Privacy Notice

The Braincloud group of companies ("we", "us" — each company and its role is listed in section 1) publishes this notice to explain how we collect, use and disclose your personal data when you use the Braincloud Learning app and website (the "Service"), in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").

Braincloud Learning is a teaching and learning service for learners at schools, educational institutions and other organisations that have an agreement with us (each, "your institution"). It is not open to public sign-up: accounts are created from information your institution provides to us.

1. Data controller

Braincloud Learning is built and run by the Braincloud group of companies, which have different roles:

Braincloud (Thailand) Co., Ltd. and Braincloud Education Technology Co., Ltd. 16/10 Sathon Nuea Road, Silom, Bang Rak, Bangkok 10500, Thailand

Build and run the platform, produce the curriculum content, and hold the agreements with institutions — each institution contracts with one of the two. The systems and servers that run the service are in Thailand.

Braincloud Inc. 3445 av du Parc, Montréal, H2X 2H6, Canada Builds the platform and produces the curriculum content, and publishes the mobile applications on the App Store and Google Play. It does not provide the service to users directly.

One contact point for all of them — email support@braincloudlearning.com

The controller of your personal data is the company that contracted with your institution. You do not need to know which one — write to the address above in any case and we will pass it to whoever is responsible.

Your institution is the controller of the educational records it sends us, and we process those records on your institution's instructions.

2. Personal data we collect

2.1 From your institution

Your name, username or learner number, year group and class, timetable, and enrolment records.

2.2 When you sign in

You can sign in several ways, and what we receive depends on which you choose.

• Signing in with Google, Facebook, Apple or LINE — we receive your name, email address, profile picture and the account identifier that provider assigns you. We never receive your password, and we cannot see anything else in your account, such as your friends or your posts. If you use Apple's "Hide My Email", we only ever receive the forwarding address Apple creates.
• Signing in by email — we store your email address and the six-digit code we send you. The code is deleted automatically when it expires.
• Signing in with your institution's learning management system (LMS) — we store that system's username and password in encrypted form, so we can connect to your institution's system on your behalf while you use the Service.

2.3 How you use the Service

Lessons and activities you open, attendance in online classrooms, your notification history and read status, and your settings such as language and which notifications you want.

2.4 Device, connection and notification data

If you allow notifications, we store a device token used to deliver them, the device type (web, iOS or Android), the device language, and when it was last used.

Separately, while you use the Service we record the following as a single current value, to keep accounts secure and to understand how the Service is used:

• the IP address you connect from;
• device details: brand, model, operating system and version, and the app version;
• the device's time settings: its time zone, and how far its clock differs from ours, so that class times and dates show correctly even when a device's clock is off;
• when you last used the Service.

This is deleted automatically after a year without use, and immediately when you delete your account.

2.5 Camera, microphone and location

The app asks for these only when they are needed, and you can refuse or withdraw permission at any time in your device settings.

• Camera — to scan a QR code to sign in, and to take part in online classrooms. QR scanning happens entirely on your device; those images are never sent to us. During online classes, occasional still images may be captured and kept for attendance and class records.
• Microphone — to take part in online classrooms, and to record your voice for speaking exercises. Recordings made for an exercise are sent to us so they can be assessed as your teacher requires.
• Location — to show local weather on your home screen, and to know in general terms which areas our users are in. If you allow it, your coordinates are sent to two external providers to be turned into a place name and to fetch the forecast (see section 4). We keep place names only — country, province, district and subdistrict — and never your coordinates, as a single current value that replaces the last one rather than a history of where you have been. The coordinates used to draw the tile stay on your own device so you are not asked again every time. If you would rather this was not sent, decline location access in your device settings. Everything else in the Service works normally without it.

3. Purposes and legal bases

4. Who we share data with

We do not sell, rent or trade your personal data for anyone else's marketing. We disclose only what is necessary, to:

• Your institution — its instructors and administrators can see your learning records as their roles require.
• Service providers that process data on our behalf, under contracts that allow them to use it only on our instructions:

• Government authorities, where we are legally required to disclose.

When you sign in with an external provider, that provider knows you use our Service. What they then collect and do is governed by their own policies and is outside our control.

5. International transfers

The systems and servers that run the service are in Thailand, and all of our users are in Thailand.

Some data is nonetheless held or processed by the external providers listed in section 4, which are outside Thailand. We put appropriate safeguards in place as the law requires, by choosing providers with recognised data protection standards and holding a data processing agreement with each of them.

6. How long we keep data

• Account and learning records are kept for no more than three years from your last use of the Service, unless the law requires longer — for example tax obligations, or a legal claim.
• Email sign-in codes are deleted automatically when they expire.
• Notification history is deleted automatically once the retention period set for that type of notification passes.
• When you delete your account, the data is removed from the live system immediately and held in an archived form for a further 90 days, so an accidental deletion can be reversed, after which it is permanently erased automatically.

7. Your rights

Under the PDPA you have the right to access your data and obtain a copy, to have inaccurate data corrected, to have data erased or destroyed, to restrict its use, to object to its collection or use, to data portability, and to withdraw consent.

You can delete your account and data yourself at any time from Profile → Delete this account. See How to delete your data.

For any other request, contact support@braincloudlearning.com. We will act on it without delay and, as the law requires, within 30 days of receiving it. Where your institution is the controller of the data in question, you may need to exercise the right through your institution directly, and we will help arrange that.

8. Security

All traffic is encrypted with HTTPS. Where we hold your learning management system password on your behalf, it is encrypted before it is stored. Access to the database is limited to staff who need it. We never hold the password to your Google, Facebook, Apple or LINE account.

No system is perfectly secure. If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee without delay and, so far as we are able, within 72 hours of becoming aware of it — unless the breach carries no risk to people's rights and freedoms. Where a breach carries a high risk to your rights and freedoms, we will also tell you, without delay, together with what can be done about it.

9. Children

This Service is used by learners, most of whom are minors. Accounts exist because of the relationship between the learner and their institution, and the institution obtains parental consent where the law requires it. We never use learners' data for advertising, commercial profiling, or sale to anyone else.

Parents who wish to exercise rights on a child's behalf should contact your institution, or us at support@braincloudlearning.com.

10. Cookies and on-device storage

We use cookies and browser storage only for what the Service needs to work: keeping you signed in, remembering your language and colour theme, remembering a few settings so you need not choose them again, and a copy of your latest learning results so pages show sooner, which is deleted when you sign out. We do not use cookies for advertising or for tracking you across other websites.

11. Changes to this notice

We may update this notice from time to time. The version in force is the one published on this page, with the date it was last updated shown at the top. If we make a material change, we will tell you through the Service or by email.

12. Contact and complaints

For questions about this notice, or to exercise your rights:

The Braincloud group of companies (each one and its role is listed in section 1) 16/10 Sathon Nuea Road, Silom, Bang Rak, Bangkok 10500, Thailand Email support@braincloudlearning.com

If you believe we are not complying with data protection law, you have the right to complain to the Office of the Personal Data Protection Committee of Thailand.