Privacy Policy

CS Academy Thailand collects only the personal data you send us through our website, email, LINE or course registration, and uses it only to answer your enquiries and provide the services you request. We never sell or rent your data, and you can ask to see, correct or delete it at any time by emailing comsec.academy@gmail.com.

Effective 27 October 2026 · Last updated 27 October 2026

1. Data controller

CS Academy Thailand (“we”) is the data controller for personal data collected through csacademythailand.com and our contact channels. For any personal-data matter, email comsec.academy@gmail.com.

2. Data we collect

We collect only what is necessary for the channel you use to contact us.

Channel	Data collected
Website contact form	Full name, company or organization, email, phone number, topic, message and your consent
Email and LINE Official	Display name, messages, and any information or documents you send
Course registration and services	Full name, position, company, contact details, receipt or tax-invoice details, and proof of payment
Website visits	IP address, browser type and server access logs, plus the language cookie

We do not intend to collect sensitive personal data such as health, religion or criminal records. Please do not include such data in forms or messages.

3. Purposes and legal bases

Purpose	Legal basis under the PDPA
Answering enquiries, replying, and sending course details or quotations you request	Consent (Section 19) and steps taken at your request before entering a contract (Section 24(3))
Running training and agreed services; issuing receipts or tax invoices	Performance of a contract (Section 24(3)) and legal obligation (Section 24(6))
Keeping accounting and tax records	Legal obligation (Section 24(6))
Keeping the website secure and preventing spam and attacks	Legitimate interest (Section 24(5))
Sending course news and articles	Consent, for example when you add our LINE Official account or ask to receive news (Section 19)

Data from the contact form is used only to respond to your enquiry. We will not use it for marketing unless you give separate consent.

4. Disclosure and service providers

We do not sell, rent or trade your personal data. We disclose it only as necessary to:

• Our website host (Hostatom), which stores the website and form data on servers in Thailand
• Google, our email provider (Gmail), used to receive form notifications and correspond by email
• LINE and Meta (Facebook) — when you contact us through LINE Official or our Facebook Page, data on those channels is governed by each provider’s privacy policy
• Government authorities where required by law or a lawful order

5. International transfers

Email and messaging providers such as Google, LINE and Meta may store data on servers outside Thailand. We use providers with internationally recognized data-protection measures and transfer only what is needed to communicate with you or provide the services you request.

6. Retention

Data	Retention period
Form, email or LINE messages that do not lead to a service	Up to 2 years from the last contact
Participant and client data	For the duration of the service and up to 5 years after it ends
Accounting and tax records	For the period required by accounting and tax law
Server access logs	According to our hosting provider’s log cycle

After these periods, or when you ask us to delete your data and no legal reason requires us to keep it, we delete it or make it no longer identifiable.

7. Cookies

This website uses one essential cookie, pll_language, to remember your language (Thai or English). We use no advertising or tracking cookies. Our host’s security system may set temporary cookies to block attacks.

If we add analytics tools such as Google Analytics in future, we will update this policy and ask for your consent first.

8. Your rights

Under the PDPA you have the right to:

• Withdraw consent at any time, without affecting processing carried out before withdrawal
• Access and obtain a copy of your personal data
• Receive your data or have it sent to another controller
• Object to the collection, use or disclosure of your data
• Have your data deleted, destroyed or anonymized
• Restrict the use of your data
• Have your data corrected, kept up to date and complete
• Complain to the Personal Data Protection Committee (PDPC) at www.pdpc.or.th

To exercise these rights, email comsec.academy@gmail.com. We may ask you to verify your identity, and we will respond within 30 days of receiving your request. If a legal reason prevents us from fulfilling it, we will tell you why.

9. Security

The website runs over HTTPS, back-end access is limited to authorized people, and login attempts are protected against password guessing. If a personal-data breach occurs, we will notify the PDPC within 72 hours where the law requires, and notify you if the breach poses a high risk to your rights.

10. Links to other websites

Our pages and articles may link to external websites such as the SEC, the SET or IOD. This policy does not cover those sites; please read their own privacy policies.

11. Changes to this policy

We may update this policy when the way we collect or use data changes, and the last-updated date will appear at the top of this page. For significant changes, we will give notice on the website.