1. Introduction

ADVEX Management School ("the School", "we", "us", or "our") is committed to protecting the personal data of our students, applicants, parents, guardians, staff, agency partners, and website visitors. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in compliance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand ("PDPA").

This Privacy Policy applies to all personal data collected through our website (advex.ac.th), our School Management System (sms.advex.ac.th), our LINE Official Account (@advex), our Facebook Page and Instagram account (ADVEX Management School, @advexbkk), our AI-powered services, and any other channels through which you interact with the School.

The School operates as a licensed private educational institution in Thailand (OPEC Registration No. 1110205063).

2. Data Controller

ADVEX Management School is the Data Controller responsible for the processing of your personal data. For any questions or requests regarding your personal data, please contact:

• Data Protection Contact: [email protected]
• Address: D204 Level 2 Thanya Park Complex, 735/4 Srinakarin Road, Phatthanakan Subdistrict, Suan Luang District, Bangkok 10250, Thailand

3. Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity data: full name, nickname, date of birth, nationality, passport or national ID number, photograph
• Contact data: email address, phone number, postal address, emergency contact details
• Education data: academic transcripts, certificates, English proficiency test scores, highest education level, previous institutions attended
• Financial data: payment records, invoices, billing information (we do not store credit card numbers; payments are processed through secure third-party payment processors)
• Application data: programme preferences, intake selection, agency referral information, campaign codes
• Document data: uploaded documents such as transcripts, certificates, identification documents, and consent forms
• Technical data: IP address, browser type, device information, and website usage data (if analytics tools are enabled)
• Communication data: correspondence with the School, feedback, and enquiries
• LINE OA data: LINE User ID, LINE display name, and registered email address used for account linking (collected when you add or interact with our LINE Official Account @advex)

4. Sensitive Personal Data

In certain cases, we may collect sensitive personal data as defined under Section 26 of the PDPA, including but not limited to health information or disability status, where such collection is necessary for providing appropriate educational support. We will obtain your explicit consent before collecting sensitive personal data, unless permitted by law.

5. Purposes of Data Collection

We collect and use your personal data for the following purposes:

• Processing and evaluating applications for admission
• Administering student enrolment, registration, and academic records
• Managing tuition fees, payments, invoices, and financial records
• Communicating with students, parents, guardians, and agency partners regarding academic and administrative matters
• Issuing official documents such as enrolment letters, transcripts, and certificates
• Reporting to awarding institutions, regulatory authorities (including OPEC), and accreditation bodies
• Providing access to the School's learning management system (LMS) and related educational technology
• Marketing and promotional communications (with your consent)
• Complying with legal and regulatory obligations
• Improving our website and services

6. Legal Basis for Processing

We process your personal data based on one or more of the following legal grounds under the PDPA:

• Your consent
• Performance of a contract to which you are a party (e.g. student enrolment agreement)
• Compliance with legal obligations
• Legitimate interests of the School, provided such interests do not override your fundamental rights
• Vital interests of the data subject
• Public interest or exercise of official authority

7. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

• Awarding institutions and examination bodies for programme validation and certification
• Government and regulatory authorities, including the Office of the Private Education Commission (OPEC)
• Payment processors (Stripe, Airwallex) for the purpose of processing tuition and fee payments
• Authorised agency partners who have referred you to the School
• Professional advisors, auditors, and legal counsel
• Technology service providers who assist in operating our systems (e.g. hosting, email services), subject to appropriate data protection agreements

We do not sell your personal data to any third party.

Requests from public authorities: if a government or public authority asks us for personal data, including data we receive through Meta platforms such as Facebook Messenger or Instagram, we will (a) first check that the request is made in writing and has a valid legal basis under Thai law; (b) disclose only the minimum personal data necessary to meet the request; and (c) keep a record of each request, our response, the legal reasoning, and the people involved.

8. International Data Transfers

Your personal data may be transferred to and processed in countries outside of Thailand, including but not limited to Hong Kong, the United Kingdom, and other jurisdictions where our awarding institutions or service providers are located. Where such transfers occur, we will ensure that appropriate safeguards are in place to protect your data in accordance with the PDPA.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. General retention periods include:

• Student academic records: retained for a minimum of 10 years after graduation or withdrawal
• Financial records: retained for a minimum of 7 years in accordance with Thai accounting and tax regulations
• Application data (unsuccessful applicants): retained for up to 2 years
• Marketing consent records: retained until consent is withdrawn
• LINE OA data: retained as long as you are enrolled or have an active relationship with the School; permanently deleted upon account unlinking
• Chat assistant conversations (Facebook Messenger and Instagram): deleted automatically 120 days after your last message

After the applicable retention period, personal data will be securely deleted or anonymised.

10. Your Rights Under the PDPA

As a data subject, you have the following rights under the PDPA:

• Right to be informed about the collection and use of your personal data
• Right to access your personal data and obtain a copy
• Right to rectification of inaccurate or incomplete data
• Right to erasure of your personal data, subject to legal and contractual obligations
• Right to restrict processing of your personal data
• Right to data portability
• Right to object to certain processing activities
• Right to withdraw consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal)

To exercise any of these rights, please contact us at [email protected] with a written request and appropriate identification documents. We will respond to your request within 30 days.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission, access controls, session management, and regular security reviews.

12. LINE Official Account (@advex)

The School operates a LINE Official Account (@advex) to communicate with students, applicants, and partners. When you add our LINE Official Account and link your account, we collect your LINE User ID, LINE display name, and registered email address for the purpose of linking your LINE account to your student record.

We use your LINE data to:

• Send tuition fee payment reminders and receipts
• Notify you about class schedules, seminars, and academic events
• Send important announcements related to your enrolment
• Respond to your enquiries and support requests
• Verify your identity when linking your LINE account to your student record

We do not collect your LINE chat history unrelated to our services, your LINE password or credentials, or your contacts or friend list.

You may unlink your LINE account at any time by sending "unlink" to our LINE Official Account or by contacting us directly. Upon unlinking, your LINE User ID will be permanently removed from our system.

You may also opt out of non-essential notifications while keeping your account linked.

13. AI-Powered Services

The School uses AI-powered services to support prospective and current students. These include chat assistants on our channels, such as Facebook Messenger and Instagram (ADVEX Management School, @advexbkk), and learning tools such as ADVEX AI Tutor in our learning management system. This section also applies to AI services we may add in the future.

When you use these services, your messages and any information you choose to share (for example your name, phone number, email address or programme interest) are processed to generate responses. For chats on Facebook Messenger and Instagram, we also receive your Facebook or Instagram user ID and profile name. To provide these services, we use technology service providers, including AI providers (such as Anthropic) and hosting providers (such as Netlify). When you share contact details or ask to speak to a staff member, a summary of the conversation may be sent to our admissions team so that we can contact you.

Conversations with our chat assistants are deleted automatically 120 days after your last message. You can ask us to delete your data at any time by contacting [email protected], and we will respond within 30 days.

Information provided by our AI services is for general guidance only and does not constitute official advice or a binding commitment by the School. The School is not liable for decisions made based solely on AI-generated responses. For official matters, please contact the School directly.

Data submitted through our AI services is processed and stored in accordance with this Privacy Policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on our website with an updated effective date. We encourage you to review this policy periodically.

15. Complaints

If you believe that your personal data has been processed in violation of the PDPA, you have the right to file a complaint with the Personal Data Protection Committee (PDPC) of Thailand. However, we encourage you to contact us first at [email protected] so that we may address your concerns.

16. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact:

• ADVEX Management School
• Email: [email protected]
• LINE: @advex
• Phone: +66 2 114 3748
• Address: D204 Level 2 Thanya Park Complex, 735/4 Srinakarin Road, Phatthanakan Subdistrict, Suan Luang District, Bangkok 10250, Thailand