1.
Introduction
The Center of Excellence for Hazardous Substance and Waste Management" ("the Center") recognizes the importance of the personal data you have entrusted to us. The Center has implemented a secure data protection system and stringent operational procedures, along with security measures to prevent unauthorized access, disclosure, use, or modification of data. These efforts align with the Personal Data Protection Act B.E. 2562 (2019). Accordingly, the Center has established this policy to provide details on the collection, use, and disclosure of personal data, the data retention period, data destruction procedures, and the rights of data subjects in relation to the operations and services of the Laboratory Management Platform ("Lab Platform" or "the Platform"). This includes records of facility usage and sample analysis services. The Center recommends that you carefully read and understand this Privacy Notice to be informed of the purposes for which the Center collects, uses, and discloses your personal data, the data retention period, data destruction procedures, and your rights as a data subject. You can find the full details below.
2.
Collection of Your Personal Data
2.1.
Identity Data, This refers to information related to a natural person that can directly or indirectly identify the individual, such as name, surname, national ID number, photograph, passport number, date of birth, as well as sensitive data including biometric information (fingerprints, facial recognition data), and others.
2.2.
Your Contact Data, This includes information such as address, email, and phone number
2.3.
Communication Data, This includes information such as conversation records via the Line application and emails exchanged with the Center.
2.4.
Information you enter, submit, or upload on the platform, such as username, password, email address, and others.
3.
The Center will collect your personal data when
3.1.
You register to use the Platform services.
3.2.
You use the Platform services.
3.3.
There is contact made with the Center for assistance with using the services.
4.
Purposes of collecting, using, processing, or disclosing your personal data.
The Center collects data for your benefit in using the Platform services, to comply with applicable laws and regulations, and/or for any other purposes you have consented to. The Center will store your data in accordance with its security measures. You can review the details as follows.
4.1.
Consent must be obtained from you, the data subject, regarding the collection of your personal data.
4.2.
Processing based on consent, where the Center may use your personal data for processing in the design and development of the Platform services.
4.3.
The Center will share your data, including but not limited to the personal data you provide. The Center will use your data to manage the Platform services, respond to your inquiries, and contact you.
4.4.
The Center will not disclose your personal data to others without your consent, except when required by law or applicable regulations.
5.
Disclosure of Personal Data
The Center may disclose your personal data to external parties for purposes related to the processing of personal data in the following cases.
5.1.
Platform development service providers under contract with the Center for the future development of the Platform services.
5.2.
Data management and cloud service providers.
5.3.
Lawyers and legal advisors for the benefit of the Center, including the exercise of legal rights and the defense of legal claims to assist in the operation of the Center's Platform services.
5.4.
Document storage and/or document destruction service providers.
During the provision of such services, the service providers may have access to the personal data of the data subjects. However, the Center will only provide the necessary data to the service providers for the purpose of providing the services, and will request that the service providers do not use this personal data for other purposes. The Center will ensure that the service providers it works with maintain the security of personal data as required by law.
6.
Rights of the Data Subject
This right refers to the legal rights related to personal data, which may be exercised by the data subject against the parties defined by law, subject to the conditions set by the law and the Center's procedures for managing rights. These rights include the following:
6.1.
Right to Withdraw Consent, You have the right to withdraw your consent given to the Center for the collection, use, or disclosure of your personal data at any time. If the Center has no other legal basis to continue collecting, using, or disclosing your personal data, the Center will proceed to delete the data.
6.2.
Right to Access, You have the right to request to know and obtain a copy of your personal data that is under the responsibility of the Center or request the Center to disclose how the data was obtained, including data that you did not consent to.
6.3.
Right to Rectification, You have the right to request the Center to correct, update, and complete your personal data to ensure its accuracy and to prevent any misunderstandings.
6.4.
Right to Data Portability, You have the right to request your data from the Center in a format that is commonly used and can be read or processed by automated tools or devices. Additionally, you have the right to: (a) request the Center to send or transfer your data in such a format to another data controller if it can be done by automated means, or (b) request to directly receive your data that the Center has sent or transferred to another data controller, unless it is technically impossible.
6.5.
Right to Erasure or Right to be Forgotten, You have the right to request that the Center delete, destroy, or anonymize your personal data so that it no longer identifies you. However, the Center is not obligated to comply with this request if it is required to retain the data for legal compliance, to establish legal claims, to comply with or exercise legal rights, or to defend against legal claims.
6.6.
Right to Object, You have the right to object to the collection, use, or disclosure of your personal data.
6.7.
Right to Lodge a Complaint, You have the right to file a complaint with the relevant government authority if the Center, its employees, or its contractors violate or fail to comply with the Personal Data Protection Act.
Any requests to exercise your rights as mentioned above must be made in writing. The Center will make every effort to process the request within a reasonable timeframe and no later than the period specified by law. The Center will comply with the legal provisions related to your rights as the data subject.
7.
Retention Period of Personal Data
The Center may not be able to completely delete all your data from the Platform’s database without leaving some residual data due to backup and other reasons. The Center will retain your data as long as it is necessary for the purposes for which it was collected. In the event that you discontinue using the Platform services with the Center, the Center will retain your personal data for a period of 5 years. After the retention period, the Center will delete, destroy, or anonymize the data so that it no longer identifies you.
8.
Registration for Platform Services, Acceptance, Rejection, and Cancellation of Service Requests
You (whether an individual, student, public or private sector personnel, or state enterprise) wish to use the Platform services by submitting a service request as specified by the Center. However, in order to approve the service request, a user account is required, and the Center must assess and create a ("certified user account.") If the Center determines that you meet any of the following criteria, the Center may reject your service request.
8.1.
You provide false information in the service request.
8.2.
You do not meet the Center's evaluation criteria (which include, but are not limited to, outstanding payments owed to the Center or delayed payments to the Center. The Center is not obligated to disclose its evaluation criteria).
8.3.
Other cases where the Platform services are used inappropriately as determined by the Center.
9.
User Account
9.1.
The Center will grant you a user account to use the Platform services once you meet the evaluation criteria as mentioned in Section 8.
9.2.
You are required to maintain the confidentiality of your user account password. You will bear the risk of any fraudulent or unauthorized use of your password. The Center will consider any use of the registered password as an action taken by you, the holder of the password.
9.3.
Upon your request, the Center may assist you in managing your user account within a reasonable scope. In such cases, the Center may access your user account and take necessary actions within the required scope to provide assistance.
10.
Your Responsibilities as a Platform Service User
10.1.
In the event that the Center incurs damages or expenses (including legal fees) related to or arising from your use of the Platform services (which includes materials, equipment, laboratory tools, and facilities within the scope of the laboratory that you used through the Platform), you will indemnify the Center for such damages or expenses.
10.2.
If another service user is designated as a co-administrator, the Center will consider the actions of the co-administrator as your actions. In the event that the actions of the co-administrator cause damage or loss of benefits to you, the Center will not be liable and requests that you resolve the issue between yourself and the co-administrator.
11.
Suspension, Modification, and Cancellation of Platform Services
11.1.
The Center may suspend the paid Platform services for certain reasons without prior notice. In the event the Center suspends the paid Platform services, the Center will not be required to refund the service fees for the period during which the services were suspended, and the Center will not be held liable for the suspension of such services under any circumstances.
11.2.
When maintenance is required for equipment necessary for providing the Platform services, either according to the scheduled timeline or on an urgent basis.
11.3.
The equipment necessary for providing the Platform services is unavailable.
11.4.
An event that obstructs the provision of Platform services due to power outages, fires, natural disasters, strikes, and other force majeure events.
11.5.
An operational or technical incident that affects the provision of Platform services.
11.6.
The center may modify, change, or cancel the paid platform services, whether in full or in part, and may notify you either generally or directly. In the event that the center modifies, changes, or cancels the paid platform services, whether in full or in part, it shall be considered that the center shall not be liable to you for any modification, change, or cancellation of the services in any way.
12.
Exemption of Liability
12.1.
The center does not guarantee, either explicitly or implicitly, that the paid platform service will be free from defects, whether in fact or law (which includes but is not limited to stability, reliability, accuracy, completeness, effectiveness, suitability for specific purposes, security flaws, errors, computer bugs, or violations of rights).
12.2.
The center is not responsible for any damages incurred by you while using the service, except in cases where the damage is caused by intentional acts or gross negligence on the part of the center. In such cases, the center will be responsible for direct damages and normal damages incurred by you, with the maximum liability limited to the service fees incurred from using any service on the platform, calculated based on the period during which you suffered damage due to the aforementioned event.
13.
Prohibited Actions
When using the platform services, you are prohibited from doing any of the following:
13.1.
Actions that are contrary to the law, court judgments, resolutions or orders, or administrative measures that are legally binding.
13.2.
The transfer or lending of your platform service user account to others, or allowing others to share the use of your platform service user account.
13.3.
Actions that lead to the unlawful or inappropriate collection, disclosure, or provision of personal data, registration information, or usage history.
13.4.
Actions that disrupt the operation of the server and/or the network systems of the platform service.
13.5.
Any other actions that the center considers inappropriate.
14.
Changes to the Privacy Policy and Terms of Service for the Platform
The Privacy Policy and Terms of Service of the Center’s platform may be modified or updated from time to time without prior notice. If there are any changes to the Privacy Policy, the Center will display the most current version on the platform’s website at www.labxxxxxxx. By continuing to use the platform after any modifications, you are deemed to have accepted the revised Privacy Policy and Terms of Service.
15.
Contact Channels for the Center
If you wish to contact us, have any questions, or need further details regarding the collection, use, or disclosure of personal data, the exercise of rights under Section 6, the withdrawal of consent, or any complaints, you may contact the Center through the following channels:
-
Center of Excellence on Hazardous Substance and Waste Management Contact Address: 10th Floor, Chulalongkorn University Research Building, Phayathai Road, Wang Mai, Pathum Wan, Bangkok 10330, Thailand
-
Platform Administration Division tel. 02-218-XXXX
-
Line application: @xxxxx