1) Scope of the Policy

This Privacy Policy applies to the collection, use, disclosure, and protection of personal data arising from the use of the Center’s website and online services, including contact forms, registration systems, news and newsletters, and other digital channels for which the Center acts as the data controller.

2) Types of Personal Data Collected

• Identification Data such as name, identification number/user ID, photographs, and digital signatures
• Contact Data such as email address, telephone number, and postal/work address
• Administrative or Academic Data related to services requested from the Center, as necessary
• Website Usage Data such as IP address, browser type, pages visited, access time, and device information
• Cookies and Online Identifiers such as session IDs, preferences, and analytics cookies
• Where strictly necessary, Sensitive Personal Data (e.g., health or biometric data) will be collected only where a lawful basis exists and explicit consent has been obtained

3) Sources of Personal Data

• Personal data provided directly by you through forms, contact channels, or service registration
• Data collected automatically through your use of the Center’s website and systems via cookies or system logs
• Data obtained from third parties in accordance with applicable laws or agreements, such as analytics providers, educational institutions, or government agencies

4) Purposes and Legal Bases for Processing

The Center processes personal data for the following purposes, relying on appropriate legal bases under the PDPA:

• Service provision, inquiries, and user support (contractual necessity or legitimate interests)
• Distribution of news, research, and academic communications (consent or legitimate interests, with the right to opt out at any time)
• System improvement, security, and user experience enhancement (legitimate interests)
• Compliance with legal obligations or government orders (legal obligation or public task)
• Emergency situations to protect life, body, or health (vital interests)

5) Cookies and Similar Technologies

We use cookies to ensure proper website functionality, remember user preferences, and analyze usage. You may manage cookies through your browser settings or by clicking the “Cookie Settings” button below to customize your consent.

6) Website Analytics

The website may use analytics services (e.g., visitor analytics tools) to collect anonymized statistics for service improvement. Analytics cookies will be activated only with your consent, which may be withdrawn at any time through the Cookie Settings.

7) Data Retention Period

Personal data will be retained only for as long as necessary to fulfill the purposes stated in this Policy or as required by law. Once no longer necessary, data will be deleted, destroyed, or anonymized in an appropriate manner.

8) Data Disclosure and Data Processors

We may disclose personal data to:

• Technical service providers or data processors under contractual obligations and appropriate data protection measures
• Government authorities or regulators where required by law or binding orders
• Research or academic partners, strictly as necessary and subject to appropriate safeguards

We do not sell personal data to third parties.

9) Cross-Border Data Transfers

Where personal data is transferred outside Thailand, the Center will comply with PDPA requirements and implement appropriate safeguards, such as standard contractual clauses or transfers to jurisdictions with adequate data protection standards.

10) Data Security Measures

We implement appropriate technical and organizational measures to protect personal data, including encryption, access controls, logging, and security testing proportionate to identified risks.

11) Data Subject Rights

Under the PDPA, you have the right to:

• Access and obtain a copy of your personal data
• Request correction or updating of inaccurate data
• Request deletion, destruction, or anonymization where processing is no longer necessary
• Object to or request restriction of processing
• Request data portability in a machine-readable format
• Withdraw consent at any time without affecting prior lawful processing
• Lodge a complaint with the supervisory authority

Requests may be submitted via the contact channels below. We will respond within the time period prescribed by law.

12) Children’s Personal Data

Where processing of children’s personal data is required under Thai law, such processing will be carried out only with valid parental or guardian consent, as required by applicable legislation.

13) Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on the website with an effective date. Continued use of the website after such updates constitutes your acknowledgment and acceptance of the revised Policy.

14) Contact the Data Protection Officer (DPO)

For inquiries, requests, or to exercise your data subject rights, please contact:

• Email: info@ccas.or.th
• Telephone: +66 2 617 1530
• Address: 122/4 Rewadi Alley, Rama VI Road, Phaya Thai District, Bangkok, Thailand