Last updated: 15 September 2025

1. Commitment to privacy

The Neurodiversity at Work Research Centre (NWRC) (collectively referred to as ‘we’ or ‘us’) is part of Steps Social Enterprise and works in partnership with Chulalongkorn University’s Sasin School of Management, focused on improving inclusive education-to-employment pathways. For PDPA purposes, Steps Social Enterprise is the data controller for NWRC activities.

We are committed to collecting, using, and disclosing personal data in accordance with Thailand’s Personal Data Protection Act 2019 (B.E. 2562) (‘PDPA‘), as well as applicable international regulations and applicable ethical standards of our partner institutions.

This Privacy Notice explains why your personal data is collected, used, or disclosed, the lawful bases for processing; our retention and deletion policies; the entities with whom it may be shared; our contact details, and your rights under Section 23 of the PDPA.

We only collect the minimum information required to operate this website, respond to enquiries, manage subscriptions, and (where applicable) process designated forms.

This Website Privacy Notice does not govern research participation. If you choose to take part in a study, you will receive a separate Participant Information Sheet and Consent Form specific to that study. 

2. What we collect and why

Under Section 6 of the PDPA, “personal data” means information relating to a Person that can identify that Person, either directly or indirectly, but does not include information relating to deceased Persons.

NWRC may collect the following categories of personal data:

     

      • Website and communications: technical/usage data (IP address, device type, browser, cookies), and registration data (name, email, organisation, preferences).

      • Expressions of interest: contact details (name, email; phone optional), basic demographics (for eligibility) to follow up about research opportunities, events, or resources.

      • Sensitive information  (collected via study-specific forms): Some forms on this website may ask for accommodations needs and/or other sensitive information where necessary  (e.g. to arrange reasonable accommodations or assess eligibility for a research study). These questions appear only in designated forms, and are optional unless required for the stated purpose. Please do not include sensitive information in general contact forms or free-text fields.

    3. Objectives of collection, usage, and disclosure and relevant lawful bases

    Objective Categories of Personal Data Lawful Bases
    Website operation & security – run pages, serve content, prevent abuse, maintain logs Technical/usage data (IP, device, browser), cookies (essential), server/security logs Legitimate interests
    Analytics & improvement – measure traffic and improve content Cookies/analytics identifiers, aggregated usage data Consent (via cookie banner)
    Communications – respond to enquiries or provide information you requested Contact/enquiry data (name, email, organisation/role, message), preferences Legitimate interests / Consent / Contract (where service requested)
    Newsletters/updates – send emails you opt into and manage your preferences Name, email, subscription preferences Consent (withdraw any time)
    Accessibility & accommodations – arrange reasonable adjustments for research participant, events, and services if you choose to tell us Sensitive data you provide (e.g., accommodation needs/health details), relevant contact data Explicit consent (PDPA s.26)
    Research screening via the website  – limited eligibility questions, incl. health/diagnosis and/or accommodations, where relevant Sensitive data and basic eligibility/demographics collected only in designated forms Explicit consent (full study processing is governed by the Participant Information Sheet + Consent, not this website notice)
    Compliance – record-keeping, responding to authorities, legal/ethics obligations Any relevant data Legal obligation

    4. Retention and deletion policies

    We keep personal data only for as long as necessary to fulfil the purposes described in this notice, after which we delete, destroy, or anonymise it. Where we cannot specify an exact period, we apply clear retention criteria consistent with our data-retention standard. 

    Typical retention periods (website and communications) 

       

        • Enquiries & expressions of interest: while active, then up to 12–24 months after our last interaction (for follow-ups and audit).

        •  Newsletter/subscription records: until you unsubscribe, then up to 12 months to evidence opt-out.

        • Server/security logs: up to 12 months, or longer if needed for incident investigation.Analytics data: per the provider’s settings (see Cookie/Providers notice).

      Sensitive information collected via forms 

         

          • Accommodation requests: keep only as needed to arrange and evidence accommodations, typically up to 12 months after the relevant event/service.

          • Screening for research (where conducted on the site): responses from ineligible candidates are kept briefly (30–90 days) then deleted/anonymised; subsequent processing for eligible participants follows the study’s Participant Information Sheet and Consent.

        Deletion on request: If you ask us to delete your data, we will act without delay and within 90 days, including copies and backups, and ensure the result cannot reasonably be recovered or re-identified. Where immediate deletion is not feasible, we will restrict use and disclosure until deletion is completed, subject to legal retention requirements

        5. Sharing your data with third parties

        We do not sell personal data. We share it only as needed for the purposes in this notice and with appropriate safeguards:

           

            • Within Steps/NWRC (need-to-know): Access is limited to authorised team members who require it to operate the website or handle your enquiry.

            • Service providers (processors): For hosting, security/CDN, email delivery, web forms, and analytics (e.g., website host, [Cloud provider], [Email/Newsletter service], Forms tool such as Google Forms or Qualtrics,  [website analytics tool]).

            • Professional advisers and authorities: Where required to meet legal, regulatory, or security obligations (e.g., auditors, regulators, law enforcement).

            • Aggregated/anonymous data: We may share de-identified statistics (e.g., website usage) that do not identify you.

          6. Rights of the data subject

          Under the PDPA, you have the right to:

             

              • Access (s.30): request access/a copy, and disclosure of how data was obtained without consent.  

              • Portability (s.31): receive data in a structured, commonly used, machine-readable format and have it transmitted to another controller.

              • Object (s.32): object to collection/use/disclosure in the circumstances set out in s.32.

              • Erasure/anonymisation (s.33): request deletion, destruction, or anonymisation where grounds apply.

              • Restriction (s.34): request restriction of processing in the situations listed (e.g., pending verification).

              • Accuracy (s.35): ensure data is accurate, up-to-date, complete, and not misleading.

              • Withdraw consent (s.19): You may withdraw your consent at any time without penalty.

            We will respond to requests for access or correction of personal data within one month as per PDPA requirements.

            7. Security, sensitivity, and confidentiality

            NWRC applies administrative, technical, and physical safeguards to protect your data:

               

                • Access restricted to authorised personnel on a need-to-know basis.

                • Digital files stored on encrypted drives or secure cloud services.

                • Physical documents kept in locked storage.

                • Pseudonymisation or anonymisation applied whenever possible.

                • Staff training on confidentiality and data-protection responsibilities.

                • Regular reviews to ensure compliance with PDPA and institutional standards.

              8. Contact information

              To exercise your PDPA rights, please email us with your request. We may ask for information to verify your identity.

              NWRC Data Protection Contact

              Email: nwrc@stepscommunity.com
              Mail: Steps 29/3 Charonmit, Ekkamai Soi 10, Sukhumvit 63, Bangkok, 10110, Thailand.