Privacy · PDPA
Privacy notice
In short: we do not track visitors, we use no advertising or analytics cookies, and we only collect personal data when you send us a message through the contact form.
1. Data controller
Wyss Academy for Nature, Hub Southeast Asia [legal entity name and registered address in Thailand] is the controller of personal data collected through this website.
Privacy contact: hub.sea@wyssacademy.org · Data Protection Officer: [DPO name and email, if appointed]
2. What we collect
When you use the contact form
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, role (e.g. government, community, media) and your message | To read and answer your message, send an acknowledgement email and pass it to the right person in the team | Consent (the checkbox on the form) under Section 19, and our legitimate interest in answering an enquiry you sent |
| Language used (Thai/English) and time sent | To reply in your language and keep messages in order | Legitimate interest |
We do not ask for sensitive personal data (such as health, religion or political opinions). Please do not include it in your message.
Technical data
To prevent spam, your IP address is read temporarily in server memory to limit how often the form can be sent (at most 5 times per 10 minutes); it is not written to our database. Our hosting provider may keep short-lived server access logs for security [retention period per provider contract].
3. How long we keep it
Contact-form messages are kept for no more than 24 months from receipt and then deleted, unless a message becomes part of a collaboration we must keep records of by contract or law.
4. Cookies
We only use cookies that are strictly necessary for the site to work. We use no advertising cookies, cross-site trackers or visitor analytics, so there is no consent banner.
| Cookie | What it does | Lifetime |
|---|---|---|
NEXT_LOCALE | Remembers your language choice (Thai/English) | 1 year |
| Admin session cookie | Keeps authorised team members signed in to the content management system. It is only set for people who sign in to the CMS; ordinary visitors never receive it. | Until sign-out or expiry |
Fonts are served from our own domain and we do not embed social-media content. Share buttons are plain links that only do something when you press them.
5. Who receives your data, and international transfers
Contact-form data is available only to designated team members and to processors acting for us: our website host (Vercel), database (Neon) and email service (Resend), which may store data on servers outside Thailand. We put appropriate safeguards in place under Sections 28–29 [specify mechanism, e.g. standard contractual clauses]. We never sell or rent personal data.
6. Your rights
Under Thailand’s Personal Data Protection Act B.E. 2562 (2019) you have the right to:
- access your data and obtain a copy;
- have inaccurate data corrected;
- have your data deleted, and withdraw consent at any time (without affecting earlier processing);
- object to or restrict processing, and request data portability;
- complain to the Personal Data Protection Committee (PDPC).
Send requests to hub.sea@wyssacademy.org or use the contact form. We will reply within 30 days.
7. Security
All connections are encrypted with HTTPS. Contact-form data can only be viewed by people signed in with an authorised account, and every change made in the CMS is logged.
8. Changes to this notice
If we update this notice, the date at the foot of the page will change, and significant changes will be flagged on the home page.
Last updated: [effective date]