Last Updated: August 25, 2026 · Effective Date: August 25, 2026
1. Data controller and scope
LITALK Education (“LITALK”) acts as data controller where it determines the purposes and means of processing personal data in connection with its website, educational programmes, Student Portal, account services, attendance and check-in features, payment-related services, communications and other LITALK-operated services (collectively, the “Services”). Additional notices may apply to particular features and shall be read together with this Policy.
AI Privacy Notice · Cookie & Local Storage Policy · Terms of Service
2. Categories of personal data
Depending on the Service used, LITALK may process identity and contact data; profile and media data; account and authentication data; educational and learning records; attendance and check-in records; payment, transaction and billing data; communications; technical, device, security and preference data; and AI-related data as further described in the AI Privacy Notice. Authentication for the Student Portal is provided using Auth0. LITALK does not store a user's Auth0 password in its application database. Payment providers may process payment credentials that LITALK does not intentionally store in full.
3. Sources of personal data
Personal data may be obtained directly from the data subject or a parent, guardian or authorised representative; from authorised LITALK personnel administering the Services; automatically through use of LITALK systems; or from service providers and business partners involved in authentication, payments, communications, educational delivery or other requested functions.
4. Purposes and lawful bases
LITALK may process personal data for enrolment and account administration; scheduling and delivery of educational services; attendance, assessment, learning progress and support; billing and payment administration; communications and customer support; authentication and access control; prevention of fraud, abuse and security incidents; troubleshooting and service improvement; exercise or defence of legal claims; and compliance with applicable law. Depending on the circumstances, processing may rely upon performance of a contract or steps requested before entering into a contract, compliance with legal obligations, legitimate interests to the extent permitted by law and not overridden by the data subject's fundamental rights, or consent where required or otherwise appropriate under applicable law. Acceptance of contractual terms does not, by itself, constitute consent to processing for which separate consent is legally required.
5. Service providers and recipients
Personal data may be disclosed or made available, to the extent reasonably necessary, to authorised LITALK personnel; Auth0/Okta for authentication and access management; Cloudflare for hosting, security and application/database infrastructure; Google and other providers used for communications, productivity, video conferencing or AI functions; payment processors and financial service providers; LINE and other communication providers where selected by the user; professional advisers; and public authorities or other recipients where disclosure is required or permitted by law. Appropriate contractual, organisational and technical safeguards will be applied where required by applicable law.
6. Cookies and browser storage
LITALK may use cookies, local storage and similar technologies for essential operation, authentication, security, service controls and user preferences. Further details are set out in the Cookie & Local Storage Policy.
7. International transfers
Use of certain service providers may result in personal data being transferred to, stored in or otherwise processed outside Thailand. Where the international-transfer provisions of the PDPA apply, LITALK will take steps intended to comply with Sections 28 and 29 of the Personal Data Protection Act B.E. 2562 (2019), applicable subordinate legislation and other applicable requirements, including reliance upon a lawful transfer mechanism or implementation of appropriate safeguards as the circumstances require.
8. Retention and disposal
Personal data will be retained only for so long as reasonably necessary for the purposes for which it was processed and for any additional period required or permitted by law, taking into account contractual obligations, account or enrolment status, security needs, legal claims and accounting or tax requirements. When continued retention is no longer required or permitted, LITALK will take appropriate steps to delete, destroy, de-identify or anonymise the data. AI chat messages are subject to the specific retention provisions in the AI Privacy Notice.
9. Security
LITALK implements technical and organisational measures intended to provide a level of security appropriate to the nature and risks of the processing, which may include authenticated access controls, restricted personnel access, protections for data in transit and safeguards supplied by infrastructure and identity providers. No transmission or storage method can be guaranteed to be completely secure.
10. Data-subject rights
Subject to the conditions, exceptions and limitations prescribed by applicable law, data subjects may have rights of access, rectification, erasure or destruction, restriction, portability, objection and withdrawal of consent where applicable, and may lodge a complaint with the competent supervisory authority. Withdrawal of consent does not affect processing lawfully undertaken before withdrawal and does not require cessation of processing supported by another lawful basis.
11. Minors
LITALK provides educational services that may be used by minors. The lawful basis for processing does not depend solely on age. Where consent is required for processing personal data relating to a minor, LITALK will obtain and manage that consent in accordance with Section 20 of the PDPA and other applicable Thai law, including from a person exercising parental power where required.
12. Amendments and contact
LITALK may amend this Policy to reflect changes in law, regulatory requirements, technology or the Services. Where a material amendment affects the manner of processing, notice will be provided by an appropriate means where required by law. Privacy questions and data-subject requests may be submitted to support@litalkeducation.com. LITALK may require information reasonably necessary to verify the identity or authority of the requester before acting upon a request.