Legal

Privacy Policy

Last Updated: 10 June 2026  |  Effective Date: 10 June 2026

1. Introduction and Scope

This policy applies to all personal data collected through our website at khitlab.cyou, our contact and enrolment forms, and direct communications with our team. It does not apply to third-party websites that may be linked from our pages.

If you have questions about this policy, please contact us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact information: Name, email address, and phone number (when provided via our enquiry form)
• Enrolment data: Program selection, payment details (processed by secure third-party payment providers — we do not store card data)
• Usage data: Pages visited, time on site, browser type, and device information collected via analytics tools
• Communications: Content of messages sent to us directly or through our contact form
• Cookie data: As described in our Cookie Policy

We do not collect sensitive personal data (such as health or financial information) through our standard enrolment process.

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: For marketing communications and non-essential cookies, where you have given explicit consent
• Contract performance: To fulfil your enrolment in a program and deliver the services you have paid for
• Legitimate interest: For internal analytics, site improvement, and fraud prevention
• Legal obligation: Where required by Thai law or regulatory authorities

4. How We Use Your Data

• Responding to enquiries and providing program information
• Processing enrolment and delivering program access
• Communicating with you about your program, schedule, or account
• Improving our website and programs through aggregated analytics
• Complying with legal or regulatory requirements
• Sending optional programme updates or relevant news — only with your consent

5. Data Retention

We retain personal data for as long as necessary to fulfil the purposes set out in this policy. Enrolment records are kept for five years following completion or withdrawal. Contact form submissions are retained for 12 months unless a longer period is required by law. Analytics data is retained in aggregated, anonymised form.

6. Data Protection Measures

• HTTPS encryption on all data transmitted through our website
• Access to personal data restricted to authorised staff only
• Third-party data processors bound by data protection agreements
• Regular internal review of data handling practices
• Breach notification procedures in line with PDPA requirements

7. Third-Party Sharing

We do not sell your personal data. We may share data with trusted third parties who assist in delivering our services, including:

• Payment processors (for secure transaction handling)
• Analytics providers (aggregated, non-identifying data)
• Email service providers (for programme communications)
• Regulatory authorities, where legally required

8. Cookies

We use cookies to support site functionality and analytics. For full information on the types of cookies we use and how to manage your preferences, please see our Cookie Policy.

9. Your Rights Under the PDPA

As a data subject under Thailand's PDPA, you have the following rights:

• Right to access: Request a copy of the personal data we hold about you
• Right to rectification: Ask us to correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data where no lawful basis remains
• Right to restriction: Ask us to limit how we process your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interest
• Right to withdraw consent: Where processing is consent-based, withdraw at any time

To exercise any of these rights, please email [email protected]. We will respond within 30 days. If you are unsatisfied with our response, you may contact the Office of the Personal Data Protection Committee (PDPC) of Thailand.

10. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices or content of those sites. We encourage you to review their privacy policies before sharing any personal information.

11. Children's Privacy

Our programs and website are intended for individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us and we will promptly remove it.

12. Changes to This Policy

We may update this policy periodically. Where changes are material, we will notify enrolled learners by email and update the "Last Updated" date at the top of this page. Continued use of our site or services following notification constitutes acceptance of the revised policy.

13. Contact for Data Enquiries