Privacy Policy

Last updated: 10 May 2025

1. Introduction

Gradient Lab ("we", "us", "our") is an online school offering AI development courses. We are committed to handling personal data with care and transparency. This policy explains what data we collect, how we use it, how long we keep it, and what rights you have in relation to it.

This policy applies to all personal data collected through our website at gradientlabidas.biz, through our course enrolment process, and through communications with our team. If you have questions, contact us at [email protected].

2. Data We Collect

Information you provide to us

• Name and email address (from enquiry or enrolment forms)
• Phone number (if you choose to provide it)
• Payment information (processed via our payment provider — we do not store full card details)
• Course work and submissions (stored as part of your learner record)
• Communications with instructors or support staff

Information collected automatically

• Browser type, device type, and operating system
• Pages visited and time spent on pages (via analytics cookies, if consented)
• IP address (anonymised where possible)
• Referral source (how you arrived at the site)

3. Legal Basis for Processing

We process personal data on the following bases:

• Contract: Data necessary to deliver a course you have enrolled in.
• Legitimate interest: Site analytics and improving our courses, where we have balanced this against your privacy interests.
• Consent: Marketing communications and optional cookies, where you have given clear consent that you can withdraw at any time.
• Legal obligation: Where required by applicable Thai law or other regulations.

4. How We Use Your Data

• Processing course enrolments and communicating about your course
• Providing instructor feedback and learner support
• Sending administrative messages (e.g. schedule changes, technical notices)
• Sending optional course-related updates (only with your consent)
• Improving course content and website functionality using aggregated data
• Meeting legal or regulatory obligations

We do not use your data to build advertising profiles or sell it to third parties.

5. Data Retention

• Enquiry form data: retained for up to 12 months from last contact
• Learner records (enrolled learners): retained for 3 years after course completion
• Payment records: retained as required by Thai tax and accounting law (minimum 5 years)
• Analytics data: aggregated and anonymised after 26 months

6. Data Sharing

We do not sell or rent personal data. We share data only in the following limited circumstances:

• Course delivery: Instructors and mentors can access learner submissions and communications as part of their role.
• Payment processing: Payment data is passed to our payment provider, which operates under its own privacy policy.
• Analytics: Anonymised usage data may be processed by analytics services (e.g. Google Analytics), subject to your cookie consent choices.
• Legal requirements: We may disclose data if required by law or regulatory authority.

7. Cookies

We use cookies for essential site functions and, with your consent, for analytics. See our Cookie Policy for full details, including how to manage your preferences.

8. Data Security

We store personal data on secure servers with access controls and encryption in transit. Access to learner data is restricted to staff members who need it as part of their role. In the event of a data breach that poses a risk to your rights, we will notify you and any relevant authority as required by law.

9. Your Rights

Under applicable data protection law, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Ask us to delete your data, subject to legal retention obligations.
• Restriction: Ask us to limit how we process your data in certain circumstances.
• Data portability: Receive your data in a structured, machine-readable format where technically feasible.
• Object: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting earlier processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Third-Party Links

Our website may contain links to external services or platforms. We are not responsible for the privacy practices of those sites. We encourage you to review their policies separately.

11. Children's Privacy

Our courses are intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have inadvertently done so, contact us and we will delete it promptly.

12. Governing Law and Jurisdiction

This policy is governed by the laws of Thailand, including the Personal Data Protection Act B.E. 2562 (PDPA). For data subjects in other jurisdictions where additional protections apply, we will seek to meet those standards as well.

13. Changes to This Policy

We may update this policy from time to time. We will post any changes on this page with a revised date. Continued use of our services after a material change constitutes acceptance of the updated policy.

14. Contact

For privacy-related questions or to exercise your rights:

• Email: [email protected]
• Post: Gradient Lab, 87 Phaya Thai Road, Ratchathewi, Bangkok 10400, Thailand