Effective date: 25 October 2026 (updated the same day for newsletters and email measurement). This policy replaces the version of 31 January 2025.
Education Gateway Co., Ltd. (“we”, “us”) runs educationgateway.co.th and the services on it. This policy explains what personal data we collect for each service, why, how long we keep it, who processes it for us and the rights you have under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) and, where it applies to you, the EU General Data Protection Regulation (GDPR).
Who is responsible
Education Gateway Co., Ltd., 29/1 Moo 14, Tambon Suthep, Amphur Muang, Chiang Mai 50200, Thailand, is the data controller. For any privacy question or request, use our support form or email hello@educationgateway.co.th.
1. Visiting the website
- What: technical data your browser sends (IP address, device and browser type, pages visited, referring site) and the choices you make in our cookie banner.
- Why: to deliver and secure the website, prevent abuse and remember your cookie choice. Legal basis: our legitimate interest in running a safe website.
- Who processes it: our hosting provider (Elementor Cloud) and Cloudflare, which protects and speeds up the site. Fonts are served from our own server; we do not load Google Fonts.
- How long: server and security logs are kept by our providers for the short period their own policies set.
2. Analytics and cookies
- What: how the site is used (pages, clicks, sign-ups, purchases) through Google Analytics 4 and Cloudflare Web Analytics.
- Consent: analytics and advertising cookies are off until you accept them in the cookie banner (Google Consent Mode). You can change your choice at any time through the cookie icon on every page.
- Without cookies: when you decline, Google may still receive anonymous signals without cookies, and we report completed purchases to Google Analytics from our server with a random identifier and the amount only (no name, email or payment details), so our sales figures are complete.
- How long: Google Analytics keeps event data for the retention period set in our account, at most 14 months.
3. The DISC Work Style Check
- What: your answers, your DISC result, first name, email address, preferred language, and optionally your job type and organization; for invitations and group codes, the code you used and who invited you.
- Why: to calculate and show your report, email it to you, let you open it online, and, for team packages, show the organizer a team map and who has taken the test. Legal basis: performing the service you asked for (a contract).
- How long: results are deleted automatically after 13 weeks. You can delete your result at any time with the “delete my data” link in your report email.
- Who sees it: you; for a team package, the organizer who bought it (your profile and whether you completed the test); our coaches only if you book a debrief.
4. Purchases and tax invoices
- What: name, email address, what you bought, the amount and the Stripe transaction reference. Card details go directly to Stripe; we never see or store them.
- Why: to process your payment, give you access, send your code or link, handle refunds and keep accounting records. Legal basis: contract and legal obligation (Thai tax and accounting law).
- Who processes it: Stripe, Inc. as payment processor.
- How long: access links and codes expire after their validity period (30 to 90 days); accounting records, including tax invoice requests with company name, address and tax ID, are kept for the period required by law (normally 5 years).
5. Contact, support, debrief and quote forms
- What: what you enter, such as name, email, phone, organization, your message and, for support, a payment or code reference.
- Why: to answer you, help with your purchase or refund and arrange a debrief or quote. Legal basis: your request (pre-contract or contract) and our legitimate interest in answering enquiries.
- How long: up to 2 years after our last contact, unless the information is part of an accounting record.
6. Newsletters, sample report and other marketing emails
- What: email address, first name (optional) and, if you choose to give it, your mobile number (contact details only; we do not send SMS); the email series and newsletters you receive and the lists you are on; how you joined (a form on our site, or added by our team); and a record of your consent: date and time, the version of this policy, and for online sign-ups a one-way coded form of your IP address, never the address itself.
- What we send: the series you signed up for (for example the free sample report emails) and our newsletters, sent once or on a regular schedule.
- Consent: we only send marketing emails to people who agreed to receive them. When you sign up on our site you tick a consent box and confirm your address with the link in our confirmation email (double opt-in). If our team adds you, for example after an event where you agreed to hear from us, we record who added you and when, or we ask you to confirm by email first. Every email has an unsubscribe link that works at once, without logging in.
- Email measurement: our emails can record when an email was opened (through a small image) and which links were clicked, and links to our site carry campaign tags, so we can see which emails are useful. We store only that it happened, for which email and when; we do not store your IP address or device for this. You can avoid open tracking by not loading images, and we can switch this measurement off.
- How long: until you unsubscribe. After that we keep only your email address and the unsubscribe record, so we never email you again by mistake. If you ask us to erase your data, we delete everything except an anonymous note that consent was once given (date and policy version).
7. Accessibility and language tools
The accessibility widget (Elementor Ally) stores your display preferences in your own browser. Page translation (TranslatePress) runs on our server; machine translation of our page text is done by a translation service without any of your personal data.
Who we share data with
We do not sell or rent personal data. We share it only with providers that process it on our behalf under contract: Elementor Cloud (hosting), Cloudflare (security and performance), Stripe (payments), Google (analytics) and SendGrid (email delivery, through our hosting provider); with our coaches for a debrief you booked; and with authorities where the law requires it. Some of these providers process data outside Thailand, including in the United States and the European Union, with safeguards such as standard contractual clauses.
Your rights
Under the PDPA (and the GDPR where it applies) you may ask to see, correct, delete or receive a copy of your personal data, object to or restrict its use, and withdraw consent at any time (this does not affect what we did before). You may also complain to Thailand’s Personal Data Protection Committee (PDPC). Send requests through our support form; we reply within 30 days.
Security
We use encrypted connections (HTTPS), restricted administrator access, regular updates and backups. Report links and access codes are long and hard to guess, and the paid assessment content cannot be downloaded directly.
Children
Our services are meant for adults at work. We do not knowingly collect data from children under 18.
Changes
When we change this policy we update the date above and, for important changes, tell subscribers by email. Each marketing consent records the policy version that applied when it was given.