Effective date: 8 September 2026

Shining Stars Co., Ltd., operating as Shining Stars School Kamala (“Shining Stars,” “the School,” “we,” “us,” or “our”), respects the privacy of children, parents, guardians, employees, website visitors and other members of our school community.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and other applicable laws.

1. Who We Are

Shining Stars Co., Ltd.
Shining Stars School Kamala
71/61 Moo 5, Kamala, Kathu
Phuket 83150, Thailand

English enquiries: 062 0305 774
Thai enquiries: 090 170 3932
Website: https://shiningstarskamala.com/

Shining Stars Co., Ltd. is the data controller responsible for deciding why and how personal data covered by this policy is processed.

2. Personal Data We May Collect

The personal data we collect depends on your relationship with the School.

Parents, guardians and website visitors

We may collect:

• Parent or guardian name

• Email address

• Telephone number

• Home or contact address

• Information submitted through our website, telephone, WhatsApp, social media or in person

• Enrolment enquiries and visit requests

• Communication preferences

• Records of correspondence with the School

• Website usage information, including IP address, browser type, device information and cookie data

Children

When a family applies for or accepts a place at the School, we may collect:

• Child’s name, date of birth, age, gender and nationality

• Home address and contact information

• Parent and guardian details

• Emergency contact details

• Authorised collection information

• Attendance and enrolment records

• Educational observations, learning records and progress information

• Photographs, videos and examples of children’s work

• Health, allergy, dietary, medication, disability or additional-support information when necessary

• Accident, incident, safeguarding and wellbeing records

• Copies of identification or other documents required for enrolment, administration or legal compliance

Information about a child’s health, disability, ethnicity, religion or other protected characteristics may be considered sensitive personal data. We process this information only when necessary and when permitted by law, including where appropriate consent has been obtained from a parent or legal guardian.

Employees, applicants and service providers

We may also collect personal data relating to employees, job applicants, contractors, suppliers and other people working with the School. This may include identification, contact, employment, qualification, payment and background-check information where appropriate and legally permitted.

3. How We Collect Personal Data

We may collect personal data:

• Directly from parents, guardians, employees or other individuals

• Through enrolment documents, consent forms and school records

• Through our website contact form

• By telephone, email, WhatsApp or social media

• During school visits, meetings and events

• Through photographs, video recordings or security systems used at the School

• From another parent, guardian or authorised representative

• From service providers or public authorities when legally permitted

• Automatically through website cookies and similar technologies

Parents and guardians should provide personal data about another person only when they are authorised to do so.

4. Why We Use Personal Data

We may use personal data to:

• Respond to enquiries and arrange school visits

• Process applications and manage enrolment

• Provide education, care and age-appropriate support

• Communicate with parents and guardians

• Maintain attendance, learning and progress records

• Protect children’s health, safety and wellbeing

• Manage allergies, medical needs and emergency situations

• Confirm who is authorised to collect a child

• Organise school activities, celebrations and events

• Share approved school updates, photographs or videos

• Operate and improve our website

• Understand how visitors use our website

• Maintain the security of our website, systems and premises

• Manage employees, contractors and service providers

• Maintain financial, administrative and legal records

• Comply with applicable laws and lawful requests from authorities

• Establish, exercise or defend legal claims

We will not use personal data for a purpose that is materially different from the purpose explained when it was collected unless we have a lawful reason to do so.

5. Our Legal Bases for Processing

Depending on the circumstances, we may process personal data because:

• It is necessary to respond to an enquiry or provide requested school services

• It is necessary to fulfil an enrolment agreement or another contract

• We must comply with a legal obligation

• It is necessary to protect a child’s or another person’s vital interests

• It is necessary for our legitimate interests in operating, protecting and improving the School, provided those interests do not override the rights of the individual

• A parent, guardian or other individual has given consent

• Another legal basis permitted under the PDPA applies

Where processing depends on consent, consent may be withdrawn at any time. Withdrawal does not affect processing that took place lawfully before consent was withdrawn.

6. Children’s Photographs and Videos

We may take photographs or videos to document children’s learning, activities and school experiences.

We will request appropriate permission before using identifiable photographs or videos for external promotional purposes, including on:

• The School’s website

• Social media pages

• Printed promotional materials

• Advertisements or public directory listings

• Media or community publications

Parents and guardians may withdraw permission for future promotional use by contacting the School. Withdrawal will not necessarily remove material that was lawfully published before permission was withdrawn, particularly printed material or content shared by others outside the School’s control.

Photographs and videos used internally for learning, safety, identification, recordkeeping or other legitimate school purposes may be handled separately from promotional consent.

7. Website Contact Forms and Communications

When you contact us through our website, WhatsApp, telephone, email or social media, we use the information you provide to respond to your enquiry and maintain an appropriate record of the communication.

Please do not send confidential medical records, passport copies or other highly sensitive documents through an ordinary website contact form or public social media message unless the School has specifically asked you to do so using an appropriate method.

WhatsApp, Facebook, Instagram and other external communication services process information under their own privacy policies. We encourage you to review the privacy information provided by those services.

8. Cookies and Website Analytics

Our website may use cookies and similar technologies to:

• Enable essential website functions

• Remember user preferences

• Protect the website against misuse

• Understand website traffic and visitor behaviour

• Measure the performance of website pages

• Display embedded maps, videos, social media or other third-party content

Some cookies are necessary for the website to function. Where required, non-essential analytics, advertising or third-party cookies will be used only after the visitor has made an appropriate cookie choice.

You can manage or delete cookies through your browser settings. Disabling certain cookies may affect how some parts of the website work.

9. When We Share Personal Data

We may share personal data only when reasonably necessary with:

• School employees and authorised staff

• Teachers and people responsible for a child’s care

• IT, website, hosting, communications and administrative service providers

• Professional advisers, including accountants, auditors, insurers and legal advisers

• Medical or emergency services when required

• Government departments, education authorities, law-enforcement bodies or courts when legally required

• Another school or educational provider when authorised or legally permitted

• Other parties with the consent of the parent, guardian or individual concerned

Service providers acting on our behalf must use personal data only for the authorised purpose and apply appropriate security and confidentiality measures.

We do not sell children’s or parents’ personal data.

10. International Data Transfers

Some website, cloud-storage, communications, analytics or social-media service providers may process or store personal data outside Thailand.

When personal data is transferred internationally, we take reasonable steps to ensure that the transfer is permitted under the PDPA and that appropriate safeguards are used where required.

11. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet educational, safeguarding, administrative, insurance, accounting and legal requirements.

Retention periods may differ depending on the type of record. When personal data is no longer required, we will securely delete, destroy or anonymise it unless continued retention is required or permitted by law.

12. How We Protect Personal Data

We use reasonable administrative, organisational and technical measures designed to protect personal data against:

• Unauthorised access or disclosure

• Accidental loss

• Improper use

• Unauthorised alteration

• Destruction or damage

Access to personal data is limited to people who reasonably need it for their work. However, no physical or electronic storage or transmission system can be guaranteed to be completely secure.

13. Your Rights

Subject to the conditions and exceptions in the PDPA, you may have the right to:

• Ask whether we hold your personal data

• Request access to and a copy of your personal data

• Ask us to correct inaccurate or incomplete information

• Request deletion, destruction or anonymisation of personal data

• Request restriction of certain processing

• Object to certain uses of personal data

• Request data portability where applicable

• Withdraw consent when processing is based on consent

• Make a complaint to Thailand’s Personal Data Protection Committee

For a child’s personal data, these rights will normally be exercised by the child’s parent or legal guardian, subject to applicable law and the child’s legal capacity.

We may need to verify your identity and authority before completing a request. Some requests may be restricted where retaining or processing the information is required for safeguarding, legal compliance, contractual obligations or the rights of another person.

14. Third-Party Websites

Our website may contain links to external websites, maps, social media services or other platforms. We do not control how those third parties collect or use personal data.

This Privacy Policy applies only to personal data controlled by Shining Stars Co., Ltd. Please review the privacy policies of external services before providing information to them.

15. Changes to This Policy

We may update this Privacy Policy when our practices, services or legal obligations change.

The current version will be published on our website with its effective date. Significant changes may also be communicated to parents, guardians or other affected individuals through an appropriate channel.