Privacy Policy | Chalad Labs

1. Introduction

Chalad Labs ("we", "us", "our") operates an online AI development school. We are committed to handling your personal data with care and transparency. This policy explains what data we collect from learners and website visitors, how we use it, and what rights you have under the Personal Data Protection Act B.E. 2562 (PDPA) of Thailand.

If you have questions about how your data is handled, you can contact us at [email protected] before providing any information to us.

2. Data We Collect

2.1 Information you provide directly

Full name and email address (required for enquiries and enrolment)
Phone number (optional, provided when you choose to share it)
Message content submitted through the contact form
Payment details (processed through our payment provider; we do not store card data)

2.2 Data collected automatically

Browser type, device type, and operating system
Pages visited and time spent on those pages
Referring website or search term
IP address (anonymised where possible)
Cookie identifiers (see Section 5)

2.3 Legal basis for processing

Contractual necessity: processing your enrolment, delivering programme content, and providing support
Consent: analytics and marketing cookies; responding to enquiries from non-enrolled visitors
Legitimate interest: fraud prevention, security, and website improvement
Legal obligation: retaining financial records as required by Thai law

2.4 Retention periods

Learner account and programme records: 3 years after programme completion
Financial transaction records: 5 years (Thai Revenue Code requirement)
Enquiry data from non-enrolled contacts: 12 months from last interaction
Analytics data: 26 months (Google Analytics default)

3. How We Use Your Data

Delivering programme content, exercises, and mentor feedback
Responding to enquiries and support requests
Processing payments and sending receipts
Sending programme-related communications (not marketing, unless consented to)
Analysing website usage to improve content and navigation
Complying with legal and regulatory obligations

We do not sell your personal data. We do not share it with third parties for their marketing purposes. We do not send marketing communications without your explicit consent.

Third-party processors

We use the following third-party services, each of which processes data only as directed by us and under data processing agreements:

Google Analytics — website usage analytics
Payment gateway — payment processing (card data never touches our servers)
Email delivery service — transactional and support emails

4. How We Protect Your Data

HTTPS encryption on all pages and data transmissions
Access to personal data restricted to staff who need it to fulfil their role
Regular review of third-party service security practices
Password-protected internal systems with access logging
In the event of a data breach affecting your personal data, we will notify you and the relevant authority within 72 hours where required by law

5. Cookies

We use essential cookies (required for the site to function), analytics cookies (to understand how the site is used), and optional preference cookies. You can manage your cookie preferences at any time via our Cookie Policy page.

6. Your Rights

Under the PDPA, you have the following rights regarding your personal data:

Right to access: request a copy of the personal data we hold about you
Right to rectification: ask us to correct inaccurate data
Right to erasure: request deletion of your data where it is no longer needed or where consent has been withdrawn
Right to data portability: receive your data in a structured, commonly used format
Right to object: object to processing based on legitimate interest
Right to withdraw consent: withdraw marketing or analytics consent at any time without affecting prior processing
Right to lodge a complaint: contact the Personal Data Protection Committee of Thailand if you believe your rights have been infringed

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7. Third-Party Links

Our website may link to external resources relevant to our programmes (documentation, tools, articles). We are not responsible for the privacy practices of those external sites. We recommend reviewing their privacy policies before providing any personal information.

8. Children's Privacy

Our programmes are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has submitted data to us, we will delete it promptly. If you believe a minor has provided us with their information, please contact us at [email protected].

9. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "last updated" date at the top and, for material changes, notify enrolled learners by email. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

10. Contact

Data controller: Chalad Labs

Address: 17 Thanon Mittraphap, Nai Muang, Mueang, Nakhon Ratchasima 30000, Thailand

Privacy enquiries: [email protected]

General enquiries: [email protected]