Windfield International School (referred to as “the School,” “we,” “us,” or “our”) is committed to protecting the privacy and personal data of our students, prospective students, parents, alumni, employees, and website visitors. This Privacy Policy outlines how we collect, use, disclose, and protect your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA) of Thailand and other applicable laws.
By providing us with your personal data or by using our website, you agree to the terms of this Privacy Policy.
We may collect and process various types of personal data, including but not limited to:
- Student Information: Name, date of birth, gender, nationality, student ID, academic records, attendance records, disciplinary records, health information, learning support needs, photographs, and video footage.
- Parent/Guardian Information: Names, contact details (address, phone number, email), occupation, relationship to the student, and financial information for billing purposes.
- Staff Information: Name, contact details, employment history, qualifications, and financial information for payroll.
- Website Visitor Information: IP address, browser type, location data, and website usage statistics collected via cookies.
- Sensitive Personal Data: We may collect “sensitive personal data” (such as health data, religious beliefs, or criminal records) with your explicit consent or where permitted by law, for purposes such as safeguarding, health and safety, and providing appropriate educational support.
We collect and process your personal data for the following purposes, based on the legal grounds outlined in the PDPA:
- Performance of a Contract: To fulfill our obligations under an enrollment contract or employment agreement, such as providing educational services, managing admissions, and processing school fees.
- Legal Obligation: To comply with legal and regulatory requirements in Thailand, including reporting to educational authorities, managing school finances, and ensuring child protection and safeguarding.
- Legitimate Interest: To operate the School effectively, for purposes such as:
- Communicating with parents about school-related matters.
- Ensuring the safety and security of our campus and community (e.g., through CCTV).
- Promotional and marketing activities, such as using photos or videos of school events.
- Improving our website and services.
- Consent: We will seek your explicit consent to process your personal data for specific purposes, such as using your child’s image for marketing materials or handling certain health data. You have the right to withdraw your consent at any time.
We do not sell, rent, or trade your personal data. We may disclose your personal data to third parties only when necessary and in compliance with the PDPA. This may include:
- Third-Party Service Providers: To companies that provide services on our behalf, such as IT hosting, learning management systems, payment processing, or school transportation.
- Governmental Authorities: To comply with legal obligations, we may share information with Thai government agencies, such as the Ministry of Education.
- Other Schools/Educational Institutions: For purposes such as a student’s transfer or a teacher’s reference.
We will retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including for legal, accounting, or reporting requirements. Our data retention policy is based on the type of data, the purpose of collection, and any legal obligations.
Under the PDPA, you have the right to:
- Right to Access: Request a copy of your personal data we hold.
- Right to Rectification: Request correction of any inaccurate or incomplete personal data.
- Right to Erasure: Request the deletion of your personal data in certain circumstances.
- Right to Object: Object to the processing of your personal data.
- Right to Restriction of Processing: Request us to temporarily cease processing your personal data.
- Right to Data Portability: Request that we transfer your personal data to another organization.
- Right to Withdraw Consent: Withdraw your consent for data processing at any time, where consent was the legal basis.
We have implemented robust physical, technical, and organizational security measures to protect your personal data against unauthorized access, use, alteration, or disclosure.
If you have any questions or concerns about this Privacy Policy or your personal data, please contact our Data Protection Officer (DPO) at:
- Data Protection Officer: [Name of DPO]
- E-Mail: [DPO Email Address]
- Phone: [DPO Phone Number]
- Address: [School Address]
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post any changes on our website and, where appropriate, notify you directly.
