Privacy Notice

1. Introduction

Heathfield International School (“the School”, “we”, “our”, “us”) is committed to protecting the personal data of our students and their families in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (PDPA). This Privacy Notice explains how we collect, use, disclose, and protect personal data.

2. Types of Personal Data Collected

We may collect the following categories of personal data:

• Student Information: name, date of birth, gender, nationality, student ID, academic history, health data (with consent), learning support needs, behaviour records
  
  
• Parent/Guardian Information: names, contact details, occupation, relationship to student
  
  
• Photographs and Videos: used for school records, learning documentation, marketing (only with consent)
  
  
• CCTV Footage: captured on campus for safety and security purposes
  
  
• Facial Recognition Data: used solely for entrance/exit security at flipgates (opt-in, with consent)
  
  
• Technology Usage Data: from platforms such as Google Workspace and Class DoJo (activity logs, assignments, communication)

3. Collection methods

We collect the majority of the personal data we process directly from the data subject concerned (or often in the case of students, from their parents or guardians). There are instances where we collect data from third parties (for example, referees/references, and previous schools) or from publicly available resources.

We also collect data about you when:

• you have expressed an interest in having your child/children attend our school;
• you have requested a planned visit to the school; 
• you have registered to attend (or have attended) one of our events;
• you visit our website or social media;
• you have expressed an interest in working for, or with, us; or
• you are employed by an organisation with whom we have a business relationship.

4. Purpose of Processing

We collect and process personal data for the following purposes:

• Providing education and learning support
  
  
• Communicating with parents/guardians
  
  
• School administration and operations
  
  
• Security and access control
  
  
• Managing attendance and student records
  
  
• Compliance with legal obligations
  
  
• Promoting school activities (only with consent)
  
  

5. Legal Basis for Processing

We rely on one or more of the following legal bases:

• Contractual necessity (e.g. enrolment agreement)
  
  
• Legal obligation (e.g. Ministry of Education regulations)
  
  
• Legitimate interest (e.g. school safety, internal reporting)
  
  
• Consent (e.g. for use of images or biometric data)
  
  

6. Disclosure of Data

Personal data may be shared with:

• Government authorities (if legally required)
  
  
• Educational service providers (e.g. online platforms)
  
  
• External contractors (e.g. school photographers, IT support), under binding data protection agreements
  
  

7. Data Retention

We retain student records and related personal data in accordance with school policy and legal requirements. Some records (e.g. academic transcripts) may be stored indefinitely.

8. Data Subject Rights

Under the PDPA, you have the following rights:

• Access and obtain a copy of your data
  
  
• Request rectification or deletion
  
  
• Object to certain processing activities
  
  
• Withdraw consent at any time (where applicable)
  
  
• Lodge a complaint with the Personal Data Protection Committee
  
  

To exercise your rights, contact us at dpo@heathfield.ac.th

9. Security Measures

We implement administrative, physical, and technical measures to protect your personal data, including:

• Access control
  
  
• Secure storage
  
  
• Staff confidentiality training
  
  
• Data encryption where appropriate
  
  

10. CCTV and Biometric Data

• CCTV is used throughout campus for security. Footage is kept for up to 14 days unless required for investigation.
  
  
• Facial recognition is opt-in and used exclusively at gates. An opt-out alternative is available.
  
  

11. Contact Information

If you have questions about this notice or your data, please contact:

Data Protection Officer (DPO): Ms Vanassanun Zand
Heathfield International School
dpo@heathfield.ac.th

6 Ramkhamhaeng Rd,
Rat Phattana,
Saphan Sung
Bangkok, 10240

You have the right to make a complaint at any time to the Office of Persona Data Protection Committee, the Thailand supervisory authority for data protection issues, by contacting them 

The Personal Data Protection Committee (the “PDPC”)

The Government Complex Commemorating His Majesty
Ratthaprasasanabhakti Building 7th Floor,
Chaengwattana Road, Thung Song Hong Sub-District, Lak Si District
Bangkok, Thailand 10210

Tel:  02 141 6993, 02 142 1033
E-mail: pdpc@mdes.go.th
Website: Thailand PDPC

We would, however, appreciate the chance to deal with your concerns before you approach the PDPC, so please contact us in the first instance.