Privacy Policy | Witaya Lab

1. Introduction

Witaya Lab ("we", "us", "our") operates an online school for AI development based at 67 Nimmanhaemin Road, Suthep, Chiang Mai 50200, Thailand. This policy explains how we collect, use, store, and protect personal data when you use our website or enrol in one of our courses.

We take our obligations under the Thailand Personal Data Protection Act B.E. 2562 (PDPA) seriously. If you have questions about how we handle your data, please write to us at [email protected].

2. Data We Collect

We collect personal data in the following ways:

Enquiry form: name, email address, and phone number (optional) when you contact us through our website.
Enrolment: name, email address, phone number, and payment details when you join a course.
Course participation: submitted exercises, written messages to your mentor, and records of sessions.
Website analytics: anonymised data about page visits, device type, and general location, collected via analytics cookies where you have given consent.

We do not collect sensitive personal data such as health information, financial records beyond what is needed to process payment, or data relating to minors.

3. Legal Basis for Processing

Contract performance: processing your enrolment, delivering course materials, and providing mentor feedback.
Legitimate interests: responding to enquiries and improving our courses based on learner feedback.
Consent: analytics and marketing cookies, where you have actively accepted them.
Legal obligation: retaining financial records as required by Thai law.

4. How We Use Your Data

To respond to your enquiry and provide the information you requested.
To process your enrolment and give you access to course materials.
To allow your mentor to review your submitted work and provide feedback.
To send you course-related communications — start dates, schedule changes, and similar operational messages.
To analyse how our website is used and identify improvements (only with your cookie consent).
To meet our obligations under Thai law, including record-keeping requirements.

We do not use your personal data for automated decision-making or profiling.

5. Data Sharing

We do not sell your personal data. We share it only in the following circumstances:

Payment processing: your payment details are passed to our payment processor to complete your transaction. We do not store card details ourselves.
Analytics: where you have consented to analytics cookies, anonymised data is shared with our analytics provider.
Legal requirement: if we are required to disclose data by Thai law or a competent authority.

6. Data Retention

Enquiry records: retained for twelve months from the date of first contact, then deleted.
Course records: retained for three years after course completion to allow for any disputes or follow-up questions.
Financial records: retained for seven years as required by Thai accounting law.
Analytics data: anonymised and aggregated; not linked to individual records after 26 months.

7. Data Security

We store your data on servers hosted in Thailand and the European Economic Area, both of which have appropriate data protection frameworks. Access is restricted to Witaya Lab staff with a direct operational need. We use encrypted connections (HTTPS) for all data transmission through our website.

In the event of a personal data breach that is likely to affect your rights, we will notify you and the relevant Thai authority within 72 hours of becoming aware of the breach, as required under the PDPA.

8. Cookies

Our website uses cookies. Essential cookies are required for the site to function. Optional analytics and preference cookies are only set with your consent, which you can give or withdraw at any time via our Cookie Policy page.

9. Your Rights Under Thai PDPA

Under Thailand's Personal Data Protection Act, you have the following rights:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete data.
Right to erasure: to request deletion of your data where it is no longer needed.
Right to data portability: to receive your data in a structured, machine-readable format where technically feasible.
Right to object: to object to processing based on legitimate interests.
Right to withdraw consent: to withdraw consent for analytics or marketing cookies at any time without affecting prior processing.
Right to lodge a complaint: with the Office of the Personal Data Protection Committee (PDPC) if you believe your rights have been infringed.

To exercise any of these rights, write to [email protected]. We will respond within 30 days.

10. Third-Party Links

Our website may link to external resources. We are not responsible for the privacy practices of those sites and recommend reviewing their policies separately.

11. Children's Privacy

Our courses are intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. When we make significant changes, we will notify enrolled learners by email and update the "Last updated" date at the top of this page. Continued use of our services after a change constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions:

Email: [email protected]
Post: Witaya Lab, 67 Nimmanhaemin Road, Suthep, Chiang Mai 50200, Thailand