Notice of Processing on Personal Data

Thailand

Le Cordon Bleu Dusit Company Limited or Le Cordon Bleu Dusit Culinary School (“LCBD”), as a Personal Data Controller according to the Personal Data Protection Act B.E. 2562 (A.D. 2019) (“PDPA”) is legally bound to abide by the PDPA¹ in the processing of the Personal Data of the Data Subject(s) – who is a natural person – in which LCBD acts under the PDPA, including notifying the Data Subject in accordance with this Notice and requesting the Data Subject’s consent (in some cases) in accordance with the attached Consent Form.

¹Processing of Personal Data means any actions towards Personal Data whether collecting, recording, organizing, storage, alteration, use, disclosure, or forwarding, publishing or any other actions making the information applicable for data utilization

Privacy Notice

Details

1. Collection of Personal Data
LCBD may collect Data Subject’s Personal Data both directly and indirectly from the information that the Data Subject and/or his/her representative(s) provided to LCBD or any other related personnel to the Data Subject, LCBD’s business partners, hotels under the Dusit Group, other telephone and digital services of LCBD which include website services, application downloads, other reliable sources such as associations, governmental organizations, governmental body, private organizations, seminars, training workshops, exhibitions which are organized either by LCBD and/or governmental or private organizations including any other online or social media.

2. Types of Personal Data Collected

Personal Data of student(s) and parent(s)/guardian(s) such as nationality, date of birth, sex, place of birth, postal address, telephone number, email, parent(s)/guardian(s)’ name(s), their date of birth, contact details, emergency contacts, academic absent date(s), bank account details of parent(s)/guardian(s), needs reports, recording of medical data and incident(s), special education requirements records and dietary requirements
Educational information such as education records, tuition and extracurricular accounts, attendance and non-attendance records, exam details and results, curricular activities which includes: educational needs reports, incident reports involving pupils or students
Information regarding membership of club(s) and/or association(s) within the School
Event attendance and work experience placements
Photographs or images of students
Sensitive personal information such as health, race and religion
Other information regarding our service(s) such as assessment, relevant medical information, special education needs information, behavioral reports and psychological assessment reports
Attendance information such as session(s) attended, number of absence(s) and absence reasons
Logging information and information technology (IT) usage audit information being applications, education technology apps, other applications and other cloud-based system service(s)
Information in the form of CCTV recording

3. Data Retention Period
LCBD will retain the Data Subject’s Personal Data as long as it is deemed necessary for the purpose of data processing. Afterwards, LCBD will delete and eradicate the aforementioned Personal Data except for any case(s) where it is required to retain the data according to the applicable laws stated or for the protection of LCBD’s rights and/or interest. Under normal circumstances, the maximum duration of data retention is 10 (ten) years unless there is/are any law(s) requiring prolonging the data retention period longer than the aforementioned period.

4. Purposes of Use and Disclosure
LCBD will use and disclose the Data Subject’s Personal Data for the following purposes:

To set up and administer students accounts;
To select the student(s) for admission, scholarship grants, communication, and on admission-related matters;
To identify and verify the student’s qualifications and academic records from other school, university, or any other related educational institution, and any other information the student(s) provides in application form or relevant documents;
To identify the Data Subject’s educational records from previous or current educational institutions (if applicable);
To create a profile for each student including revealing their performance and progress;
To provide educational products and services including appropriate counseling and support to students;
To provide an overview for teachers/instructors to allow them to monitor students’ progress which includes recording of said progress;
To provide students’ progress report to teachers/instructors;
To conduct research and development of educational products and services to enhance educational capabilities;
To evaluate and improve educational products and services;
To prevent and inspect fraud;
To comply with relevant established laws/regulations regarding Personal Data procession;
To inspect, analyse, and prepare document(s) as required by government organization(s) or regulatory bodies;
For all school-provided educational purposes, activities, facilities, services, and benefits (in particular those governed by the relevant regulations and laws regarding educational institutions);
To communicate and notify news and updates of the school, as well as other information;
To use in the school’s promotional media such as promotional leaflets and website;
To use in statistical analysis and research, surveys, inspection, and audit;
To organise educational field trips;
To coordinate and proceed with student internship or job application at hotels or organizations/other entities;
To issue joint certificate and/or diploma with other institution(s) to students;
To convey marketing communications relating to education courses via email, direct mail, and social media;
To protect the health of the student(s);
To ensure the safety and security plans for students.

In the case where LCBD appoints third party service provider(s) to process your Personal Data, LCBD will process your Personal Data for the purposes of performing LCBD’s contractual obligations, compliance with legal obligations, based on LCBD’s legitimate interests or based on your consent (if necessary). LCBD will not disclose or permit the disclosure or make available your Personal Data other than in accordance with the relevant ground unless a prior consent of Data Subject has been given to LCBD or PDPA allows LCBD to do so without obtaining consent from Data Subject.

If any Data Subject could not share Personal Data necessary for LCBD to process Personal Data based on the ground specified above, LCBD will not be able to perform its contractual obligations with such subject matter nor able to comply with legal obligations.

LCBD will process Personal Data in strict compliance with applicable laws. In case where you have given a consent to any data processing activity, you may withdraw your consent at any time.

5. Disclosure
LCBD will not disclose your Personal Data without any legal basis. Your data may be disclosed or transferred to governmental organizations, governmental bodies or third parties including:

Government Authorities: We may share the Personal Data of students to relevant government authorities to fulfill any legal obligations and/or requirement we may have. In case of international students, we may share your information with appropriate government authorities including to act as your sponsor for visa or other facilitation purposes.
LCBD: We may share the Personal Data of students to LCBD and Dusit in order to proceed with student internship, trainee program, school trips and outing.
Third-Party Hotel or Other Organization: We may share the Personal Data of students to third-party hotel or other organization in order to proceed with student internship, trainee program, school trips and outing.
Partner School and Institutions: We may share the Personal Data of students to our partner school and/or institutions who have collaborated with us for a joint degree in order to evaluate and issue the joint certificate and/or diploma to the students who attend the course.
Hospital and Medical Organisation or Personnel: We may share the Personal Data of students to family nurses, doctors or social service organisations where sharing is in the vital interests, or where not sharing could have a negative impact on the individual.
Service Providers: We may share the Personal Data to service provider that are necessary for School to deliver the admissions, administration, teaching and learning, pastoral development, students benefits/ social care and child protection services.
Franchisor: We may share the Personal Data of students to our franchisor education institutions who have granted us the license to operate the institutions in order to evaluate and issue the certificate and/or diploma to the students who attend the course.
Financial Institutions: We may share Personal Data to any financial institutions, charge or credit card issuing companies, credit information or reference bureau, or collection agencies necessary to establish and support the payment of any services being requested. Personal Data may also be disclosed to any person or persons that have a right under local law to gain access to such information provided they are able to prove their authority to access such information.

LCBD will disclose your Personal Data to the recipient outside of Thailand only where it is permitted by PDPA or other applicable laws.

In the event where LCBD is required to disclose your Personal Data to a third party, LCBD will follow appropriate procedures to ensure that the third party will properly handle your Personal Data in order to prevent data loss, unauthorized access, improper use, modification, disclosure or processing.

6. Data Security Measure
LCBD adopts the high-standard security system in both technology and procedures to prevent any possible data theft. LCBD implements various measures to protect its computer system, though substantial investments, effort and human resources as to ensure that LCBD achieves high-standard measures and your Personal Data remains safe.

Although LCBD makes its best efforts to protect Personal Data with our technical mechanism along with the management by our personnel to control access and keep Personal Data against unauthorized access, LCBD cannot always guarantee the security and confidentiality of Personal Data from every incident that may arise, such as virus threat and unauthorized access. A Data Subject should regularly keep up with technology news, install personal firewall software to prevent his computer from threat or data theft.

7. Right of Data Subject
In exercising any right under this Clause 6, Data Subject shall comply with criteria and procedures specified in Clause 7 of this document. However, the rights specified in this Clause 6 are subject to change as the relevant law may be amended from time to time by the government. LCBD will inform you about the changes.

7.1 Right to be notified: if LCBD wishes to collect, store, use or disclose your Personal Data in any manner beyond the intended purposes or your given consent, LCBD will notify and/or seek your prior consent with respect to such additional scope.

7.2 Right to Access to your Personal Data: You may request for a copy of your Personal Data and request to disclose about the source of your Personal Data.

7.3 Rectification of the Personal Data: To ensure that your Personal Data is accurate, up-to-date, complete and not misleading, you may file a request to rectify any of your Personal Data that has been changed by following the procedures specified in Clause 7.

7.4 Right to data portability: In case where it is technically available, you may request to receive your Personal Data in a commonly used or readable by the automatic device or to automatically transfer.

7.5 Right to erasure of your Personal Data: You may request to erase or make your Personal Data pseudonymised under any of the following circumstances: (a) your Personal Data is no longer needed to be collected, stored, used or disclosed for the intended purposes, (b) you withdraw your consent for your Personal Data to be collected, stored, used or disclosed and LCBD no longer has any legal right to process your Personal Data for the intended purposes, (c) you object to LCBD’s processing of your Personal Data, or (d) your Personal Data was processed in contravention of the PDPA.

7.6 Request to suspend the use of your Personal Data: You may request LCBD to suspend its use of your Personal Data in any of the following events:
         (1) when LCBD is in the process of verifying certain information for the purpose of rectifying, updating, completing or avoiding any misleading about your Personal Data upon your request;
         (2) when your Personal Data is to be erased under Clause 6.5 but you instead request to suspend its use;
         (3) when it is no longer necessary to store your Personal Data, but you request LCBD to continue the storage of your Personal Data for establishing legal claims, legal compliance, exercise of legal rights or defenses; or
         (4) when LCBD is in the process of verifying its legitimate rights in its data collection or processing for purposes specified by law.

7.7 Right to object the processing of Personal Data: You may object to the collection, storage, use or disclosure of your Personal Data in any of the following events:
         (1) In case where your Personal Data was collected by LCBD for the purpose of (a) LCBD’s compliance with a governmental order or (b) any legitimate interest of LCBD or other legal entity;
         (2) In case where LCBD has processed your Personal Data for the purpose of direct marketing; and
         (3) In case where LCBD has processed your Personal Data for any research purposes as specified in relevant laws, including for statistical purpose.

7.8 Right to withdraw consent: You may withdraw your consent at any time. Your withdrawal will not have any effect on LCBD’s previous data processing. If your withdrawal will affect any part of your Personal Data, LCBD will notify you of such effect at the time you make such withdrawal.

However, LCBD may deny your request to withdraw consent if the processing is for the purpose of, or for complying with, applicable law or court order, the withdrawal may adversely affect and harm the rights and freedom of the Data Subject himself or other people, the processing is for research purposes that has appropriate protection for Personal Data, or the processing is for establishing legal claims, legal compliance, exercise of legal rights or defenses.

8. Criteria and Procedures for Exercise of Your Rights

1.	If you wish to exercise your right, please submit your request via email at [thailand@cordonbleu.edu] Alternatively, you may contact us at the following: Le Cordon Bleu Dusit Co., Ltd. 4,4/5 Central Tower, 17th-18th Floor, CentralWorld, Ratchadamri Road, Pathumwan, Bangkok 10330 Tel: [02 237 8877] email: [thailand@cordonbleu.edu] Please mark as “Personal Data Rights Request from the Data Subject” with your first name, last name and contact information.
2.	Your request will be sent to LCBD’s data protection officer for verification of your identity. We will require you to produce some form of photo identification (copy of a government-issued identification with signature, passport, driver’s license or Student ID Card), home or business address, phone number, information of your study with Le Cordon Bleu Dusit Culinary School, and details of products purchased. You will also be asked to sign a request form.
3.	The data protection officer will consider your request by considering various factors such as its legitimate reasons, its negative effect on a third party etc. and whether the PDPA provides for any exemptions.
4.	If your request is approved, the data protection officer will proceed and report the result to you without delay via the channel you have specified in your request.
5.	If you request is denied, the data protection officer will notify you with explanation without delay via the channel you have specified in your request. You may make an appeal to the authority as prescribed by the PDPA which LCBD will inform you in LCBD’s notification of such denial.

Remark:

The procedures above will take no more than 30 (thirty) days following the receipt of your request and all supporting documents.
LCBD’s process will not incur any costs to you. But if there is any cost, LCBD will notify you prior to taking any action.

TOP