Personal Data Processing Notice ( Privacy Notice)
For those interested in further study or interested in university information

Sripatum University (“the University”) would like to inform you about the University’s Personal Data Processing Notice. As this Notice explains how the University will treat your personal data, in order to protect your personal data that the University will collect, use or disclose, the University has issued this Notice and the University would like you to read this Notice to know and understand the University’s objectives in collecting, using or disclosing your personal data, as follows:

1. Purpose of collecting, using or disclosing personal information
The University aims to provide education to students with knowledge and expertise, respond to needs in line with the national economic and social conditions, and emphasize the missions of higher education institutions in terms of learning, teaching, research, providing academic services to society, and preserving the good arts and culture of the nation. In order to achieve these objectives, the University will collect, use, and disclose personal information only as necessary for the University’s operational objectives and under the Personal Data Protection Act B.E. 2562, according to the following objectives and bases:

(1) Contract basis
It is necessary for you to provide personal data to the University when you use the service or contact about the service offer or enter into a contract with the University so that the University can process such data in relation to the provision of services or entering into a contract or for the University to communicate or to follow up and inform you about the performance of the contract.

(2) Consent basis
Where necessary, when you have given your consent to the University, the University may use your personal data for processing for designing or developing education or services, for offering marketing activities related to education, or for management under the University’s operations.

(3) Legitimate Interest
In necessary cases, the University may use your personal data for processing for management and preparation of necessary reports within the University, system maintenance to maintain standards or service development, risk management within the University, internal control and audit, which are necessary for the legitimate interests of the University.

(4) Archival, research or statistical bases
The University may process your personal data to achieve the purposes of compiling historical documents or archives for public interest or for studies, research, or statistics, for which appropriate measures have been taken.

(5) Vital Interest
In necessary cases, the University may process your personal data for the purpose of eliminating a danger to the life, health or safety of you or another person.

(6) Public Task
In necessary cases, the University may use your personal data for processing to perform duties in the public interest or to exercise state powers assigned to the University.

(7) Legal Obligation
In the event of necessity, the University may use your personal data for data processing to comply with laws currently in effect and those that may be amended or supplemented in the future.
Personal data that the University has collected, used or disclosed your personal data in accordance with the purpose of using the service, together with the lawful basis for processing personal data in each activity as follows:

The University may use more than one legitimate data processing base for processing your personal data, depending on the purposes for which the University uses your personal data.

2. Marketing and promotion activities

The University or an external party with whom the University has an agreement may conduct marketing and promotional activities. Your personal data will be used for the following marketing and promotional activities:

(1) Direct Marketing Activities: The University will conduct direct marketing activities only if you have given your express consent to the University as the University has informed you of the purpose of using your data. You have the right to withdraw your consent at any time through the University’s data cancellation system.

(2) Activities to promote marketing: The University will conduct activities to promote student recruitment, such as gaming activities or activities on social networks, public relations activities for the University’s courses and services. The University will inform you of this activity. The University will not use the information for direct marketing unless you give your express consent for direct marketing, as the University has informed you of the purpose of using the information. You have the right to withdraw your consent at any time through the University’s data cancellation system.

3. Personal data that the university will process

3.1 General personal information
(1) Personal information: Name-surname, date/month/year of birth, gender, nationality, ID card number or other official documents that can identify the individual.
(2) Contact information: address as per house registration, address where contact can be made, email, telephone number, fax number, LINE ID.
(3) Educational history information: educational institution graduated from, academic qualifications, academic results
(4) Technical information: Usage and behavior of searching for information on the website. The University may use cookies as a tool for collecting information, such as IP address, type of web browser used to access the website, pages visited, time of visit, websites referring to the University website, and information indicating your location while using the University website.
(5) Other information: Records of conversations and communication information between university officials and you, faculty of interest, field of study of interest, reasons for applying to study.

3.2 Personal information that is sensitive information ¹
Personal information: Nationality, Religion
The University must request your explicit consent before or at the time of collecting sensitive personal data in accordance with the criteria set by the University without violating the law.

4. Source of personal information
The University will collect, use or disclose your personal data from the following sources:

4.1 Personal data is collected directly from you when:
(1) You visit the university website ( Cookies )
(2) You provide information to the University through the website or application.
(3) You provide information to the University through inquiries via the University’s online channels or normal channels.
(4) You provide information to the university through responding to questionnaires from university public relations activities.
(5) You provide information to the University through marketing or public relations activities of the Public Relations Group.
(6) You provide information through the Sripatum University Management Information System or the Sripatum Campus Management System (SCMS) of the university.

4.2 Collect personal information from sources other than you directly when
You provide information to universities through agents who provide educational advisory services both domestically and internationally.

5. Disclosure and transfer of personal data

5.1 Disclosure, transmission or transfer of personal data
The University may disclose, transmit or transfer your personal data to third parties with your consent and will use it for the purposes specified in this Processing Notice as follows:
(1) Affiliated companies
(2) Online marketing tools
(3) Marketing companies or consultants
(4) Regulatory agencies, such as the Personal Data Protection Commission.
(5) Business or professional consultants.
(6) Contracting Bank
(7) The agency where the student wishes to intern or apply for employment.
(8) Government agencies related to the operation of universities in the field of education, such as the Ministry of Higher Education, Science, Research and Innovation (MHESI) and the Office of the Higher Education Commission, Social Security, Student Loan Fund, Student Loan Fund tied to future income, etc.

5.2 Disclosure, sending or transfer of personal data abroad
In the event that the University discloses, sends or transfers your personal data abroad, the University will transfer or transfer to the destination country, international organization or overseas recipient that has adequate measures to protect personal data and the University may request your consent for the transfer of personal data abroad as required by law.
Third parties who receive your personal data from the University must not use or disclose that data for any purpose other than those notified to the University.

6. Rights as a data owner
You have the right to take the following actions to the extent permitted by law:
(1) The right to request the withdrawal of consent.
If you have given consent for the University to collect, use and disclose your personal information, you have the right to withdraw your consent at any time during the period that your personal information is with the University, unless such right is restricted by law or a contract that benefits you. However, your withdrawal of consent will not affect the collection, use or disclosure of your personal information to which consent has been given in accordance with the law.
(2) The right to request access to personal data.
You have the right to request access to and obtain a copy of your personal data held by the University or request that the University disclose the source of such personal data to which you have not given consent.
(3) The right to request correction of personal data.
You have the right to request that the University correct your personal data to be accurate, current, complete and not misleading.
(4) The right to request deletion or destruction of personal data.
You have the right to request the University to delete or destroy your personal data if it is found that such data is no longer necessary for collection, use or disclosure in accordance with the University’s objectives, or in the event that you have withdrawn your consent and the University has no authority to collect, use or disclose your data, or in the event that you have exercised your right to object to the collection, use or disclosure of data and the University cannot cite grounds for rejecting the objection, or in the event that the University has collected, used or disclosed your personal data unlawfully.
(5) The right to request suspension of use of personal data.
You have the right to request the University to suspend the use of your personal data in the event that the University is conducting a verification process in accordance with your request to exercise your right to correct your personal data or request to suspend the use of your personal data instead of deleting or destroying personal data that is unlawful or no longer necessary, or your personal data is in the process of being proven in the event that you have objected to the University collecting, using or disclosing your personal data in order to refuse to exercise your right to object as mentioned above.
(6) The right to request, send or transfer your personal data.
You have the right to request that the University has made the personal data available in a format that can be read, used or disclosed by automated tools or devices, and you have the right to request that the University transmit or transfer the personal data in such a format to another data controller, including the right to request that the University transmit or transfer the personal data directly to such another data controller, unless this is not possible due to technical reasons.
(7) The right to object to the processing of personal data.
You have the right to object at any time to the University’s collection, use or disclosure of your personal data where the University is using legitimate interests, unless the University demonstrates compelling legitimate grounds, or for direct marketing purposes or scientific, historical or statistical research, unless it is necessary for the University’s public interest missions.
(8) Right to lodge a complaint.
You have the right to lodge a complaint with the relevant legal authority if you believe that the University’s collection, use or disclosure of your personal data violates or fails to comply with relevant laws.

7. Measures to maintain the security of personal data
In order to prevent the risk that your personal data may be unlawfully accessed, leaked, altered, lost or disclosed without authorization or in violation of the law, the University has security measures to protect your personal data by limiting the right to access your personal data, which will be specified to be accessible only to those permitted by the University in accordance with the University’s care measures to protect your personal data.

8. Period for collecting, using or disclosing personal information
The University will collect, use or disclose your personal data only as necessary to fulfil the purposes set out in this notice within 5 years from the date you provided your personal data to the University, except that the University may continue to retain your personal data if it deems it necessary or a longer retention period is required by law.
The University will delete or destroy your personal data when it is no longer necessary or when the period for that purpose has expired.

9. Potential impact on you
If you do not consent to provide personal data to the University, it may affect your convenience in accessing the services for the purposes of this processing notice.

10. Changes to the Notification of Personal Data Processing
The University may revise, change or amend this Processing Notice to comply with the University’s operations and relevant laws, which will be announced on the University’s website at www.spu.ac.th , www.chonburi.spu.ac.th , www.khonkaen.spu.ac.th.

11. Information about the personal data controller and personal data protection officer
If you have any questions about personal data protection, you can contact us as follows:
(1) Personal Data Controller: Sripathum University, No. 2410/2 Phahonyothin Road, Senanikhom Subdistrict, Chatuchak District, Bangkok.
(2) Personal Data Protection Officer: Any person or agency of the University responsible for protecting personal data can be contacted at telephone number 0 2561 1111, 0 2561 2222 or fax 0 2561 1720 or E-mail: DPO@spu.ac.th.