Privacy notice

1. Data controller

Assumption University, through the Bernadette de Lourdes School of Nursing Science, which hosts the event and administers registration.

Address: Martin de Tours Hall (M Building), 2nd Floor, 592/3 Soi Ramkhamhaeng 24, Hua Mak, Bang Kapi, Bangkok 10240

Data Protection Officer (DPO): School of Nursing Science, Assumption University — abacnurse@au.edu, (+66) 2783 2222 ext. 3505

2. What we collect

• Identity and contact: title, name in Thai and English, nickname, email, phone number (if given)
• Education and demographics: attendee type, year of study, institution, province, gender, year of birth (never a full date), position (teachers and staff)
• Interests: faculties of interest, how you heard about the event, activities booked, and satisfaction survey answers
• Guardian details (attendees under 20): a parent or guardian’s name and phone number
• Possibly sensitive, optional: dietary needs and accessibility needs, which can reveal health, disability or religious belief
• On the day: check-in time, the staff member who checked you in, certificates issued, and photographs, video and audio recorded at the venue
• Technical: cookies, sign-in and system activity records, your IP address, the approximate location our web host derives from it (country, region, city — never your device’s GPS position), device type, operating system and browser, and — only with your consent — pages visited and buttons pressed
• We do not collect national ID numbers or biometric data (such as face recognition).

3. Purposes and lawful basis

We use data only for the purposes below. Before using it for any other purpose we will tell you and, where required, ask for consent (section 21).

4. Photography, video and audio at the event

• University photographers and video crews record photographs, video and audio at the venue, and some sessions may be streamed live. Signs mark the areas being recorded.
• General shots of crowds may include you incidentally. These are used for reporting and the archive.
• Images or clips that focus on you (close-ups, interviews, recordings of your voice) are used in publicity only with your consent — and for anyone under 20, with a guardian’s consent as well.
• If you would rather not be recorded, ask at registration for a “no photos” marker; photographers will avoid you.
• If you find a published image of yourself, you can ask us to remove it from university channels. We will act promptly for future publication, but cannot recall copies others have already shared.
• Photographs attendees take themselves are the responsibility of whoever takes them. Please respect other people’s privacy.

5. Who we share data with

• Within the university: only assigned staff of the School of Nursing Science, limited to what their role needs. The list with contact details is available to administrators only, and every access is logged.
• Service providers that process data on our behalf (processors), listed in section 6, under contracts restricting them to our instructions.
• We do not share your data with other outside organisations for their own purposes. If that ever changes, we will name the organisation and ask for your consent first.
• Public authorities where the law requires.
• We do not sell personal data.

6. Servers outside Thailand

This system runs on cloud services, so your data is stored or processed on servers outside Thailand — in Singapore, Japan, the United States and Germany, as the table shows. Transfers follow sections 28 and 29 and the related notifications of the Personal Data Protection Committee: each provider is bound by a data processing agreement with appropriate safeguards, data is encrypted in transit and at rest, and access is restricted.

7. Cookies and website usage logs

• Necessary cookies (always on): sign-in cookies (blns_at, blns_rt), a signed-in indicator (blns_si) and a record of your cookie choice (dl_consent). The site cannot work without them.
• Analytics cookie (consent required, off by default): a random visitor id (dl_vid) used to log pages visited, buttons or links pressed, time on a page, device, IP address and approximate location, so we can improve the site. We never log what you type into forms, and never URL parameters.
• Usage logs are stored in our own database, are not shared with advertisers, and can be viewed only by the superadministrator.
• Change your choice at any time from “Cookie settings” at the bottom of the site. Your choice lasts 180 days.
• For your security you are signed out automatically after 6 hours without activity.

8. How long we keep data

9. Your rights

• Access and obtain a copy (s. 30), and receive your data in a machine-readable format (s. 31)
• Object to processing based on legitimate interests (s. 32)
• Have data erased or anonymised (s. 33), or its use restricted (s. 34)
• Have data corrected (s. 35), and withdraw consent at any time without affecting what was done before (s. 19)
• Complain to the Office of the Personal Data Protection Committee (www.pdpc.or.th)
• From the Profile menu you can correct your details, change consent, download a report of your data (PDF or JSON) and ask for deletion yourself. For other rights, contact the DPO in section 1. We reply within 30 days and may first verify your identity.

10. Minors

Registrants under 20 are minors under section 19 of the Civil and Commercial Code and must give the name and phone number of a parent or guardian who is aware of and consents to the registration, as PDPA section 20 requires. A guardian may exercise the rights in section 9 on the minor’s behalf. To inform guardians as section 25 requires, a minor receives a link to the “notice for parents and guardians” (the /guardian-notice page) on screen and in the confirmation email, to forward by LINE or SMS.

11. Security

TLS in transit, encryption at rest, and field-level encryption for values such as phone numbers; row-level security in the database; an append-only record of every consequential access; automatic sign-out when idle. If a breach occurs we notify the PDPC Office within 72 hours of becoming aware of it, and notify you without delay if it poses a high risk to your rights (s. 37).

12. Changes to this notice

We may update this notice. The version in force is shown at the top, and each consent records the version you gave it under. For a material change we will tell you and ask for consent again where required.