Privacy Policy | Witthaya

Witthaya ("we", "us", "our") is committed to handling personal data responsibly and transparently. This policy explains what information we collect when you use our website or enrol in one of our programs, how we use it, and what rights you have over it. We operate from Bangkok, Thailand, and process personal data in accordance with the Personal Data Protection Act B.E. 2562 (PDPA).

1. Data Controller

The data controller for personal information collected through this website and our programs is:

Witthaya
76 Phaya Thai Road, Ratchathewi, Bangkok 10400, Thailand
Email: [email protected]
Phone: +66 2 718 6043

2. What Data We Collect

We collect the following categories of personal data:

Contact information: name, email address, and phone number when you submit a contact form or enquiry.
Program enrolment data: name, email, and payment confirmation when you enrol in a program.
Usage data: browser type, pages visited, and session duration, collected via analytics cookies with your consent.
Communications: content of messages you send to our instructors or support team.

We do not collect sensitive personal data (health, religious, or biometric information).

3. Legal Basis for Processing

Contract performance: processing necessary to deliver the program you have enrolled in.
Consent: analytics cookies and optional marketing communications, with your explicit agreement.
Legitimate interest: responding to enquiries, improving program content, maintaining website security.
Legal obligation: retaining certain records as required under Thai law.

4. How We Use Your Data

To respond to enquiries and provide information about programs.
To administer your enrolment and deliver program materials.
To send instructor feedback and program-related communications.
To improve website content and program quality using aggregated analytics.
To comply with legal and regulatory obligations under Thai law.

We do not sell your personal data to third parties. We do not use your data for unsolicited advertising or share it with external parties for their own marketing purposes.

5. Data Retention

Contact enquiries: retained for 12 months, then deleted unless you become an enrolled learner.
Enrolment records: retained for the duration of your enrolment plus 3 years for legal and administrative purposes.
Analytics data: retained in aggregated, anonymised form for up to 24 months.

6. Third-Party Services

We may use the following third-party services which may process limited data on our behalf:

Google Analytics: website usage analysis, operating under a data processing agreement.
Payment processors: for program fee collection — we do not store card details directly.

Each third party operates under their own privacy policy and appropriate data processing agreements where required.

7. Data Security

We take reasonable steps to protect personal data against unauthorised access, disclosure, or loss:

Data transmitted through our website is encrypted via HTTPS/TLS.
Access to learner data is restricted to authorised staff members only.
We conduct periodic reviews of data handling and access controls.
In the event of a data breach likely to affect your rights, we will notify you and the relevant authority within the timeframe required under Thai PDPA.

8. Cookies

We use cookies to keep the website functioning and, with your consent, to understand how it is being used. See our Cookie Policy for a full breakdown of the cookie categories we use and how to manage your preferences.

9. Your Rights Under the PDPA

As a data subject under Thailand's PDPA, you have the following rights:

Right to access: request a copy of the personal data we hold about you.
Right to rectification: ask us to correct inaccurate data.
Right to erasure: request deletion of your data where there is no longer a lawful basis for processing.
Right to restriction: ask us to pause processing in certain circumstances.
Right to data portability: receive your data in a structured, machine-readable format.
Right to object: object to processing based on legitimate interests.
Right to withdraw consent: withdraw consent at any time where processing is based on consent, without affecting the lawfulness of earlier processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You may also lodge a complaint with Thailand's Personal Data Protection Committee if you believe your rights have not been respected.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend reading their policies separately before providing any personal information.

11. Children's Privacy

Our programs are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that a minor has submitted data through our website, we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects when changes were last made. We will notify enrolled learners of material changes by email. Continued use of the website after changes are published constitutes acceptance of the revised policy.

13. Contact for Data Queries

For any questions about this policy or to exercise your data rights:

Email: [email protected]
Address: 76 Phaya Thai Road, Ratchathewi, Bangkok 10400, Thailand
Phone: +66 2 718 6043