The Alumni · Published document
PRIVACY AND PERSONAL DATA PROTECTION POLICY
PRIVACY AND PERSONAL DATA PROTECTION POLICY
PDPA Privacy Policy - The Alumni Platform by Univerza
1. Introduction & Scope
UNIVERZA CO., LTD. (hereinafter referred to in this Policy as the
"Company"), as the developer and service provider of The Alumni,
an alumni social community platform, together with educational
institutions, faculties, and alumni associations (hereinafter referred
to in this Policy as the "Institution"), recognizes and places the
utmost importance on the protection of Personal Data and the respect of
the privacy rights of all Users.
This Privacy and Personal Data Protection Policy (the "Privacy
Policy") is established to inform service users, Members, alumni, and
personnel (hereinafter referred to in this Policy as the "Data
Subject" or "User") of the purposes, conditions, lawful bases,
retention periods, security measures, and rights under the Personal Data
Protection Act B.E. 2562 (2019) (PDPA).
2. Legal Definitions
For the purposes of this Privacy Policy, the following terms shall have
the meanings set forth below:
- Personal Data: means any information relating to an individual
that enables the identification of such individual, whether directly
or indirectly, but does not include information relating
specifically to a deceased person. - Sensitive Data: means Personal Data of a sensitive nature under
Section 26 of the Personal Data Protection Act B.E. 2562 (2019),
such as biometric data, health data, religion, race, or criminal
records. - Data Controller: means a person or juristic person having the
power and duty to make decisions regarding the collection, use, or
disclosure of Personal Data, including UNIVERZA CO., LTD. together
with the relevant educational Institution. - Data Processor: means a person or juristic person that carries
out activities relating to the collection, use, or disclosure of
Personal Data pursuant to the instructions of, or on behalf of, the
Data Controller. - Data Subject: means the individual to whom the Personal Data
relates, including applicants for membership, alumni, personnel, and
Users of the Platform.
3. Categories of Personal Data Collected
The Alumni collects Personal Data only to the extent necessary for the
relevant functions of the Platform. Such Personal Data includes
information displayed or managed through the profile editing interface
and other Platform functions, and is categorized as follows:
- Identity Data: first name and surname, nickname, date of birth,
gender, profile photograph, national identification number and/or
taxpayer identification number (collected only where required for
donation-related e-Tax purposes). - Contact Data: mobile telephone number (verified through a
six-digit OTP), email address, contact address, and social media
accounts. - Alumni & Career Data: faculty affiliation, class or cohort,
major/department, activity groups, Verified Badge membership status,
employer or workplace name, job title or position, and educational
and employment history. - Location Data: GPS location data used for location-based map
services (collected only when the User enables the Location
Service). - Business Profile Data: business name, business category,
merchant discount details, and business or store location. - Technical Data: IP address, device information or Device ID, and
system usage history, including Traffic Logs retained for not less
than 90 days.
4. Purposes & Lawful Bases
The Company processes Personal Data pursuant to the lawful bases
provided under the Personal Data Protection Act B.E. 2562 (2019),
categorized according to the principal purposes and lawful bases as
follows:
4.1 Contractual Basis
The Company processes Personal Data for the performance of the agreement
governing the provision of The Alumni Platform, including six-digit OTP
identity verification, creation of Member accounts, provision of Class
community services, news feeds, photo albums, chat services,
administration of the alumni directory, and business profiles.
Relevant Personal Data: mobile telephone number, first name and
surname, faculty/class or cohort affiliation, profile photograph, job
position, chat data, and post content.
4.2 Consent Basis
The Company processes Personal Data on the basis of consent voluntarily
provided by the User, including sharing and displaying location
information through the Friend's Location map service, displaying
names and statistics in the Donor Directory, and transmitting
information to the Thai Revenue Department for e-Donation tax deduction
purposes.
Relevant Personal Data: GPS location data, donation statistics,
13-digit national identification number, and/or taxpayer identification
number.
4.3 Legitimate Interest
The Company processes Personal Data for the legitimate interests of the
Company, the Institution, or third parties, provided that such
processing does not override the fundamental rights of the User. Such
purposes include maintaining system security, detecting and preventing
fictitious accounts, investigating fraudulent transactions and bullying
or harassment through the chat system, and producing anonymized
analytical statistics (Anonymized Insights).
Relevant Personal Data: IP address, Device ID, Traffic Log, and
records of account Reports/Blocks.
4.4 Legal Obligation & Vital Interest
The Company processes Personal Data for compliance with applicable legal
obligations and for purposes relating to vital interests, including
retaining computer traffic data in accordance with applicable Thai laws
governing computer-related offences for not less than 90 days;
maintaining accounting records and financial evidence for submission to
the Thai Revenue Department for a period of 5--10 years; protecting the
welfare and safety of children; and preventing child sexual abuse and
exploitation, including Child Sexual Abuse Material (CSAM).
Relevant Personal Data: System Activity Logs, financial transaction
history, transfer slips, e-Tax documentation, and evidentiary records
relating to detected serious violations.
5. Micro-Privacy Protection Mechanisms and Security Innovations
- Micro-Privacy Toggle: Members may independently enable or
disable the display of individual Personal Data fields, including
telephone number, email address, date of birth, and job position, on
their public profile. - Per-Class Privacy: Members may independently configure different
levels of information disclosure for each individual Class to which
they belong. - Ghost Mode: A heightened privacy mode for executives or VVIP
Members under which only the User's name and profile photograph are
displayed, while other Members are prevented from accessing detailed
profile information or tracking the User's location. - Three-Level Map Location Mode: Users may select from three
location-display modes: (1) current real-time location; (2) an
approximate location obscured within a radius of approximately 1--3
kilometers; and (3) a fixed or last-known location. - Donation Privacy Choice: Donors may select from three display
options in the Donor Directory: (1) display the donor's name and
donation amount; (2) display the donor's name while concealing the
donation amount; or (3) make the donation without disclosing the
donor's identity (Anonymous Donor). - Double-Blind Voting System: For official elections, the system
maintains voter-turnout records (Turnout) separately from raw
vote or score records (Score) and permanently removes the
linkage to the voter's ID.
6. Disclosure & Data Sharing
The Company does not have a policy of selling, publishing, or exchanging
Personal Data with third parties for commercial benefit, except in the
following circumstances:
- where the Data Subject has provided explicit consent;
- where Personal Data is disclosed to external service providers
acting as Data Processors, such as SMS OTP service providers and
cloud server providers; - where Personal Data is disclosed to the Thai Revenue Department in
connection with an e-Donation tax deduction requested by the User;
or - where disclosure is made in compliance with a court order or to a
government authority having lawful authority, including where there
are reasonable grounds to believe that the matter involves a serious
criminal offence, child sexual abuse or CSAM, or a threat to the
safety of an individual.
7. Data Retention Period
The Company determines Personal Data retention periods according to the
applicable purposes of processing and the relevant categories of
Personal Data, as follows:
7.1 Member Account and Profile Data
Member account and profile data is retained for as long as the User's
account remains active. Where the User requests permanent account
deletion (Delete Account), the data will enter a Soft Delete
status for seven days to protect against accidental deletion, after
which the data will be permanently deleted (Hard Delete) from the
primary system.
7.2 GPS Location Data
GPS Location Data is retained on a temporary basis (Real-time /
Ephemeral) and location information is cleared immediately when the
User disables the location service or when there has been no movement
for more than 24 hours.
7.3 Chat Message and Post History
Chat messages and posts are retained for as long as the User remains a
Member or until the User uses the applicable message deletion function
or deletes the relevant post.
7.4 Logs and Legal/Tax Documentation
Computer Traffic Logs are retained for at least 90 days in accordance
with applicable Thai laws governing computer-related offences. Financial
and e-Tax documentation is retained for a period of 5--10 years in
accordance with applicable provisions of the Thai Revenue Code.
8. Data Security Safeguards
The Company implements advanced technical and administrative security
measures to protect Personal Data against loss, unauthorized access, or
unlawful disclosure. Such measures include encryption of data at rest
and in transit using SSL/TLS protocols and AES-256, Role-Based Access
Control (RBAC), and the maintenance of Audit Logs relating to
access to data repositories.
9. Data Subject Rights under the PDPA
Data Subjects have the following rights under the PDPA:
- Right to Withdraw Consent
- Right to Access and Obtain a Copy of Personal Data
- Right to Object to Processing
- Right to Erasure / Right to be Forgotten, including through the
Delete Account function available on the Platform - Right to Restriction of Processing
- Right to Rectification
- Right to Data Portability
- Right to Complain to the Personal Data Protection Committee
10. Contact Information for the Data Controller and DPO
Data Controller: UNIVERZA CO., LTD.
Address:
800/108 Sukhumvit Road, Saen Suk Subdistrict, Mueang Chon Buri District,
Chon Buri Province, Thailand
Email Support: support-thealumni@univerza.co