1 Data We Collect

2 Parent Data & Student Linking

BBS Portal allows school administrators to pre-populate parent guardian slots by importing parent data via CSV. Parent accounts may also be linked to student records through Google Classroom roster data or the school's student information system.

• No accounts are created automatically — parents must sign in with Google One-Tap to activate their account.
• Imported parent data is never shared with any third party.
• School administrators can remove or correct this data at any time via the dashboard.
• Parents may request deletion by contacting school administration.

3 How We Use Data

• To deliver school enrolment, invoicing, and communication services.
• To manage role-based access control and protect user accounts.
• To send school-related notifications, such as parent invite links and invoice emails.
• To improve platform quality and user experience.

4 Retention and Security

Personal data is retained only as long as required for educational operations and legal obligations. The system uses Firebase Auth for identity, HTTPS encryption in transit, and Google Cloud Firestore with strict security rules.

5 Data Sharing

BBS Portal does not sell, rent, or share personal data with external parties, except infrastructure providers (Google Firebase, Gmail API) operating on behalf of the school under data processing agreements.

6 Your Rights

Under Thailand PDPA, you have the right to access, correct, delete, or port your personal data. Please contact school administration or email the BBS Portal system administrator.

7 Contact

Bangkok Bilingual School · 68 Soi Ramkhamhaeng 43/1, Bangkok 10240
Email: admin@bbs.ac.th

8 Student Data Protection (Notice to Schools)

BBS Portal operates as a software service provider. Bangkok Bilingual School acts as the Data Controller under PDPA. The school decides what data is entered, and is responsible for consent, roles, and handling deletion requests.

As the operator, BBS Portal will:

• Store data securely using encryption (HTTPS/TLS) and Firebase role-based rules.
• Process data strictly on school instructions.
• Never use student data for advertising or personal gain.
• Honour school-initiated deletion requests.

School administrators have full capability to view, correct, and delete student data, QR codes, and guardian links via the dashboard at any time. All significant actions are logged in Audit Logs.

9 Google API Services User Data Policy

BBS Portal fully complies with Google's requirements, including the <a href="https://developers.google.com/terms" target="_blank">Google APIs Terms of Service</a> and the <a href="https://developers.google.com/terms/api-services-user-data-policy" target="_blank">Google API Services User Data Policy</a>.

1Introduction

Bangkok Tawiwit School, including persons involved in the processing of personal data according to the orders or on behalf of Bangkok Tawiwit School, hereinafter collectively referred to as the “School,” recognizes the importance of personal data and other information concerning you (collectively referred to as “Data”). This is to ensure that you can trust that the School is transparent and responsible in collecting, using, or disclosing your data in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“Personal Data Protection Law”) and other relevant laws. This Personal Data Protection Policy (“Policy”) has been prepared to clarify the details regarding the collection, use, or disclosure (collectively referred to as “Processing”) of personal data carried out by the School, its officers, and related persons acting on behalf of the School.

2Scope of Policy Application

This policy applies to the personal data of persons who have a relationship with the School at present and may have in the future, whose personal data is processed by the School, personnel, students, service recipients, other persons, or other types of agencies operated by the School. This includes contractors or third parties who process personal data on behalf of or in the name of the School (“Personal Data Processor”) under various products and services such as websites, systems, applications, documents, or other forms of services controlled by the School (collectively referred to as “Services”).

Persons having a relationship with the School under the first paragraph include:

1. Executives, personnel, employees, officers, or staff
2. Students or service recipients
3. Parents, guardians, curators, or protectors of students
4. Research participants or activity participants
5. Committees or sub-committees appointed by the School
6. Individual customers
7. Partners and service providers who are natural persons
8. Directors, attorneys, representatives, agents, employees, or other persons with a similar relationship to legal entities having a relationship with the School
9. Users of the School's products or services
10. Visitors or users of the website www.bbs.ac.th, including systems, applications, devices, or other communication channels controlled by the School
11. Other persons whose personal data is collected by the School, such as job applicants, family members of staff, guarantors, insurance policy beneficiaries, etc.

Items 1) to 6) are collectively referred to as “You”.

In addition to this Policy, the School may establish a Privacy Notice (“Notice”) for specific operations or services to clarify to the data subjects the specific personal data processed, objectives, lawful basis, retention periods, and rights. In case of significant conflict between the Notice and this Policy, the provisions of the specific Service Notice shall prevail.

3Definitions

• Personal Data: Information about a natural person which makes it possible to identify that person, whether directly or indirectly, but excluding the information of deceased persons specifically.
• Sensitive Personal Data: Personal data as provided in Section 26 of the Personal Data Protection Act B.E. 2562, including race, ethnicity, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, labor union information, genetic data, biometric data, or any other data affecting the data subject in a similar manner as announced by the Personal Data Protection Committee.
• Processing of Personal Data: Any operation performed on personal data, such as collecting, recording, copying, organizing, storing, updating, changing, using, retrieving, disclosing, forwarding, publishing, transferring, merging, deleting, destroying, etc.
• Data Subject: A natural person who is the owner of the personal data that the School collects, uses, or discloses.
• Data Controller: A person or legal entity with the power and duty to make decisions regarding the collection, use, or disclosure of personal data.
• Data Processor: A person or legal entity that performs operations regarding the collection, use, or disclosure of personal data according to the orders or on behalf of the Data Controller. Such a person or legal entity is not the Data Controller.

4Sources of Personal Data Collected by the School

The School collects or obtains various types of personal data from the following sources:

• Data collected directly from the Data Subject: For educational services, activities, or through various channels such as application, registration, job application, signing contracts, surveys, or contacting the School at the office or through other controlled channels.
• Data collected from usage: Such as website behavior tracking via Cookies or software on the device.
• Data collected from other sources: Where the source has legal authority or consent to disclose it to the School, such as links to government digital services, data from other government agencies under the School's mission, or necessary exchanges under contracts.

If you provide personal data of third parties to the School, you are responsible for informing them of this Policy and obtaining their consent if required.

If a data subject refuses to provide information necessary for the School's services, the School may be unable to provide those services in whole or in part.

5Collection of Personal Data

The School will collect personal data upon receiving consent from the data subject, except in the following cases:

• Contractual Basis: Necessary for providing services or performing a contract between the data subject and the School.
• Vital Interests: To prevent or suppress danger to life, body, or health.
• Legal Obligation: To comply with the law.
• Legitimate Interests: Necessary for the School's legitimate operations (e.g., fraud prevention, network security) while prioritizing the rights of the data subject.
• Research or Statistics: For historical documents, public interest research, or statistics with appropriate protection measures.
• Public Task: Necessary for public interest missions or the exercise of state power assigned to the School.

6Personal Data of Minors, Incompetent Persons, and Quasi-Incompetent Persons

For minors (not yet sui juris by marriage or status), incompetent, or quasi-incompetent persons, the School may require consent from parents, guardians, curators, or protectors as permitted by law. If the School discovers it has collected such data without proper consent, it will delete the data from the system.

7Types of Personal Data Collected

The School uses lawful methods and limits collection to what is necessary:

8Cookies

The School uses cookies and similar technologies on websites like www.bbs.ac.th to ensure security, provide convenience, and improve the website experience. You can set or delete cookies through your web browser settings.

9Purposes of Collecting Personal Data

The School collects data for various purposes, including:

• Education, research, and academic development for the benefit of society and the School.
• Student activities, teaching, and networking.
• Student selection, testing, and interviewing.
• Public relations, surveys, and opinion polls.
• International relations and coordination with other institutions.
• Registration in the Ministry of Education systems (REGIS, ORSS, E-DOC, E-SAR), student management, and behavioral records.
• Health data for safety and emergency prevention.
• Religious data for providing appropriate facilities and activities.
• Photos/videos of school atmosphere for news and PR via social media and the website.
• Analyzing website usage and Log Files for troubleshooting.
• Notifications and assistance.
• Procurement and contracts.
• Accounting and finance (billing, auditing, legal transactions).
• Legitimate interests (CCTV, security).
• Compliance with School regulations.
• Job applications and employment.
• Investigations, disciplinary actions, or legal disputes.
• Communication, responding to requests, and complaints.
• Marketing and customer relations.
• Other purposes with explicit consent.

10Forwarding and Disclosing Personal Data

The School will not disclose your personal data to external agencies unless explicit consent is given or:

• It is necessary for partners, service providers, or external agencies under a data processing agreement.
• Sharing with affiliated schools for purposes stated in this Policy.
• Required by law or legal process (disclosure to government officials or authorities).

11International Data Transfer

The School may transfer data abroad (e.g., Google Education Suite servers). The School will ensure the destination has adequate protection measures according to international standards.

12Retention Period

Data is kept only as long as necessary for its purpose or as required by law. Afterward, data will be deleted, destroyed, or anonymized. In case of disputes or lawsuits, data may be kept until a final judgment is reached.

13Data Protection

The School uses appropriate technical and administrative measures, including encryption for internet transmission and access control for both physical and electronic documents.

14External Links

School services may link to third-party websites with different policies. The School is not responsible for the content or privacy practices of these external sites.

15Data Protection Officer (DPO)

The School has appointed a DPO to monitor, advise, and coordinate with the Office of the Personal Data Protection Committee.

16Your Rights under PDPA B.E. 2562

You may exercise the following rights:

• Right to access and obtain a copy of personal data.
• Right to correct data.
• Right to data portability.
• Right to erasure or destruction of data.
• Right to restrict processing.
• Right to withdraw consent.
• Right to object to collection, use, or disclosure.

17Penalties for Non-Compliance

Failure to follow this policy may result in disciplinary action (for staff) or penalties under the Personal Data Protection Act B.E. 2562 and related regulations.

18Complaints to Authorities

If the School fails to comply with the law, you have the right to complain to the Personal Data Protection Committee. However, the School requests that you contact us first to resolve concerns.

19Policy Updates

The School may update this policy and will notify you via www.bbs.ac.th. Continued use of services after an update constitutes acknowledgment of the new policy.

20Contact Information

To exercise your rights or ask questions:

Please provide your Name-Surname, ID/Passport number, the specific concern or right you wish to exercise, and contact details (phone, address, email).

Announced on August 22, 2025