Privacy Policy

We may collect the following categories of Personal Data:

• Directly Provided Information Your name, email address, telephone number, address, child’s date of birth, and other contact details submitted via inquiry or application forms.
• Visitor Pre-registration Information Visitor category, full name, optional organization, one contact route, host or department, broad purpose code, intended visit date and time, party size, adult or responsible-adult declaration, and conduct and privacy acknowledgments. Visitors must not enter student names or sensitive information in free-text fields.
• Automatically Collected Information Browser type, IP address, device type, visit duration, pages viewed, and usage data via cookies or similar technologies.
• Sensitive Personal Data Only when necessary and with explicit consent, such as health information for school services or special needs accommodations.

We collect Personal Data only when necessary and for specific lawful purposes as outlined in Section II.

We process your Personal Data only when there is a lawful basis under the PDPA, including:

• Consent When a specific activity relies on consent, we request it separately and explain how to withdraw it. Submitting the visitor form acknowledges the notices and is not consent to unrelated uses.
• Contractual Obligations For processing admissions or service-related requests.
• Legal Obligations To comply with applicable laws and regulatory requirements.
• Legitimate Interests To maintain and improve our Site and services, provided that your fundamental rights are not infringed.

Your Personal Data may be used for:

• To respond to inquiries and provide information about our academic programs.
• To facilitate communication regarding admissions, school events, or updates.
• To manage visitor pre-entry screening, campus access, safety, safeguarding and an auditable reception record using an applicable lawful basis, including the School’s legitimate interests where appropriate.
• To analyze and improve our Site and Service.
• To comply with legal or regulatory obligations.

We may share Personal Data with:

• Third-party service providers, such as website hosting and email services, under strict confidentiality and only for the above purposes.
• Government authorities when legally required.
• Internal school departments for administrative or educational purposes.
• Authorized reception, security and administrative personnel who need visitor details for access control, safety or safeguarding.

We do not sell or rent your personal information to any third party.

We use cookies and similar technologies to enhance user experience and track visitor behavior on our Site. You may adjust your browser settings to refuse or delete cookies. However, some parts of our Site may not function properly without them. After a visitor-form submission, an encrypted, HttpOnly first-party receipt cookie is retained for up to 30 minutes solely to display and translate the QR receipt; it is not used for advertising or analytics. For abuse prevention, the visitor form derives a keyed pseudonymous rate identifier from the connection address and does not keep the raw address in its rate table. The identifier stops affecting decisions at the next hourly boundary; expired buckets are removed by scheduled cleanup. Hosting or CDN security logs are governed separately.

We retain your Personal Data only as long as necessary for the purposes it was collected or to comply with legal requirements. Your data is stored securely using reasonable administrative, technical, and physical safeguards to protect against loss, misuse, unauthorized access, or disclosure.

Visitor pre-registration records are retained for 90 days by default. An authorized administrator may configure a period from 30 to 365 days. A legal, safeguarding or incident hold may extend retention only for as long as the documented need continues.

Direct identifying and contact fields (name, contact route, organization, and host) are encrypted. Linked operational metadata—including date, time, category, purpose, party size, status, and retention timestamps—remains in access-controlled columns of the private table.

The visitor QR code encodes a random opaque pseudonymous verification token. It contains no name or contact fields, but it links to an access-controlled record and is protected accordingly. It expires at the end of the intended visit day in the School website timezone.

You have the following rights regarding your Personal Data:

• Right to Access Request a copy of your personal data.
• Right to Rectify Request corrections to incomplete or inaccurate data.
• Right to Erasure Request deletion of your data when it is no longer necessary.
• Right to Withdraw Consent Withdraw your consent at any time, which will not affect prior processing.
• Right to Object Object to data processing where applicable.
• Right to Data Portability Request transfer of your data to another party.
• Right to Lodge a Complaint Submit complaints to the Personal Data Protection Committee (PDPC) of Thailand.

To exercise your rights, contact us at the email address or phone number provided below.

Children receive specific protection. The School applies the consent and parent-or-guardian rules relevant to each activity under the PDPA and, where applicable, other binding law. If you believe a child’s data was collected or used improperly, contact us so we can investigate and take appropriate action.

Our Site may contain links to external websites. We are not responsible for the privacy practices or content of such sites. Please review their privacy policies before engaging with them.

We may update this Privacy Policy from time to time to comply with PDPA or other applicable regulations. Significant changes will be posted on our Site or communicated to you directly when required. Please review this page periodically.

If you have any questions or concerns about this Privacy Policy or your personal data, please contact: