Personal Data Retention Policy
The Thai Cuisine Academy (TCA) places the highest priority on protecting and securing the personal data of customers, partners, and all stakeholders. We collect and process personal data carefully and transparently in accordance with applicable laws, including the Personal Data Protection Act (PDPA), and international privacy standards such as the GDPR, to ensure data subjects are fully protected.
- Purpose of this Policy
This policy sets out clear principles, methods, and measures for storing and managing personal data, appropriate retention periods, and procedures for deletion, destruction, or anonymization when the data is no longer necessary, to ensure lawful and transparent handling. - Scope of Collected Data
TCA collects personal data in various categories, including basic contact information (name, phone number, email, and address), transaction and service history, data from subscriptions, surveys, or event participation, and technical data from devices and the website such as IP addresses, cookies, and logs. These data are used for specified purposes with the consent of the data subject. - Retention Periods
Personal data will be retained only as long as necessary for the stated purposes. Examples: registration data will be kept until account cancellation or up to 5 years from last activity; financial and tax records up to 10 years as required by accounting law; website usage data up to 2 years or until consent is withdrawn; inquiry or complaint records up to 3 years after case closure. When retention periods expire, TCA will securely delete or destroy the data promptly. - Storage and Security Measures
TCA implements comprehensive technical and administrative security measures to prevent unauthorized access, use, or disclosure of personal data. Measures include encryption, role-based access controls, backup systems to prevent loss, regular security assessments to identify and fix vulnerabilities, and continuous staff training on data protection. - Deletion and Destruction
When personal data is no longer required or retention periods have expired, TCA will securely delete or destroy data according to international standards to prevent recovery. Physical documents will be destroyed by methods that prevent reconstruction, such as shredding. Where necessary for statistical analysis, data will be anonymized so it cannot be linked to an individual. - Data Subject Rights
Data subjects have legal rights to access their personal data, request corrections, deletion, restriction of processing, or withdraw consent. Data subjects may contact TCA's Data Protection Officer (DPO) to exercise these rights through the published contact channels. TCA will process requests promptly and in accordance with applicable law. - Policy Updates
TCA reserves the right to update this policy as appropriate to remain consistent with legal or international standard changes. The latest version will be published on the website and communicated through appropriate channels to ensure personal data is protected effectively and up to date.