Privacy
A plain-language notice of what this site collects, why, how long we keep it, and the rights you have over it.
Who runs this site
BIRSA (the BIR Student Association), the student association of the BIR programme, Faculty of Political Science, Thammasat University, is the data controller for this site: it decides what data is collected and why.
Address: BIR, Faculty of Political Science, Thammasat University, 2 Prachan Road, Bangkok 10200
Why we don't ask for your consent
Almost nothing on this site runs on your consent. We rely on two other grounds in the Personal Data Protection Act instead: section 24(3), because you've asked us to do something for you, and section 24(5), where we have a legitimate interest, such as running the equipment loan service fairly for everyone.
This matters in practice. The age of majority in Thailand is twenty, so most first-year students are minors, and a minor's consent normally needs a guardian's consent too, under section 20 of the Act. Because we don't rely on consent, that requirement never comes up. Borrowing club equipment is, in any case, something a minor can decide for themselves: section 24 of the Civil and Commercial Code lets a minor carry out an act that suits their condition in life and is reasonably needed to meet their ordinary needs, and returning a borrowed camera or tent fits that description.
If we ever add a feature that is genuinely optional and not needed to run a service you asked for, we'll ask for your consent separately, in plain language, and you'll be free to say no. See "Withdraw consent" among your rights below.
What we collect, and why
This is every place on this site where we collect personal data. For each one, we say why we collect it, whether you have to give it, what we collect, our legal basis, who else sees it, and how long we keep it.
Messages you send us
- Why we collect it
- So a BIRSA officer can read your message and reply to you.
- Do you have to give this?
- You have to give a name and an email address, because without them we have no way to reply. Nothing else is required.
- What we collect
- Your name
- Your email address
- What you write in the message, including the subject you pick
- Who else sees it
- Resend (Delivers every email this site sends)
- How long we keep it
- Kept for up to two years, counted from the day we receive it, then deleted automatically.
- Legal basis: section 24(3)
- of the Personal Data Protection Act. Necessary to do what you asked us to do, or to carry out an agreement with you
Proposals to start a club
- Why we collect it
- So the committee can consider your proposal and get back to you about it.
- Do you have to give this?
- The name, email address, club name and description are required, because the committee cannot consider a proposal without them. Listing other members is optional.
- What we collect
- Your name and email address
- The club name and what you want it to do
- Any other people you list as interested members
- Who else sees it
- Resend (Delivers every email this site sends)
- How long we keep it
- Kept for up to two years, counted from the day we receive it, then deleted automatically.
- Legal basis: section 24(3)
- of the Personal Data Protection Act. Necessary to do what you asked us to do, or to carry out an agreement with you
Equipment loan requests
- Why we collect it
- So an officer can decide on your request, hand the equipment over, and get it back.
- Do you have to give this?
- We need your name, student ID, email address and dates. Without the student ID we cannot check your loan limit, and without an email address we cannot tell you the decision, so we cannot take the request. Your phone number and your reason are optional, though a reason helps an officer decide.
- What we collect
- Your name
- Your Thammasat student ID
- Your email address
- Your phone number, if you give one
- The dates you want the equipment, and why
- What condition the equipment was in when it went out and came back
- Who else sees it
- Resend (Delivers every email this site sends), Vercel Postgres (The database behind the equipment loan service)
- How long we keep it
- Kept for up to two years, counted from the day the record closes, then deleted automatically. The two years run from the day the loan closes, not the day you ask. A loan that is still open is never deleted.
- Legal basis: section 24(3)
- of the Personal Data Protection Act. Necessary to do what you asked us to do, or to carry out an agreement with you
Borrower records
- Why we collect it
- So we can see someone's loan history, hold them to a sensible number of loans at once, and block a borrower who does not return equipment.
- Do you have to give this?
- This record is built from what you give us when you request a loan. There is nothing separate to fill in.
- What we collect
- Your name, student ID, email address and phone number
- How many loans you may hold at once
- Whether you are blocked, and the reason an officer recorded
- Who else sees it
- Vercel Postgres (The database behind the equipment loan service)
- How long we keep it
- Kept for up to two years, counted from the last time it changed, then deleted automatically.
- Legal basis: section 24(5)
- of the Personal Data Protection Act. Necessary for BIRSA's legitimate interests, weighed against your rights
Checking a loan you already made
- Why we collect it
- So you can look up or cancel your own request without asking an officer.
- Do you have to give this?
- Both are required. They are how we check the loan is yours before showing it to you.
- What we collect
- Your reference number and the email address you used
- Who else sees it
- Vercel Postgres (The database behind the equipment loan service)
- How long we keep it
- Kept for up to two years, counted from the day we receive it, then deleted automatically. Looking something up does not create a new record. Nothing is stored beyond the loan itself.
- Legal basis: section 24(3)
- of the Personal Data Protection Act. Necessary to do what you asked us to do, or to carry out an agreement with you
Page feedback
- Why we collect it
- So we can tell which pages work and which do not.
- Do you have to give this?
- Feedback is entirely optional. We do not ask for your name, your email address or anything else that identifies you, so please do not type those into the comment box.
- What we collect
- Whether you found the page useful
- Anything you type in the comment box
- Which page you were on, and whether you were reading in Thai or English
- Who else sees it
- Vercel Postgres (The database behind the equipment loan service)
- How long we keep it
- Kept for up to two years, counted from the day we receive it, then deleted automatically.
- Legal basis: section 24(5)
- of the Personal Data Protection Act. Necessary for BIRSA's legitimate interests, weighed against your rights
Requests about your own data
- Why we collect it
- So we can find your data, act on your request, and prove we answered it in time.
- Do you have to give this?
- We need a name and an email address to answer you and to be reasonably sure the request is really yours.
- What we collect
- Your name and email address
- Which right you are using, and anything you tell us to help us find your data
- Who else sees it
- Resend (Delivers every email this site sends)
- How long we keep it
- Kept for up to two years, counted from the day we receive it, then deleted automatically.
- Legal basis: section 24(3)
- of the Personal Data Protection Act. Necessary to do what you asked us to do, or to carry out an agreement with you
BIRSA officer accounts
- Why we collect it
- So the people who run the equipment service can sign in, and so each action has a name against it.
- Do you have to give this?
- This only applies to BIRSA officers. An officer who does not want an account cannot run the equipment service.
- What we collect
- The officer's name, email address and role
- A scrambled form of their passcode, which cannot be turned back into the passcode
- When they last signed in
- Who else sees it
- Vercel Postgres (The database behind the equipment loan service)
- How long we keep it
- Kept for up to two years, counted from the last time it changed, then deleted automatically. After two years without signing in, an officer's name and email address are overwritten. The record itself stays, because the log of who approved which loan would otherwise lose its meaning.
- Legal basis: section 24(3)
- of the Personal Data Protection Act. Necessary to do what you asked us to do, or to carry out an agreement with you
Log of officer actions
- Why we collect it
- So that if something goes wrong with an item or a loan, we can see who did what and when.
- Do you have to give this?
- This is written automatically when an officer acts. It records officers, not visitors, and it does not record your IP address or your browser.
- What we collect
- Which officer acted, what they did, and when
- Which item, loan or record they acted on
- Who else sees it
- Vercel Postgres (The database behind the equipment loan service)
- How long we keep it
- Kept for up to two years, counted from the day we receive it, then deleted automatically.
- Legal basis: section 24(5)
- of the Personal Data Protection Act. Necessary for BIRSA's legitimate interests, weighed against your rights
Stopping form abuse
- Why we collect it
- So one person cannot flood a form with hundreds of submissions.
- Do you have to give this?
- This happens automatically on every form. There is no way to turn it off, and no way to use the forms without it.
- What we collect
- Your IP address, and a count of how many times you submitted a form recently
- Who else sees it
- Nobody outside BIRSA.
- How long we keep it
- Kept for up to two years, counted from the day we receive it, then deleted automatically. Held in the server's memory for ten minutes and never written to a database. It disappears sooner if the server restarts.
- Legal basis: section 24(5)
- of the Personal Data Protection Act. Necessary for BIRSA's legitimate interests, weighed against your rights
How long we keep it, in short
Every category of personal data on this site is kept for up to two years and then deleted automatically. What differs is when the clock starts, which is set out activity by activity above.
For an equipment loan, the two years start on the day the loan closes, not the day you ask to borrow something. An open loan is never deleted, however old it is. The full deletion rules are set out on our record of processing activities, linked below.
Sending your data outside Thailand
Some of the outside providers we use are not based in Thailand. Resend, which delivers our email, and Vercel, which hosts this site and its database, are both in the United States. OpenStreetMap, which supplies the maps on this site, is in the United Kingdom. Thailand's Personal Data Protection Committee has not found either country to give an adequate level of protection, and we don't claim it has.
Instead, we rely on section 28(3) of the Act: the transfer is necessary to perform a contract with you, or to take steps you've asked for before entering one, for example sending you an email or running the equipment loan you requested. Each provider's data processing agreement also carries the safeguards required under section 29, paragraph 3, of the Act.
Automated decisions
When you ask to borrow equipment, the system automatically checks whether the item is free and whether your account is blocked or already at its loan limit, and stops an invalid request there. It never decides on its own whether to approve or reject a request: a BIRSA officer makes that decision every time.
No ads, no selling your data
We don't run advertising on this site, and we never sell or trade your data. The providers named on this page only ever act on our instructions, for the purposes described here, and never for their own purposes.
Your rights
The Personal Data Protection Act gives you these rights over the data we hold about you. You can use any of them by writing to us.
- See what we hold about you (Section 30)
- Ask us what personal data we hold about you, get a copy of it, and ask how we got it.
- Get your data in a reusable format (Section 31)
- Ask for your data in a format you or another organisation can read with a computer.
- Correct something that is wrong (Section 35 and 36)
- Tell us to fix data that is wrong, out of date, incomplete or misleading.
- Have your data deleted (Section 33)
- Ask us to delete or anonymise your data, for example when we no longer need it for the purpose we collected it.
- Object to what we are doing with it (Section 32)
- Object to us collecting, using or disclosing your data where we rely on our legitimate interests.
- Ask us to pause using it (Section 34)
- Ask us to hold your data but stop using it, for example while we look into a correction you asked for.
- Withdraw consent (Section 19)
- Where we ever rely on your consent, take it back. It is as easy to withdraw as it was to give, and withdrawing does not undo what was already done lawfully.
- Complain about us (Section 73)
- Complain to the Personal Data Protection Committee's expert committee if you think we have broken the law.
If you ask to see your data, we have thirty days to answer, under section 30 of the Act.
More detail
This page is a summary written in plain language. Three pages go into more depth, and all three are built from the same record we use here, so nothing on them can contradict this page.
Cookies
Every cookie this site sets, what it's for, and how long it lasts.
Read about cookiesRecord of processing activities
The formal record required by section 39 of the Act, including our security measures and how we handle a data breach.
Read the recordYour data
Ask to see, correct, delete, or get a copy of your data.
Manage your data
Questions about this notice, or about your data? Get in touch: Contact BIRSA or email birsa@tu.ac.th or birstudentassociation@gmail.com.