PDPA

Privacy notice

How T2B Academy collects and uses personal data. Version 2026-09-04 · draft — pending legal review

Who we are

The data controller is TIBD Company Limited (Tax ID 0105559056226), 50 Plant Factory Building, 2nd Floor, Ngamwongwan Rd., Lat Yao, Chatuchak, Bangkok 10900, which operates T2B Academy (the "Academy"). Courses are taught in laboratories operated by K-API; K-API is not the seller and is not the data controller. Contact for data matters: info@t2bacademy.com.

What we collect

  • Registration: name, email, mobile, company, role, seats, food choices and dietary needs, invoice details.
  • Account: sign-in codes, sign-in times, preferred language.
  • Learning record: sessions attended, certificates issued (code, course, date), online course progress synced from the learning platform.
  • Booking requests: organisation and contact details you send us.
  • Website: the source of your visit (campaign tags) and technical logs needed to run the site. We do not use advertising cookies.

Why we use it and on what basis

  • To run the session you registered for, issue your certificate, send confirmations and reminders (performance of contract).
  • To pass food orders and allergies to the caterer, when catering is booked (performance of contract; allergy data is used only for your safety).
  • To tell you about related courses and services of the Academy and its partners (consent, withdrawable any time).
  • To report aggregate, non-identifying attendance and utilisation numbers to K-API as the laboratory operator (legitimate interest).

Who receives it

  • K-API (laboratory operator): participant counts per session, and food and allergy counts when catering is booked.
  • Ubion Coursemos (online learning platform): your name and email to create your learner account, only after a data processing agreement is in place. Thai learner data is not used to train models.
  • Payment providers: the amount and reference of your payment.

How long

Learning records and certificates are kept so they can be verified. Contact details are kept while your account is active and for 3 years after your last activity, unless you ask us to delete them earlier.

Your rights

You can access, correct, export (transcript.json in your account) or ask us to delete your data, and withdraw marketing consent at any time. Use the request button in My details or write to the contact above. Certificates already issued are kept in anonymised form for verification.

This notice is a working draft prepared for the prototype and must be reviewed by counsel before launch (budget item 8).