Who is responsible
TECH Infinity Education Co., Ltd. handles data for the One purposes described here. Contact info@techeducationth.com, corporate@th-tiis.com, 02 686 1202 or 093 326 3776 for privacy matters. These are coordination contacts, not a statement appointing a DPO.
Providers and organizations that determine their own purposes must explain their role and privacy notice. Processing solely on an organization's instructions requires a defined scope and processing agreement; One is not automatically a processor in every case.
What we use and why
Account details, name, email, sign-in method, organization and role support identity and requested services. Optional interests and goals support recommendations and can be edited in the account.
Booking, attendance, submissions, feedback and evidence support learning and portfolio access. Payers and learners are distinct. Qualifications and assessments require verified sources; buying a package does not establish competence.
Provider, authority, rights evidence, images and source files support application review, content management and requested documents. Upload only necessary information and redact unrelated third-party details.
Requested services rely on contractual or pre-contractual necessity; legal obligations apply where required. Security and fraud prevention require assessed legitimate interests. Optional marketing and analytics use separate consent, not bundled acceptance of service terms.
Do not submit sensitive data through general text fields. Any necessary sensitive-data activity requires a specific notice, lawful basis and safeguards first. Minors require appropriate consent and legal-representative arrangements under applicable law.
Access and disclosure
Learners access their own data. Providers and staff access authorized tasks within their role and organization. Private evidence is not public artwork. Instructor profiles, storefronts and selected portfolio items are published within the chosen scope.
Hosting, file storage, identity and enabled integration providers may process necessary data under applicable agreements and safeguards. Subprocessors and processing locations require review per system. Live payments, cash refunds and automated outbound email remain closed in this review release.
Each AI use must explain the data sent and provider before use. This notice does not grant permission to train general models on private documents or work. Do not send confidential or sensitive data without an appropriate basis and safeguards.
Hosting and international transfers
The Sites review website uses web processing, D1 and R2. Hostinger is a separate environment; project history describes Node.js and MySQL. The installed release, server, database, file and backup countries and subprocessors still require account-level verification. We do not claim that all data stays in Thailand.
International transfers or access require assessment under PDPA sections 28–29, including adequacy, an applicable exception or safeguards required by law, with relevant recipient agreements. Using the website or accepting cookies is not blanket consent to transfer data to any country.
Retention
The inspected Sites release sets business-event expiry at 90 days, core audit-table retention at 365 days and core snapshots at no more than 14 days with a 20-snapshot cap. Some pruning runs on reads or writes, not as an immediate deletion guarantee for every copy.
These periods do not cover every account, provider document, work item or file. Those require a category-specific schedule reflecting purpose, contract, legal obligations and disputes. Hostinger and provider backups require separate verification.
Cookies and preferences
Necessary cookies support sessions, security, language and preferences. Analytics is optional and can be declined or withdrawn through footer cookie settings while retaining core access.
One cookie preferences last up to 90 days. Browser storage may also retain interface state or notify other tabs of preference changes; it is not the authoritative store for money, entitlements or points. Marketing has a separate account preference.
Exercise your rights
Subject to legal conditions, rights may include access, copies, correction, portability, objection, erasure or anonymization, restriction and consent withdrawal. Withdrawal does not invalidate prior lawful processing. Exceptions or recordkeeping duties may require a reasoned response.
Use account controls for supported corrections and exports, or email the contacts with the request type and relevant account. Do not send passwords or excessive sensitive evidence. Staff must proportionately verify identity, record receipt and respond within applicable legal deadlines. An email link only opens your mail app; it does not submit a request.
You may contact Thailand's Office of the Personal Data Protection Committee through official channels about unlawful processing. Data incidents require risk assessment, remediation and regulatory or individual notification when legally required.