Privacy Policy

1. Our Privacy Policy

1.1 Regent’s International School, Bangkok ("RISB") is committed to safeguarding personal data in accordance with the Personal Data Protection Act B.E 2562 (2019) of Thailand ("PDPA"). This privacy notice is addressed to parents or guardians that are responsible for one or more prospective, past or present students of RISB. It explains how we collect and use your personal data and the personal data of each student you are responsible for during the course of our provision of educational and related services.

1.2 This privacy notice is intended to explain our privacy practices and covers the following areas:

• What personal data we process
• How we use your personal data
• Use of sensitive personal data / criminal convictions data
• Transmission, storage and security of personal data
• Rights relating to personal data
• Changes to our privacy notice
• Definitions, lawful bases and contact details

1.3 By providing your information, or the information of any student you are responsible for (whether via our website, in person, in writing or over the phone), you acknowledge the processing set out in this privacy notice. Where required by the PDPA, we will seek your explicit consent for certain activities, for example where we process sensitive personal data (see Section 4) or use non-essential cookies.

1.4 Most of the processing activities set out in this privacy notice are undertaken by our school. Limited processing activities are undertaken by NAE itself, as the ultimate owner of the schools. The exact split differs between schools, students and over time. We can confirm which processing activities are undertaken by which entity upon request.

1.5 This privacy notice only relates to processing undertaken by or on behalf of RISB and NAE. Whilst our websites may contain links to third-party websites, we do not accept responsibility or liability for their privacy policies or processing activities.

2. What Personal Data Do We Process?

We may collect and process the following personal data about you and any student you are responsible for:

• Biographical and identification information including name, gender, nationality, date and place of birth, family member details, passport and national identity information.
• Contact information including addresses, telephone numbers, email addresses and emergency contacts.
• Student information including admission information, test scores, start date, year group, class information, school ID, grades, transcripts, assignments, observations, participation records, learning skills, notes, timetables, transport routes, photographs, videos, communications and safeguarding reports.
• Financial information including bank account information, credit/debit card information and relevant financial checks.
• Correspondence including records of communications with students, parents and guardians.
• Website and communication usage including IP addresses, domain names, browser versions, operating systems, traffic data, location data, web logs, cookies and telemetry data.
• Information provided to us through enquiry forms, feedback forms and other communications.
• Sensitive Personal Data processed only in limited circumstances as described in Section 4.

3. How We Use Your Personal Data

3.1 We may process your personal data manually or electronically, including through learning tools and technologies.

3.2 Personal data will only be processed where we have a specific purpose and lawful basis for doing so.

1. Select, onboard and enrol students

   To process applications, testing, interviews, travel arrangements and student enrolment activities.

   Lawful bases: Contract performance; legitimate interests; explicit consent or PDPA exception for Sensitive Personal Data.

2. Manage academic, sporting and boarding timetables

   To schedule activities and provide access to school communication and information systems.

   Lawful bases: Contract performance; legitimate interests.

3. Develop and support students

   To assess progress, support learning and provide development opportunities. This may include limited processing of religious beliefs, ethnicity, race, sex life or orientation where necessary.

   Lawful bases: Legal obligation; contract performance; legitimate interests; consent where applicable.

4. Provide a safe and healthy environment

   Including processing health information and criminal offence information where permitted by law.

   Lawful bases: Contract performance; legal obligations; legitimate interests.

5. Conduct extra-curricular programmes

   To organise activities, expeditions, insurance and supervision arrangements.

6. Keep parents and guardians informed

   To provide reports, updates, parent portal access and communications regarding students.

7. Provide newsletters and marketing materials

   To send information about products and services where consent has been provided.

8. Ensure payment

   To recover outstanding fees and pursue legal recovery where necessary.

9. Improve our services

   To analyse requirements and enhance educational offerings.

10. Support, develop and improve teaching

    To analyse pseudonymised data and improve curriculum, technology tools, products and services.

11. Monitor certain activities

    To ensure student safety, prevent misuse, maintain network security and comply with laws and policies.

12. Ensure website content is relevant

    To optimise website presentation and user experience.

13. Reorganise or make changes to our business

    To support mergers, acquisitions, restructuring or business transfers.

14. Meet legal and regulatory obligations

    To comply with legal requirements and cooperate with regulators, courts and law enforcement agencies.

Sharing Personal Data with Other Organisations

In order to provide educational and extra-curricular services effectively, we may share information with:

• NAE regional office teams undertaking management functions.
• Suppliers supporting educational services, transportation, catering, technology and programme delivery.

Where such entities are located outside Thailand, transfers will be conducted in accordance with the PDPA.

4. Use of Sensitive Personal Data

As a general rule, we do not process Sensitive Personal Data unless necessary for providing educational services and where permitted under the PDPA.

Categories of Sensitive Personal Data may include:

• Health and medical information.
• Religious beliefs, ethnicity and race.
• Sex life or orientation.
• Photographs and video footage used for identification or security purposes.
• Criminal offence information where required for safeguarding or legal compliance.

We apply enhanced safeguards including access controls, audit logging, encryption, retention limits and periodic reviews.

Where required, consent will be obtained from a parent, guardian or student as appropriate.

5. Transmission, Storage and Security of Personal Data

Security over the Internet

No data transmission over the Internet can be guaranteed to be completely secure. However, we maintain commercially reasonable physical, technical and organisational safeguards.

All information is stored on secure servers and accessed in accordance with our security policies.

We request that users:

• Do not share passwords granting access to school systems.
• Follow all security procedures communicated by the school.

Cross-Border Transfers (Export Outside Thailand)

As part of a global network of schools, personal data may be transferred, stored or accessed outside Thailand. Such transfers are conducted in accordance with PDPA requirements and safeguards.

Storage Limits

Personal data is retained only for as long as necessary for the purposes for which it was collected and any related legal or business requirements.

When records are no longer required, they are securely destroyed or irreversibly anonymised.

6. Rights Relating to Personal Data

Under the PDPA, data subjects have a number of rights relating to their personal data.

• The right to be informed.
• The right to withdraw consent.
• The right to access personal data.
• The right to object to processing.
• The right to restrict processing.
• The right to correct personal data.
• The right to data portability.
• The right to erasure, destruction or anonymisation.

If you wish to exercise any of these rights, please contact us.

You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC): https://www.pdpc.or.th

7. Changes to Our Policy

This privacy notice was last updated on 25 January 2026.

Appendix 1: Definitions

• Personal Data – Information relating to an identifiable natural person.
• Sensitive Personal Data – Personal data relating to health, ethnicity, religion, sexuality, criminal records, biometric data and other protected categories.
• Data Controller – The organisation determining the purposes and means of processing.
• Data Subject – The individual to whom personal data relates.
• Data Processor – A party processing personal data on behalf of the controller.
• Guardians / Parents – Parents or guardians responsible for a student.
• RISB – Regent’s International School Bangkok.
• NAE – Nord Anglia Education.
• Student – Any prospective, current or former RISB student.

Appendix 2: Contacting Us

We would, however, appreciate the chance to deal with your concerns before you approach the PDPC, so please get in touch with us in the first instance.