Privacy Policy

1. Introduction

Witcha Labs Co., Ltd. ("Witcha Labs", "we", "our") operates an online school for AI development, based at 88 Ratchadaphisek Road, Din Daeng, Bangkok 10400, Thailand. This Privacy Policy describes how we collect, use, store, and protect personal data in connection with our website and courses.

We comply with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and relevant regulations. If you have questions about this policy, contact us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact information: name, email address, phone number — provided when you submit an enquiry form or enrol in a course.
• Course activity: submitted assignments, progress records, and mentor communication relating to your enrolment.
• Technical data: IP address, browser type, pages visited, and session duration — collected automatically via server logs and analytics tools.
• Cookie data: your cookie preferences as stored in your browser's localStorage. See our Cookie Policy for details.

We do not collect sensitive categories of personal data (such as health, financial, or biometric data).

3. Legal Basis for Processing

• Contractual necessity: processing required to deliver course services you have enrolled in.
• Legitimate interests: website security, analytics to improve our services, and responding to enquiries.
• Consent: marketing communications and non-essential cookies, which you may withdraw at any time.

4. How We Use Your Data

• Responding to enquiries and processing enrolments
• Delivering course content, mentor feedback, and learner support
• Sending course-related updates and administrative messages
• Sending marketing communications (only where you have given consent, with an unsubscribe option in every message)
• Improving website content and course materials based on aggregate analytics
• Complying with legal obligations under Thai law

5. Data Sharing

We do not sell personal data. We may share limited data with:

• Service providers: cloud hosting, email delivery, and analytics platforms operating under data processing agreements. These providers may not use your data for their own purposes.
• Mentors: your submitted work and contact details are shared with your assigned mentor for the purpose of delivering feedback.
• Legal authorities: where required by Thai law or a valid legal order.

6. Data Retention

• Contact enquiries: retained for 12 months from the date of enquiry, or until resolved.
• Enrolment and course records: retained for 3 years from course completion to support post-course material access and learner summaries.
• Analytics data: anonymised after 26 months.
• You may request earlier deletion — see Section 8.

7. Data Security

We use TLS encryption for all data in transit. Learner data is stored on servers within the Asia-Pacific region. Access to personal data is restricted to staff and mentors who require it to perform their roles. We conduct regular access reviews and monitor for unauthorised access attempts.

In the event of a data breach that poses a risk to data subjects, we will notify the Office of the Personal Data Protection Committee (PDPC) within 72 hours and affected individuals without undue delay.

8. Your Rights Under the PDPA

As a data subject under Thailand's PDPA, you have the right to:

• Access: request a copy of personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: request deletion of your personal data where there is no longer a legal basis for retention.
• Portability: receive your data in a structured, machine-readable format where applicable.
• Objection: object to processing based on legitimate interests.
• Withdrawal of consent: withdraw consent for marketing or non-essential cookies at any time, without affecting the lawfulness of prior processing.
• Complaint: lodge a complaint with the PDPC (Thailand's supervisory authority for data protection).

To exercise any of these rights, email [email protected]. We will respond within 30 days.

9. Cookies

We use essential cookies for site functionality and optional cookies for analytics. You can manage your preferences at any time via our Cookie Policy page.

10. Third-Party Links

Our website may contain links to external resources. We are not responsible for the privacy practices of third-party websites and encourage you to review their policies independently.

11. Children

Our courses are intended for individuals aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us at [email protected] and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of our website after changes constitutes acceptance. For material changes, we will notify active learners by email.

13. Contact

For data protection enquiries:

Witcha Labs Co., Ltd.
88 Ratchadaphisek Road, Din Daeng, Bangkok 10400, Thailand
Email: [email protected]
Phone: +66 2 970 3486