Privacy Policy

1. Scope

This policy applies to all personal data collected from students, parents/guardians, teachers, school staff, and other individuals in connection with our camping, trekking, and outdoor education programmes, and to everyone who uses our website.

2. Data Controller

Data Controller: Blackridge Group Company Limited

Address: 189/86 Town Plus, Hua Mak, Soi Krungthep Kreetha 7, Hua Mak Subdistrict, Bang Kapi District, Bangkok 10240

Contact: info@unclephannob.com | Tel: 082-163-2915

For data protection enquiries, please contact our Data Protection Officer at the address above or via email with the subject line "PDPA Enquiry".

3. Categories of Personal Data Collected

We collect the following categories of data, which are necessary for the safe delivery of our programmes:

General Personal Data: Full name, date of birth, age, nationality, passport/ID number (for national park entry), emergency contact details, school name and year group, dietary requirements, photographs and video for programme documentation.

Sensitive Personal Data: Medical conditions, allergies, disabilities, medication requirements, religious dietary needs, and any other health-related information disclosed for safety purposes.

4. Lawful Basis for Processing

We process personal data on the following bases under the PDPA:

• Contractual Necessity (Section 24(3)): To deliver the booked programme and fulfil our obligations to the school.
• Vital Interests (Section 24(4)): Medical and emergency data processed to protect life and safety during activities.
• Consent (Sections 19 and 26): Explicit consent is obtained for sensitive personal data and any processing beyond what is strictly necessary for service delivery.
• Legal Obligation (Section 24(6)): Where required by Thai law, including insurance and regulatory reporting.

5. Children’s Data — Special Protections

The booking school is responsible for obtaining all necessary parental and guardian consent prior to sharing student data with Uncle Phannob. By providing student data to us, the school confirms that appropriate consent has been obtained in accordance with PDPA Section 20 and the school’s own data protection policies.

Our expectations for consent, aligned with PDPA Section 20 and international best practice:

• For children under 10 years: Consent must be obtained exclusively from a parent or legal guardian.
• For children aged 10–17: Consent must be obtained from both the child and a parent or legal guardian.
• All consent forms should use clear, age-appropriate language.
• Schools must retain parental consent records and make them available for audit if required.
• We implement age-appropriate data minimisation — collecting only what is necessary for safety and programme delivery.

We provide schools with a template Data Collection & Consent Form that meets these requirements, but schools may use their own forms provided they cover the same scope of consent.

6. Data Sharing

Personal data may be shared with the following parties only as necessary:

• The booking school’s designated trip leader and educational visits coordinator.
• Medical professionals in case of emergency.
• Insurance providers in the event of a claim only — personal data is not shared with insurers in advance of the programme. Only anonymised group size and trip details are provided for policy underwriting.
• Thai government authorities where required by law (e.g. national park registration).

We do not sell, rent, or share personal data with third parties for marketing purposes.

7. International Data Transfers

Where personal data is transferred to the booking school or its parent organisation outside Thailand, we ensure that the receiving country or organisation maintains data protection standards equivalent to the PDPA, or appropriate safeguards are in place.

8. Data Security

We implement technical and organisational measures to protect personal data, including:

• Encrypted digital storage systems with role-based access controls.
• Physical documents stored in locked facilities with restricted access.
• Staff trained on data protection obligations and handling procedures.
• Regular review and audit of data security practices.

9. Data Retention

Personal data is retained only for as long as necessary:

• Booking and programme records: 3 years after the programme date.
• Medical/emergency data: Destroyed within 90 days of programme completion unless an incident report is active.
• Financial records: As required by Thai tax law (5 years).
• Photographs/video: Retained until consent is withdrawn, subject to a maximum of 2 years.

10. Data Subject Rights

Under the PDPA, individuals (or parents/guardians on behalf of minors) have the right to:

• Access their personal data held by us (Section 30).
• Request correction of inaccurate data (Section 35).
• Request deletion or destruction of data (Section 33).
• Object to or restrict processing (Sections 32 and 34).
• Data portability (Section 31).
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

Requests should be submitted to info@unclephannob.com and will be responded to within 30 days.

11. Data Breach Notification

In the event of a personal data breach that poses a risk to data subjects, we will notify the Personal Data Protection Committee (PDPC) within 72 hours and inform affected individuals without undue delay, in accordance with PDPA requirements.

12. Consent Forms

We provide schools with a template Data Collection & Consent Form that covers all data described in this policy. Schools are responsible for obtaining signed consent from parents/guardians before sharing any student data with us. By submitting student data, the school warrants that all necessary consents have been obtained. Schools should retain original signed consent forms in accordance with their own record-keeping policies.

13. Our Website and Signing In

School staff sign in to our website to see and manage their school’s trips. They can sign in with a Google account, a Microsoft account, or an email address and password.

Signing in with Google or Microsoft: Google or Microsoft tells us your name, your email address and your profile picture, with your agreement on their sign-in screen. We use them only to sign you in, to show you the trips your school has shared with that email address, and to show your name to the people you work with on a trip. We do not ask for, and cannot reach, your emails, files, contacts or calendar.

Signing in with a password: Your password is held by our sign-in provider (Google Firebase) in a form that cannot be read back, never by us. A password sign-in also needs a code from your phone, from an authenticator app or a text message; for a code by text, the sign-in provider keeps your phone number to send it.

Where it is kept: Accounts and trip records are stored with Google Firebase, on Google’s servers, which may be outside Thailand (see section 7).

Not shared or sold: What Google or Microsoft tells us is used only as described here. It is not sold, not used for advertising, and not shared with anyone except as section 6 allows.

Website statistics: Our public pages use Google Analytics, which sets cookies to count visits and see which pages are read. It does not tell us who you are. You can block these cookies in your browser.

Closing your account: To have your account and what it holds deleted, email info@unclephannob.com. You can also remove our access from your Google or Microsoft account settings at any time.