Personal Data Protection Policy

1. Data Controller

The Artificial Intelligence Creative Association of Thailand (the “Association”) is the data controller under this policy. For any matter concerning your personal data, contact aicat.information@gmail.com

2. Personal Data We Collect

The Association collects only the data necessary to operate its member registry:

• Account data — email address and sign-in credentials (passwords are encrypted by our authentication provider and are not accessible to the Association)
• Individual member applications — title, full name (Thai/English), 13-digit Thai national ID number, date of birth, phone number, address, province, postcode, organization, position, and position level
• Corporate member applications — legal entity name, taxpayer ID, company address, province, postcode, billing address, and contact-person details (title, full name in Thai/English, email, phone, position, and position level)
• Payment data — payment slip image with the transfer date/time and amount you declare
• Membership data — tier, member number, validity period, status, and consent timestamp

3. Why We Collect the National ID Number

The national ID number of individual members is collected solely to identify members accurately in the Association's member registry, as required by the Association's bylaws and the laws governing registered associations. It is never used for any other purpose and is never displayed publicly.

4. Purposes and Legal Bases

• Processing membership applications and maintaining the member registry — contractual necessity and legal obligation
• Verifying fee payments and issuing membership credentials (digital card, member number) — contractual necessity
• Communicating Association news and activities to members — legitimate interest
• Listing active corporate members (organization name, member number, and contact-person name) in the corporate directory, visible only to signed-in users — contractual necessity
• Any other purpose will be subject to your separate, specific consent

5. Disclosure and Data Processors

The Association does not sell or rent your personal data. We use the following service providers as data processors, each under its own data-protection safeguards:

• Clerk — user accounts and authentication; stores member profile data (servers located abroad)
• Vercel — website hosting and payment-slip file storage (servers located abroad)
• Notion — the Association's application registry, used by administrators to review and approve applications; stores only your name, email, phone, membership tier, organization, declared transfer details, and slip link (never your national ID, birthday, or address) (servers located abroad)
• Resend — sends the membership confirmation email using your email address and application summary

Use of these providers involves cross-border data transfers. The Association selects only providers with internationally recognized data-protection standards.

6. Retention Period

Your personal data is retained for the duration of your membership and for no more than 2 years after it ends, unless a longer period is required by law, after which it is deleted or anonymized.

7. Security Measures

All data is transmitted over encrypted connections (HTTPS). Access to the member registry is restricted to administrators designated by the Association. Passwords are stored in encrypted form by the authentication provider and cannot be read by the Association, and all system credentials are stored separately from the website.

Payment-slip files are stored at unguessable, unlisted URLs that are never published; the access link is shown only to the data owner and registry administrators.

8. Your Rights

Under Thailand's PDPA (B.E. 2562), you have the right to:

• Access and obtain a copy of your personal data
• Correct your data (self-service via the member portal)
• Request erasure of your data
• Request suspension of processing
• Object to processing
• Request data portability
• Withdraw consent at any time, without affecting prior processing
• Lodge a complaint with Thailand's Personal Data Protection Committee (PDPC)

To exercise any of these rights, contact aicat.information@gmail.com. The Association will respond within 30 days.

9. Cookies

This website uses only cookies strictly necessary for sign-in and account security. No advertising or cross-site tracking cookies are used.

10. Changes to This Policy

The Association may update this policy from time to time. The latest version and its effective date will always be published on this page. Members will be notified in advance of any change that materially affects their rights.