Announcement of Sripathum University

Subject: Sripathum University’s Personal Data Protection Policy

( Personal data protection policy of Sripatum University)

—————————————————–

Currently, there is a violation of the privacy rights of personal data, which causes annoyance and damage to the owner of the personal data. In addition, the advancement of technology makes the collection, use or disclosure of personal data that is a violation easy, convenient and fast. Sripathum University recognizes the importance of such violation of the privacy rights of personal data. Therefore, the Personal Data Protection Policy has been established to protect the personal data that Sripathum University has collected, used or disclosed, and to allow the owner of the data to be aware of and understand the personal data protection policy, including the rights under the Personal Data Protection Act B.E. 2562.

Therefore, in accordance with the powers under Section 43 (1) of the Private Higher Education Institutions Act B.E. 2546 and the Personal Data Protection Act B.E. 2562, the following announcement is issued:
Section 1 This announcement is called the “Sripathum University Announcement on the Sripathum University Personal Data Protection Policy 2020”.
Section 2 This announcement shall come into force from now on.
Article 3 Definitions
“University” means Sripathum University, Bangkhen Campus, Sripathum University, Chonburi Campus, Sripathum University, Khon Kaen Campus.
“Personal Data” means information about an individual which enables the identification of that individual, either directly or indirectly, in accordance with the Personal Data Protection Act, but does not specifically include information about a deceased person.
“Data Owner” means a natural person or legal entity who is the owner of personal data.
Section 4 Collection, use or disclosure of personal information
4.1 The University will collect personal data with purposes, scope and methods that are lawful and fair. The University will only do so to the extent necessary for providing educational services, organizing educational activities or providing services by any other electronic means under the University’s objectives. The University will notify the data owner and provide consent in accordance with the forms and methods specified by the University.
In addition, the University may collect personal data related to the interests and services used, which may include race, ethnicity, religious or philosophical beliefs, sexual behavior, criminal history, health information, disability, identity or any other information that is useful for using educational services. However, in the above cases, the University will request consent from the data owner before collecting it.
4.2 The University will disclose personal information only for the purposes, scope and under the consent of the data owner who has provided it to the University and will use lawful and fair methods. The University will do so only to the extent necessary for providing educational services, organizing educational activities or services by any other electronic means under the University’s objectives only.
Section 5 Purpose of collecting, using or disclosing personal information
The University shall collect, store, use and disclose personal data in an orderly manner and in accordance with the law for the benefit of management, providing services to data owners when using various services, such as contacting, inquiring, making complaints, providing suggestions, including other matters necessary for the University or for the benefit of analyzing data, presenting services or products of the University or its representatives, and for any other purposes not prohibited by law or to comply with laws or related regulations, both currently in effect and to be amended or added in the future, including allowing the University to send, transfer and/or disclose personal data to business groups, business partners who have contracts with the University, including government agencies and organizations with legal authority. The University shall retain such data only for the period necessary for these purposes. The University may review and amend this Policy from time to time to comply with the Act and/or secondary laws, regulations, announcements of government agencies that come into force later, and the University will announce it to you.
The University will process personal data only after receiving consent from the data owner, except for processing under the following data processing bases:
5.1 Contract Basis When a user applies for membership or does not become a member, including using other services, it is essential that the data owner provides the University with information so that the University can process such personal information in relation to the provision of services in accordance with the terms and conditions of the service agreement, including using it to communicate with the data owner, track and inform about benefits of products or services. If the data owner does not provide such personal information, the University will not be able to use the data owner’s services, will not be able to provide benefits in accordance with the terms and conditions, will not be able to communicate or verify the ability to enter into contracts, and will not verify the identity of the data owner.
5.2 Consent Basis In necessary cases, the University may use the personal data of the data owner for processing to design or develop education and/or services for offering, organizing marketing activities related to the University’s education, or collecting, using or disclosing the personal data of the data owner.
5.3 Legitimate Interest: In necessary cases, the University may use the personal data of the data owner for processing for management and reporting purposes within the University, system maintenance, to maintain standards or develop services, risk management within the University, internal control and auditing, which are necessary for the legitimate interests of the data controller and the use of the data processor.
5.4 Legal Obligation In the event of necessity, the University may use the personal data of the data owner to process the data in order to comply with the law, both currently in effect and those to be amended or added in the future.
Article 6 Data security measures
6.1 Sripathum University recognizes the importance of personal data protection (Data Privacy), which is considered a fundamental right to privacy (Privacy Right). Therefore, it has determined measures to maintain the security of personal data appropriately and in accordance with the university’s information technology security policy and to maintain the confidentiality of personal data to prevent loss, access, destruction, use, modification, alteration or disclosure of personal data without permission or illegally, as well as to prevent the use of personal data without permission.
6.2 Personal information received by the University, such as name-surname, address, telephone number, national ID card number, email, financial information, etc., which can identify the owner of the information and is personal information that is accurate and current, will be used only in accordance with the operational objectives of the University, and the University will take appropriate measures to protect the rights of the owner of the personal information.
Article 7 Restrictions on collection, use or disclosure of personal data
7.1 The University will keep personal data and protect personal data from unauthorized access, alteration, disclosure or destruction of data held by the University. The use and/or disclosure of personal data must be approved by the data owner and must be for the purpose of collecting, using or disclosing personal data of the University only. The University will supervise the staff and employees of the University not to use and/or disclose personal data of the data owner outside of the purpose of collecting personal data or disclosing to external parties, except
7.1.1 Compliance with the law
7.1.2 For the benefit of the investigation of the investigator or the court’s consideration of the case.
7.1.3 It is for the benefit of the data owner and the request for consent cannot be made at that time.
7.1.4 It is necessary for the legitimate interests of the University or of another person or entity.
7.1.5 It is necessary to prevent or suppress a danger to the life, body or health of an individual.
7.1.6 It is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract.
7.1.7 To achieve the objectives of the University regarding the preparation of historical documents or archives for public benefit or for study, research, or statistics, for which appropriate measures have been provided.
7.2 Duration of storage The University will store the personal data of the data owner for the minimum period stipulated by the relevant laws or will store the personal data for at least 10 years after the end of the relationship with the University. However, the University may continue to store the personal data after the end of such period if the University deems that it is still necessary to store the data for use in accordance with the purposes for which it was collected or for any other necessity that the University deems appropriate, such as to enforce the rights under the law or under the University’s contract, etc.
Article 8 Personal Data Protection Officer
The University has implemented the Personal Data Protection Act B.E. 2562 by appointing a Data Protection Officer (DPO) to inspect the University’s operations related to the collection, use or disclosure of personal data to comply with the Personal Data Protection Act B.E. 2562 and laws related to personal data protection. In addition, the University has prepared regulations and orders for relevant persons to proceed as specified in order for the implementation of the policy on personal data protection to proceed smoothly.
Section 9 Contact channels
Sripathum University
Address: 2410/2 Phahonyothin Road, Senanikhom Subdistrict, Chatuchak District, Bangkok 10900
Telephone number: 0 2597 1111 , 0 2561 2222
Fax : 02 561 1721
Email: DPO@spu.ac.th