land Office and the Immigration Bureau, including courts and any other authorities as required by law. c) Financial institutions, insurance companies and insurance brokers involved in fee processing, student insurance schemes, or other related services. d) Service providers, suppliers, business partners who support the School’s operations. e) Relevant stakeholders, including scholarship sponsors or affiliated academic partners. f) Professional advisors such as accountants, lawyers, IT advisors, technicians, and auditors engaged by the School. g) Third parties in connection with the sale, transfer, merger, or restructuring of all or part of the School’s operations or assets, including in cases of business reorganization, insolvency, rehabilitation and similar proceedings. In this regard, the disclosure shall be conducted for the purposes as stated in the Privacy Policy, the Privacy Statements and the consents given by the Data Subject and/or other purposes as required or permitted by the PDPA and/or any applicable laws. 7. Cross-Border Transfer Due to the nature of modern educational operations, the School may disclose or transfer Personal Data of the Data Subject to third parties located overseas. The destination countries may or may not have the equivalent level of protection for Personal Data protection standards. In any case, the School will take steps and measures to ensure that Personal Data is securely transferred, the receiving parties have in place an appropriate level of protection standards or other there are derogations as required or allowed by PDPA and other applicable laws. In the event that the destination countries do not have the sufficient data protection standards, the School will ensure that the transfer of your Personal Data complies with the PDPA or other applicable laws. 8. Cookies Cookies are small software files stored on the School’s Websites & Applications and sent to the Data Subject’s browser when using the School’s Websites Applications. Cookies on the School’s Websites & Applications are used to identify and distinguish users who have visited the School’s Websites & Applications and track their personal preferences, which the data of the users shall be automatically collected by Cookies. These Cookies do not cause any harmful effects to the computer or transmit any viruses, Cookies otherwise help the School to serve the users with personalized services or support, provided that its purposes of using are: a) To allow the users to access or use services or functions on the School’s Websites & Applications. b) To increase effectiveness of the School’s Websites & Applications in operating online service or interactive applications; c) To enhance the visitation to the School’s Websites & Applications, such as to recognize a name, account, password or previous interest, in order to serve those who repeatedly use the School’s Websites & Applications or services; and d) To analyze the performance, including update and improve the operation of the School’s Websites & Applications. If the users, as the Data Subject, disagree to the use of Cookies in automatically collecting the data while browsing the School’s Websites & Applications, the users can choose not to accept Cookies by visiting [www….] 9. Log Files The School may record log files when the Data Subject visits the School’s Websites & Applications. Log files include IP address, browser type, internet service provider name, entry and exit pages, platform type, date/time stamp, and number of clicks. 10. Surveillance camera The School uses surveillance cameras to capture footage of the visitors and the vehicles in and around the location of the School for safety purposes including the prevention and detection of crimes. The surveillance cameras of the School will detect the entrance, the terrace, the parking lot outside of the buildings, the fence around the buildings and the area within the perimeter of the School. The surveillance system does not use sound recording. The School ensures that live feeds and captures from the surveillance cameras will be observed by authorized person of the School only. 11. Minors A minor refers to any person under the age of 20 years. The School may not know the age of the Data Subject visiting the School’s Websites & Applications. The School shall principally collect, use, and/or disclose Personal Data, including sensitive data, of minors only in the following circumstances: a) Consent is obtained from the parents or the persons holding legal guardianship over the minor, except where the collection, use, or disclose of such data is otherwise permitted by applicable law without the requirement of consent; or b) The minor is legally competent to give consent independently under the PDPA, in which case the School may rely on the minor’s consent after taking into account the nature of the processing and the minor’s maturity and understanding. In cases where the processing involves sensitive data of the minor, such as data concerning health conditions, religious beliefs, biometric, identifiers, food allergies, or other data prescribed as sensitive under the PDPA. The School shall obtain explicit consent from the parents or legal guardians, unless an applicable legal exemption applies. Any withdrawal of consent shall be made by or through the parents or legal guardians of minors who providing Personal Data of such minors (if applicable), unless the minors have attained the legal capacity to withdraw such consent independently in accordance with the applicable law. If the School becomes aware that the Data Subject are minors and such minors cannot act alone according to the Civil and Commercial Code, the School will, and without delay, proceed to obtain consent from the parents or legal guardian, if required by the PDPA. 12. Personal Data Security
Measure The School recognizes the importance of maintaining the security of the Data Subject’s Personal Data. Therefore, the School has implemented reasonable technical and organizational security measures to protect the Data Subject’s Personal Data collected by the School against unauthorized access, misuse, loss or destruction, which include control access, encrypted storage and storage with lock. 13. Data Subject’s Rights Where permitted by the PDPA or applicable laws and under the relevant criteria/requirements specified thereunder, the Data Subject have the rights with respect to their Personal Data to: Access: The Data Subject may have the right to access or request a copy of Personal Data, which the School is collecting, using or disclosing about the Data Subject, including to disclose the acquisition of the Data Subject’s Personal Data which the School obtained without the Data Subject’s consent. For the Data Subject’s own privacy and security, the School may require the Data Subject to prove their identity before providing the requested Personal Data. Data Portability: The Data Subject may have the right to obtain Personal Data of them, which the School holds, in a structured, electronic format, and to send or transfer such Personal Data to another data controller, where this is (a) Personal Data of the Data Subject and (b) the School is collecting, using or disclosing such Personal Data on the basis of the Data Subject’s consent or to perform a contract with the Data Subject. Rectification: The Data Subject may have the right to have incomplete, inaccurate, misleading, or not up-to-date Personal Data which the School collects, uses or discloses about the Data Subject rectified. Withdraw Consent: For the purposes of consent, which the Data Subject have given to the School for the collecting, using or disclosing of the Data Subject’s Personal Data, the Data Subject have the right to withdraw such consent at any time. File a complaint: The Data Subject have the right to file a complaint with the Personal Data Protection Committee if the Data Subject believe that there is any violation of the PDPA. Objection: The Data Subject may have the right to object the collection, use, and disclosure of Personal Data in certain circumstances, including the case where Personal Data is being processed under the basis of public interest and legitimate interest or for the purposes of direct marketing and/or scientific, historical or statistic research. Restriction: The Data Subject may have the right to restrict the processing of Personal Data in circumstances that (a) the School is in the process of verifying the accuracy of Personal Data or assessing the basis of the Data Subject’s objection to the collection, use and disclosure of their Personal Data, (b) the Data Subject requests the School to restrict the use of Personal Data instead of deleting or destroying, and (c) Personal Data is no longer necessary for the purposes of collection, use and disclosure but the Data Subject request the School to retain such Personal Data to establish, comply, exercise or defend legal claims. Deletion (‘right to be forgotten’): The Data Subject may have the right to request that the School delete or de-identify Personal Data which the School collects, uses or discloses about the Data Subject, unless the School is not obligated to do so, or if the School needs to retain such Personal Data in order to comply with a legal obligation or to establish, exercise, or defend legal claims. The Data Subject may exercise these rights by changing their privacy preference, unsubscribing, or contacting the School or the Data Protection Officer, as detailed below. The Data Subject’s request to delete or anonymize Personal Data, or request to restrict or object to the processing of Personal Data could mean that the School is unable to perform its obligations under an existing contract and unable to provide the Data Subject with the services and products and/or to acts on the Data Subject’s request. In the event that your withdrawal of consent will affect you in any manner, the School or the Data Protection Officer will inform you of the consequences of such withdrawal of consent accordingly. For the Data Subject’s privacy and security, the School may refuse to comply with the request if (a) the person submitting the request does not have evidence to verify that he/she is the data subject or does not has the authority to submit such request (b) the request is not reasonable, e.g., the person submitting the request does not have the rights under the PDPA or does not have Personal Data in the School’s possession (c) the request is excessive or vexatious, e.g., the request unreasonably repeats a previous request from the same person (d) the School has compelling legitimate grounds to reject such request as required or permitted by the PDPA and/or any applicable laws. 14. Privacy Policy of other
Websites The School’s Websites & Applications may contain address links to other websites. This Privacy Policy applies only to the School’s Websites & Applications and the School shall be solely responsible subject to the scope of this Privacy Policy. The School shall not be responsible for any collection, storage, process, or disclosure of Personal Data, or the use of Cookies conducted by other websites which the Data Subject access from the School’s Websites & Applications. Therefore, the School would kindly suggest the Data Subject carefully review the privacy policies of other websites before submitting any Personal Data. 15. Amendment and Review The School may regularly review this Privacy Policy and the Privacy Statements from time to time to be in accordance with any amendments made to the PDPA and applicable laws. Amendments to this Privacy Policy and the Privacy Statements will be publicly announced on the School’s Websites & Applications or other available channels. 16. Miscellaneous This Privacy Policy and the Privacy Statements are governed by and shall be construed in compliance with the PDPA and the laws of Thailand. This Privacy Policy and the Privacy Statements are written in English and Thai language. In the event of any inconsistency between the English versions and Thai versions, the English versions shall prevail. 17. Contact Us: DPO Regarding all queries or awareness with respect to Personal Data arising from this Privacy Policy, the Privacy Statements, or the activities of the School, including the exercise of any rights of Data Subject, please contact the Data Protection Officer at the below address: Data Protection Officer of the School
|
|||||||||||||