Privacy Policy

Last updated: [DD Month YYYY]

[Organization name] ("we", "us") respects your privacy and is committed to protecting your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). This policy explains what personal data we collect through this website, why we collect it, how we use and protect it, and what rights you have over it.

1. Personal Data We Collect

Data you provide directly — name, email address, phone number, and message content submitted through contact forms, registration forms, or live chat.
Data collected automatically — IP address, browser type, device type, pages visited, and time spent on the site, collected via cookies and analytics.
Data from linked services — where applicable, information from social login or linked social media accounts you choose to connect.

2. Purposes of Collection, Use, and Disclosure

To provide, operate, and maintain the services and content on this website.
To respond to inquiries submitted through contact forms or live chat.
To process applications or registrations submitted through this website.
To analyze website usage and improve content, layout, and user experience.
To send important notices related to the services you use (not marketing, unless you separately opt in).
To comply with legal obligations or requests from competent authorities.

3. Legal Basis for Processing

We process your personal data based on: your consent; the necessity to perform a contract or take steps at your request prior to entering into one; compliance with a legal obligation; and/or our legitimate interests in operating and improving this website, provided such interests do not override your fundamental rights.

4. Cookies

This website uses cookies to remember your preferences, analyze traffic, and improve your browsing experience. You can choose to accept all cookies or only those essential for the site to function via the cookie consent banner shown on your first visit. You may also manage or delete cookies through your browser settings at any time.

5. Disclosure of Personal Data

We do not sell your personal data. We may share it only with:

Service providers who process data on our behalf (e.g. hosting, analytics, email delivery), under confidentiality obligations.
Government agencies or authorities where required by law or a valid legal order.
[Add any other specific third parties relevant to your organization, if applicable.]

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law, after which it will be securely deleted or anonymized. [Specify retention periods per data category, e.g. contact form submissions: X years; registration records: X years.]

7. Your Rights

Under the PDPA, you have the right to: access and request a copy of your personal data; request correction of inaccurate data; request deletion or anonymization of your data; withdraw consent at any time (where processing is based on consent); object to or restrict certain processing; and request data portability. To exercise these rights, please contact us using the details in Section 9 below.

8. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure, including access controls, encryption in transit, and restricted staff access on a need-to-know basis.

9. Contact Us / Data Protection Officer

[Organization name]
Address: [Full address]
Email: [dpo@example.ac.th]
Phone: [0X-XXX-XXXX]

10. Changes to This Policy

We may update this policy from time to time. The "Last updated" date above indicates when it was last revised. Material changes will be announced on this page.

This is a starting draft, not a ready-to-publish legal document. Please have your organization's legal or data protection team review and complete every bracketed placeholder before publishing.