Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how we collect, use, store, and protect the personal data of users ("User", "you") of the Aster of Asia Academy educational platform ("Platform"), accessible at class.asterofasia.com.

The data controller is:

1.1. Applicable Legislation

This Policy has been prepared in accordance with the requirements of:

• PDPA (Personal Data Protection Act B.E. 2562) -- Thailand's data protection law, as the Company is incorporated in Thailand
• GDPR (General Data Protection Regulation, EU 2016/679) -- to the extent it applies to users located in the European Economic Area

By using the Platform, you confirm your acceptance of this Policy. If you do not agree with any provision of this Policy, please do not use the Platform.

2. Data We Collect

We collect the following categories of personal data:

2.1. Data You Provide Directly

• First and last name
• Email address
• Phone number (if provided)
• Account credentials (email and encrypted password)
• Information submitted in employment application forms

2.2. Data Collected Automatically

• IP address
• Cookie data
• Browser and device information
• Course progress data (learning progress, test results)
• Website usage statistics

2.3. Sensitive Personal Data

Under the PDPA and GDPR, the following qualify as sensitive personal data:

• Psychological test results -- responses to assessment questions and interpretation of results
• Psychological profile data -- personality traits, stress resilience levels, and other characteristics identified through assessments

3. Purposes of Data Processing

We process your personal data for the following purposes:

• Providing access to the Platform's educational materials
• User authentication and account management
• Tracking learning progress and issuing certificates
• Communicating with you (notifications, responding to inquiries)
• Processing employment applications at Aster of Asia
• Improving the Platform and educational content
• Protecting the Platform from spam and abuse (via Google reCAPTCHA)
• Complying with applicable legal requirements

4. Legal Basis for Processing

We process personal data on the following legal grounds:

• Consent -- by registering on the Platform, you consent to the processing of your personal data
• Contractual necessity -- processing is required to deliver educational services
• Legitimate interests -- to improve the Platform, ensure its security, and prevent fraud
• Legal obligations -- where required by applicable law

5. Data Retention

Personal data is retained for the period necessary to fulfill the purposes for which it was collected:

• Account data -- until the account is deleted by you or upon your request
• Course progress and certificates -- 5 years from course completion
• Cookie data -- according to browser settings, but no longer than 1 year
• Employment applications -- 3 years from the date of submission

Upon expiration of the retention period, personal data is securely deleted or anonymized.

6. Data Security

We implement appropriate organizational and technical measures to protect your personal data:

• Encryption of data in transit (SSL/TLS)
• Passwords stored in hashed form (Firebase Authentication)
• Role-based access controls to personal data
• Regular data backups
• Secure cloud infrastructure (Firebase / Google Cloud Platform)

7. Third-Party Data Sharing

We do not sell your personal data. We may share data with the following categories of service providers, solely to operate and improve the Platform:

• Hosting and authentication: Firebase / Google Cloud Platform -- for data storage, user authentication, and platform hosting
• Email delivery: SendGrid (Twilio) -- for sending transactional and notification emails
• Spam protection: Google reCAPTCHA -- to protect forms from automated abuse
• Analytics: Google Analytics -- for aggregated, anonymized website usage statistics
• Legal requirements: where disclosure is required by a valid legal request from authorized government bodies

8. Cookies

The Platform uses cookies for:

• Authentication and session management
• Saving interface preferences (theme, language)
• Collecting usage statistics

You can manage cookies through your browser settings. Disabling cookies may affect Platform functionality. For more details, see our Cookie Policy.

9. Your Rights

Under the PDPA and, where applicable, the GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data
• Withdraw your consent to data processing at any time
• Request a copy of your data in a portable, machine-readable format
• Object to or restrict certain types of processing
• Lodge a complaint with a supervisory authority (the Office of the Personal Data Protection Committee in Thailand, or your local data protection authority under the GDPR)

To exercise any of these rights, please contact us at: info@asterofasia.com

10. International Data Transfers

As the Company is located in Thailand and the Platform uses Google Cloud infrastructure, your personal data may be stored and processed in Thailand and other countries where Google operates data centers.

Where personal data is transferred internationally, we ensure that appropriate safeguards are in place in accordance with the PDPA and, where applicable, the GDPR.

11. Changes to This Policy

We reserve the right to update this Policy at any time. The current version is always available on this page. In the event of material changes, we will notify you via the Platform or by email.

12. Contact Information

For any questions regarding the processing of your personal data, please contact us: