Record of processing activities

The formal record section 39 of the Personal Data Protection Act requires us to keep, open for you or the regulator to inspect.

About this record

This page is the structured record section 39 of the Act requires a data controller to keep. It lists what we process, why, and how, in more formal detail than the plain-language notice at /privacy. Both pages are generated from the same underlying record, so they can't drift apart or contradict each other.

Controller

BIRSA (the BIR Student Association), the student association of the BIR programme, Faculty of Political Science, Thammasat University, is the controller for all processing listed below.

Address: BIR, Faculty of Political Science, Thammasat University, 2 Prachan Road, Bangkok 10200

Email: birsa@tu.ac.th or birstudentassociation@gmail.com

Processing activities

Every category of personal data this site processes, one row per activity.

Category	Purpose	Data collected	Legal basis	Recipients	Retention
Messages you send us	So a BIRSA officer can read your message and reply to you.	Your name Your email address What you write in the message, including the subject you pick	24(3)	Resend	2 years, from creation
Proposals to start a club	So the committee can consider your proposal and get back to you about it.	Your name and email address The club name and what you want it to do Any other people you list as interested members	24(3)	Resend	2 years, from creation
Equipment loan requests	So an officer can decide on your request, hand the equipment over, and get it back.	Your name Your Thammasat student ID Your email address Your phone number, if you give one The dates you want the equipment, and why What condition the equipment was in when it went out and came back	24(3)	Resend, Vercel Postgres	2 years, from closure
Borrower records	So we can see someone's loan history, hold them to a sensible number of loans at once, and block a borrower who does not return equipment.	Your name, student ID, email address and phone number How many loans you may hold at once Whether you are blocked, and the reason an officer recorded	24(5)	Vercel Postgres	2 years, from last activity
Checking a loan you already made	So you can look up or cancel your own request without asking an officer.	Your reference number and the email address you used	24(3)	Vercel Postgres	2 years, from creation
Page feedback	So we can tell which pages work and which do not.	Whether you found the page useful Anything you type in the comment box Which page you were on, and whether you were reading in Thai or English	24(5)	Vercel Postgres	2 years, from creation
Requests about your own data	So we can find your data, act on your request, and prove we answered it in time.	Your name and email address Which right you are using, and anything you tell us to help us find your data	24(3)	Resend	2 years, from creation
BIRSA officer accounts	So the people who run the equipment service can sign in, and so each action has a name against it.	The officer's name, email address and role A scrambled form of their passcode, which cannot be turned back into the passcode When they last signed in	24(3)	Vercel Postgres	2 years, from last activity
Log of officer actions	So that if something goes wrong with an item or a loan, we can see who did what and when.	Which officer acted, what they did, and when Which item, loan or record they acted on	24(5)	Vercel Postgres	2 years, from creation
Stopping form abuse	So one person cannot flood a form with hundreds of submissions.	Your IP address, and a count of how many times you submitted a form recently	24(5)	None outside BIRSA	2 years, from creation

Processors

The outside organisations that process personal data on our behalf, and where they're based.

Processor	Role	Country
Resend	Delivers every email this site sends	United States
Vercel	Hosts the site and serves every page	United States
Vercel Postgres	The database behind the equipment loan service	United States
Vercel Blob	Stores photographs of equipment	United States
OpenStreetMap	Supplies the map tiles on the places pages	United Kingdom
Google Forms	Some club sign-up forms are Google Forms shown inside a page here	United States

Rights and how to access data

Data subjects hold the rights listed on our privacy notice, covering access, portability, correction, deletion, objection, restriction, withdrawing consent, and complaint. A request can be made through the /privacy/your-data journey or by emailing us directly.

See what we hold about you (30)
Get your data in a reusable format (31)
Correct something that is wrong (35 and 36)
Have your data deleted (33)
Object to what we are doing with it (32)
Ask us to pause using it (34)
Withdraw consent (19)
Complain about us (73)

We must answer an access request within 30 days, under section 30 of the Act.

See your rights in full

Security measures (section 37(1))

In plain terms, here's what protects the personal data we hold:

Officer passcodes are stored as a scrypt hash, a one-way scramble that cannot be turned back into the original passcode, even by us.
Sign-in sessions use a cookie that's cryptographically signed (HMAC), so it can't be forged or edited by a visitor.
Officers only see and act on what their role and their club scope allow: an officer of one club cannot see another club's borrower data.
The site runs under a strict Content Security Policy, which limits what scripts and resources a page is allowed to load.
Forms are rate-limited, so one visitor cannot flood a form or overwhelm the system.
All data in transit runs over encrypted connections (TLS).
A scheduled job deletes or anonymises personal data automatically once it passes the two-year retention period, rather than relying on someone remembering to do it.

If something goes wrong

If we discover a personal data breach that's likely to risk your rights and freedoms, section 37(4) of the Act requires us to notify the Personal Data Protection Committee within 72 hours of becoming aware of it, and to tell affected people without delay where the risk to them is high.

Data protection officer

BIRSA is not required to appoint a data protection officer under section 41 of the Act: we're not a state agency, we don't monitor personal data on a large scale as a core activity, and we don't process the sensitive categories of data listed in section 26. We still give a named contact point, as section 23(5) requires, for anyone with a question about this record or their data.

Contact BIRSA