Privacy Policy

1. Data Controller

The data controller for personal information collected through this website and through programme enrolment is Rung Lab, operating at 27 Nimmanhaemin Road, Suthep, Mueang Chiang Mai District, Chiang Mai 50200, Thailand. You can contact the data controller at [email protected] or by telephone at +66 53 219 467.

2. Personal Data We Collect

We collect the following categories of personal data:

• Contact information: full name, email address, and telephone number provided via our website contact form or direct correspondence.
• Enrolment information: professional background, current role, and programme preferences provided during the enquiry or enrolment process.
• Technical data: IP address, browser type, device type, pages visited, and time spent on pages — collected via server logs and analytics tools.
• Cookie data: preferences and consent choices stored in your browser via cookies. See our Cookie Policy for details.
• Communications: the content of emails or messages you send to us.

We do not collect sensitive personal data such as health information, financial account details, or government identification numbers.

3. Legal Basis for Processing

We process personal data on the following legal bases under applicable Thai data protection law (the Personal Data Protection Act B.E. 2562, PDPA) and, where applicable, equivalent international standards:

• Consent: for marketing communications and non-essential cookies, where you have given explicit consent.
• Contract performance: for processing necessary to fulfil a programme enrolment or to take pre-contractual steps at your request.
• Legitimate interests: for improving our website, maintaining security, and responding to enquiries — where those interests are not overridden by your rights.
• Legal obligation: where processing is required to comply with Thai law or regulatory requirements.

4. How We Use Personal Data

We use personal data for the following purposes:

• Responding to enquiries submitted through our contact form or by email.
• Processing programme enrolments and communicating about cohort schedules, session details, and programme materials.
• Sending information about upcoming programmes or cohort dates where you have consented to receive such communications.
• Improving our website and understanding how it is used, using anonymised or aggregated analytics data.
• Maintaining records as required by applicable Thai law.

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Data Retention

We retain personal data for the following periods:

• Enquiry and contact form data: up to 24 months from the date of contact, or until you request deletion.
• Programme participant records: up to 5 years from the date of programme completion, in line with standard record-keeping requirements for educational providers in Thailand.
• Analytics data: up to 26 months in aggregated or anonymised form.
• Cookie consent records: up to 12 months from the date of consent.

When data is no longer needed for its stated purpose, it is securely deleted or anonymised.

6. Data Sharing and Third Parties

We do not sell personal data to third parties. We may share data in the following limited circumstances:

• Service providers: we use third-party services for email delivery, website hosting, and analytics. These providers process data on our behalf under data processing agreements.
• Analytics: we may use a web analytics service (such as Google Analytics) to understand site usage. Data shared with such services is aggregated or anonymised where possible.
• Legal requirements: we may disclose data if required by Thai law, court order, or regulatory authority.

Where third-party services are used that may involve international data transfers, we take steps to ensure appropriate safeguards are in place consistent with the PDPA's requirements for cross-border transfers.

7. Cookies

Our website uses cookies to support basic site functionality and to understand how visitors use the site. You can manage your cookie preferences at any time through our Cookie Policy page. Essential cookies are required for the site to function and cannot be disabled. All other cookie categories are optional.

8. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• HTTPS encryption for all data transmitted via this website.
• Access controls limiting who within our team can access personal data.
• Regular review of our data handling practices.

In the event of a personal data breach that is likely to result in risk to individuals, we will notify the relevant authorities and affected individuals as required under the PDPA.

9. Your Rights

Under the Personal Data Protection Act B.E. 2562 (PDPA) of Thailand, you have the following rights regarding your personal data:

• Right to access: you may request confirmation of whether we hold your personal data and a copy of it.
• Right to rectification: you may request correction of inaccurate or incomplete data.
• Right to erasure: you may request deletion of your data where there is no overriding legal basis for its continued processing.
• Right to restrict processing: you may request that we limit the processing of your data in certain circumstances.
• Right to data portability: you may request a copy of data you have provided to us in a structured, machine-readable format.
• Right to object: you may object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint: you may lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand if you believe your rights have been infringed.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices or content of those sites and encourage you to review their privacy policies before providing any personal data.

11. Children's Privacy

Our programmes are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we have collected data from a minor, we will delete it promptly. Parents or guardians who believe a minor's data has been submitted should contact us at [email protected].

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page indicates when it was last updated. Continued use of our website or programmes after a policy update constitutes acceptance of the revised policy. Where changes are material, we will make reasonable efforts to notify affected individuals.

13. Contact Us

For any questions, requests, or concerns about this policy or your personal data, please contact: