Privacy Policy

1. Data We Collect

When you contact us or register for a workshop, we may collect:

• Full name and preferred form of address
• Email address and telephone number
• Organisation name (for employer-group bookings)
• Workshop selection and attendance details
• Any additional information you choose to share in a message

We also collect standard technical data automatically when you visit our website: IP address, browser type, pages visited, and session duration. This data is collected through analytics cookies where you have given consent.

2. How We Use Your Data

We use personal data for the following purposes:

• Responding to your enquiry about workshop availability, dates, or suitability
• Confirming your place on a workshop and providing joining information
• Sending logistical communications related to a session you have booked
• Following up after attendance (e.g., sending reference materials)
• Improving our website and workshop content using aggregated, non-identifying analytics
• Meeting any legal or administrative obligation arising under Thai law

We do not use your personal data for automated decision-making or profiling. We do not send promotional emails unless you have separately opted in to receive them.

3. Legal Basis for Processing

Under the PDPA, we process personal data on the following grounds:

• Contractual necessity — processing required to deliver a workshop you have booked
• Legitimate interests — responding to enquiries and improving our services, where these interests are not overridden by your rights
• Consent — for analytics cookies and any optional communications you have agreed to receive
• Legal compliance — where processing is required by law

4. Data Retention

We retain personal data only for as long as it serves the purpose for which it was collected:

• Enquiry data (no booking made): up to 6 months
• Workshop booking and attendance records: up to 3 years (for administrative and reference purposes)
• Employer programme records: up to 5 years
• Analytics data: aggregated; no personally identifiable information retained beyond session

After the applicable period, data is securely deleted or anonymised.

5. Data Sharing

We do not sell, rent, or trade personal data. We may share it only in the following limited circumstances:

• Service providers — hosting providers and email delivery services who process data on our behalf under data processing agreements
• Analytics providers — where you have consented to analytics cookies (e.g., Google Analytics, used in anonymised form)
• Legal requirements — if we are required to disclose information under applicable Thai law, a court order, or regulatory request

Any third-party service provider with access to personal data is contractually bound to handle it in accordance with applicable data protection law and to use it only for the purposes we specify.

6. Data Protection Measures

We take reasonable and appropriate technical and organisational steps to protect personal data from unauthorised access, loss, or disclosure. These include:

• HTTPS encryption on all website pages
• Access controls limiting data access to authorised staff only
• Secure email handling and storage practices
• Regular review of data processing activities

In the event of a personal data breach that is likely to affect your rights or freedoms, we will notify you and the Office of the Personal Data Protection Committee (PDPC) in accordance with PDPA requirements.

7. Cookies

Our website uses cookies. Cookies are small text files stored in your browser that help us understand how the site is used. We use:

• Essential cookies — required for core site functionality; always active
• Analytics cookies — active only with your consent; used to measure page visits and navigation patterns
• Preference cookies — store your cookie consent choice so you are not asked again on every visit

You can review and adjust your cookie preferences at any time on our Cookie Policy page.

8. Your Rights Under the PDPA

As a data subject under the PDPA, you have the following rights:

• Right to be informed — to know how your data is collected and used (this policy fulfils that obligation)
• Right of access — to request a copy of personal data we hold about you
• Right to rectification — to ask us to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your data where there is no lawful reason to retain it
• Right to restrict processing — to ask us to suspend use of your data in certain circumstances
• Right to data portability — to receive your data in a commonly used format where technically feasible
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — at any time, for processing based on your consent (this does not affect prior processing)

To exercise any of these rights, please contact us using the details in Section 10. We will respond within 30 days. If you believe we have not handled your data appropriately, you may lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) at pdpc.or.th.

9. Third-Party Links and Children's Privacy

Our website may contain links to external websites or public-sector resources (such as the Social Security Office or Revenue Department). We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

Our workshops are designed for adults. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted data through our site, please contact us so we can arrange its deletion.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or in applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page occasionally. Continued use of our website or services after an update constitutes acceptance of the revised policy.