Data Privacy Policy

(updated: July 2024)

We, Asia Pacific Transgender Network Foundation (referred to in this Privacy Policy as “APTN”, “we” or “us”), are determined to protect the privacy of our employees, members, participants, and partners (collectively, “you”, or “Data Owner”) in the collection, use, disclosure and/or cross-border transfer of your personal data (“Data Processing”). To comply with the Personal Data Protection Act B.E. 2562 (A.D. 2019) and relevant notifications (“PDPA”), APTN has issued this Privacy Policy to inform you details of personal data we collect from you, how and why we collect, disclose, transfer and/or handle such personal data, your rights, and other terms and conditions with regards to our Data Processing of your personal data, including security measures that we adopt to protect your personal data.

1. Personal Data

“Personal Data” means any information related to you which can directly or indirectly identify you (excluding the deceased’s information). 

“Sensitive Data” means Personal Data that relates to racial or ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual orientation, criminal records, health information, disability, trade union information, genetic and biometric information or any data which may affect you in the same manner as prescribed by the Personal Data Protection Committee under the PDPA. 

2. Personal Data that we collect 

In collecting and storing Personal Data, APTN will use lawful measures and will only do so for the purpose of the operation of APTN, which consists of the following:

1. Information of employees includes (to the extent necessary): 
   1. personal information such as name, surname, photo, date of birth, identification card, passport and disability card;
   2. contact information such as address, email address, phone number and emergency contact;
   3. education information such as education level and background;
   4. family information such as names of your family members and their contact details;
   5. employment information such as internship and employment records; 
   6. financial and accounting information such as bank account number and copy of book bank;
   7. your Sensitive Data such as religion as shown in the identification card, blood type as shown in the identification card, medical information (which includes medical records, diagnosis and medication, including therapy and psychological assessment records), criminal records and biometric data; 
   8. other information necessary for complying with the laws; and
   9. other data such as records of our correspondence with you.
2. Information of members, participants and partners includes (to the extent necessary): 
   1. personal information, such as name, surname, photo, date of birth, identification card and passport;
   2. contact information such as address, email address, phone number, and emergency contact;
   3. financial and accounting information such as bank account number and copy of book bank; 
   4. your Sensitive Data such as religion as shown in the identification card, blood type as shown in the identification card, sexual orientation, medical information (which includes medical records, diagnosis and medication, including therapy and psychological assessment records), criminal records, biometric data; 
   5. information to be used to function, improve and develop our missions, operations, services seminars, trainings, workshops, projects and events;
   6. other information necessary for complying with the laws; and
   7. other data such as records of our correspondence with you or your representative. 
3. Legal basis for Data Processing of your Personal Data 

We will collect, use and/or disclose your Personal Data when it is necessary and there is a lawful basis for such collection, use or disclosure. Your consent may not necessarily be required if we have other legal basis to collect, use and/or disclose your Personal Data. Circumstances where your consent may or may not be required are as follows:

1. Personal Data necessary for compliance with law 

We may be required by laws, regulations and/or orders of competent authorities or courts, such the labour department or the tax authority, to collect, use or disclose your Personal Data in which case your consent will not be required. 

2. Personal Data necessary for contract

We may need to collect, use or disclose your Personal Data in order to (a) process your request prior to entering into a contract with us, (b) authenticate your identity prior to entering into a contract with us or (c) perform our obligations under the contract. Your consent will not be required for these purposes.

3. Personal Data necessary for protecting our legitimate interest 

We may need to collect, use or disclose your Personal Data in order to protect our legitimate interest or a third party’s legitimate interest. This includes circumstances where your Personal Data is required for functioning, development or improvement of our missions, operations, services, seminars, trainings, workshops, projects and events, prevention of fraud, internal compliance and good governance of APTN and to maintain our relationship and security. If the Data Processing of your Personal Data relies on this legal basis, we will ensure that it will not violate your fundamental rights. Your consent will not be required for this purpose. 

4. Other legal basis

In addition to the legal basis described above, we may rely on other legal basis, as described under the PDPA, to collect, use or disclose your Personal Data. Such legal basis includes circumstances where your Personal Data is required for performing public tasks or exercising official authority or preventing harm on a person’s life or health.

5. Personal Data which requires your consent 

We may ask for your consent prior to a Data Processing in the following circumstances: 

1. a Data Processing of your Personal Data which is Sensitive Data when other legal basis do not apply;
2. when we would like to contact you to promote and advertise our missions, operations, services, seminars, trainings, workshops, projects or events;
3. when you are minor, incompetent or quasi-incompetent whose consent must be given by parents, guardian or curator (as the case may be); or
4. other circumstances which PDPA requires your consent.
5. Sources of our collection
   1. We may collect Personal Data directly from you through the process of our operations and/or services in the course of our interactions and communications with you, including your participation of the seminars, trainings, workshops, projects, events and/or through any forms of channels including our online channels (e.g. website, mobile application, etc).

5. Purposes of the Data Processing

We may process the Personal Data collected for the following purposes. If the Personal Data shall be used for other purposes apart from the below, we will inform you before or when the data is being collected.

1. Information of members, participants and partners
   1. To carry out of our missions, operations and/or services, including holding seminars, trainings, workshops, projects or events of any kinds; 
   2. To conduct a survey research, data analytic studies, prepare studies and reports, send updates, newsletters and publications, and coordinate with government officials, service providers and other stakeholders;
   3. To perform and fulfill our contractual and legal obligations. We may require your Personal Data such as name, surname, photo, date of birth, identification card, passport, phone number, address and email address for the purpose of entering into a relevant agreement. If such Personal Data cannot be provided, APTN may not be able to enter into a contract with you;
   4. To promote and advertise our missions, operations, services, seminars, trainings, workshops, projects and/or events of any kinds on our website, social media and other channels; and
   5. To carry out financial and tax activities such as making or receiving any payment pursuant to any agreed arrangement.
2. Disclosure or sharing of Personal Data 

We will not disclose or share your Personal Data to any third parties unless under such disclosure complies with the following criteria:

1. Information of members, participants and partners 

We may share your Personal Data, to the extent necessary on our website, publications, advertising materials, newsletters, presentations to our partners, stakeholders or the public for marketing activities. However, we will ask for your explicit consent prior to any of the disclosure or sharing of your Sensitive Data.

7. Transfer of Personal Data outside Thailand

If it is necessary for us to the transfer of your Personal Data to any person or entity outside Thailand where such destination may not have in place adequate protection for the Personal Data as prescribed under the law of such jurisdiction, we will ask for your consent prior to a cross-border transfers of your Personal Data, unless the PDPA allows us to transfer your Personal Data without your consent, for instances, for the purpose of compliance with laws. In such cases, we will comply with all requirements imposed by the PDPA.

8. Protection of Personal Data 

The security of your Personal Data is important to us. We implement appropriate security measures to protect your personal data from unauthorised use or access or leakage. Our measures include:  

1. We apply physical and electronic safeguards in connection with the collection, storage and disclosure of your Personal Data;
2. We protect the security of your Personal Data while it is being transmitted by using standard web protocols of encryption (es. SSL, GMAIL encryption);
3. We use computer safeguards such as firewalls and data encryption to keep your Personal Data safe;
4. We only authorise access to employees and trusted partners who need it to carry out their responsibilities; and
5. We regularly monitor our systems to ensure no information leakage.
6. Duration of Personal Data storage

No.	Type of Personal Data	Storage period
Information of members, participants and partners
	personal information, such as name, surname, photo, date of birth, identification card and passport;contact information such as address, email address, phone number and emergency contact;financial and accounting information such as bank account number and copy of book bank; your Sensitive Data such as religion as shown in the identification card, blood type as shown in the identification card, sexual orientation, medical information (which includes medical records, diagnosis and medication, including therapy and psychological assessment records), criminal records and biometric data;information to be used to function, improve and develop our missions, operations, seminars, trainings, workshops, projects, and events;other information necessary for complying with the laws; andother data such as records of our correspondence with you or your representative.	Up to 10 years after the completion of the relevant seminars, trainings, workshops, projects or events.

10. Amendment of the Privacy Policy

We may amend this Privacy Policy from time to time by publishing the amended Privacy Policy on our website: https://www.weareaptn.org/privacy-policy/ with the date of the latest amendment and you will be notified of such update. 

11. Your rights as the Data Owner

You can request to exercise the following rights to the extent permitted by law and as prescribed in this Privacy Policy:

1. a right to withdraw consent to the Data Processing previously granted;
2. a right to access to, and ask for, a copy of your Personal Data;
3. a right to request APTN to provide a copy of your Personal Data in a machine readable format and to request APTN to transfer your Personal Data to a third party or to receive your Personal Data which was sent or transferred to the third party (unless it is technically impossible to do so or we are entitled to reject your request pursuant to the PDPA);
4. a right to object the Data Processing at any time relating to your Personal Data collected (a) for public interest and legitimate interest purpose (b) for direct marketing purpose and (c) for scientific, historical or statistic research (unless we have compelling legitimate interest to retain or continue using or disclosing your Personal Data, for example, your Personal Data is required for us to initiate or defend a claim);
5. a right to request APTN to erase, destruct or anonymise your Personal Data (unless we have legal grounds to reject your request) in case that the consent for the Data Processing is withdrawn, the Data Processing was lawfully objected, or the Personal Data is unlawfully obtained;
6. a right to restrict the Data Processing of Personal Data if it is the data that must be erased, is no longer needed, or is pending a verification on objection or the accuracy of the Personal Data; and
7. a right to raise a claim against APTN or its employees upon its or their violation of the PDPA.
8. Personal Data collected before 1 June 2022

Any Personal Data which APTN have collected prior to the effective date of the PDPA (1 June 2022), APTN shall be entitled to continue to collect and use such Personal Data for the original purposes. If you do not wish for APTN to continue collecting and using such Personal Data, please contact APTN via the channel in Clause 13 of this Privacy Policy below to make your request. 

13. Our contact details : 

If you have any queries or requests relating to your Personal Data, please contact us at hello@weareaptn.org.