Cornerstone Counseling Foundation (“the foundation” or “we”) realize the importance and have the determination to protect the personal data of service recipients (“you” or “the data subject”), according to the Personal Data Protection Act 2019 of Thailand, regarding the collection, use and/or disclosure of personal data (or “data processing”). The foundation, therefore, announces this privacy notice in order to inform the service recipients about their rights and the duties of the foundation, as well as any other conditions related to the collection, use and disclosure of personal data.

Definitions

“Personal Data” means any information relating to a person, which enables the identification of such person, whether directly or indirectly, but not including the information of the deceased persons in particular.

“Sensitive Data” means personal data pertaining to racial or ethnic origin, political opinions, part of religious affiliation , religious philosophical beliefs, sexual orientation/history , criminal record, health data, disability, trade union information, genetic data and biometric data, such as facial recognition data, iris recognition data or fingerprint recognition data.

“Foundation” means Cornerstone Counseling Foundation

“Service Recipient” consists of the individuals who receive mental health services from the foundation, the participants of the workshops or seminars organized by the foundation, both onsite and online workshops.

“Service Provider” consists of a counselor, psychologist, psychiatrist or any other therapist or team member working for the foundation, such as an art therapist, play therapist, facilitator or clinical services coordinator.

The Collection of Personal Data

The foundation collects, uses or discloses personal data under the Personal Data Protection Act 2019 of Thailand in that the personal data will be collected only when it is needed for the purposes of operating and providing mental health therapy services of the foundation. The details are as follows:

1. Personal Information: first-last names, nickname, age, birthday, gender, nationality, marital status, professions of the service recipients, signatures

2. Contact information: current address, telephone number, email address.

3. Workplace information: workplace name, name of a contactable individual at the workplace, workplace email and telephone number.

4. Information of a spouse: If married, first-last names of the spouse, email address and telephone number and workplace contact information.

5. Information of children: number of children, names, genders and ages of each child.

6. Emergency contact information: first-last names of the emergency contact, relationship, email address and telephone number.

7. Information about services received, such as appointments with a counselor, psychologist, psychiatrist or any other therapist or participation in workshops or seminars organized by the foundation.

8. Information related to participation in training organized by the foundation, such as information required for the workshop or training registration.

9. Statistical Data, such as numbers of individuals receiving services and the numbers of website visits.

10. Information related to health, such as history of previous treatments, history related to personal health, sleep patterns, mental health history and list of related symptoms.

11. Information from service survey and feedback form.

12. Information collected automatically from the system and devices, such as IP Address, Cookies, behaviors and history of service usages.

The foundation will ask for a consent from the data subject before or while collecting the personal data, except in the following cases:

1. Contractual obligation: in the cases that the collection, use or disclosure of personal data are needed in order for the foundation to provide services and for the performance of a contract to which the data subject and the foundation are parties.

2. Vital interest: for preventing or suppressing a danger to a person’s life, body or health.

3. Legal Obligation: when it is necessary for compliance with a law to which the foundation is subjected.

4. Legitimate interest: when it is necessary for legitimate interests of the operations of the foundation, except when such interests are overridden by the fundamental rights of the data subject and his or her personal data. Examples include: the fraud prevention, network security system, and protection of the freedom, rights and the benefits of the data subjects.

5. Educational research and statistics: for the achievement of the purpose relating to the preparation of historical documents or archives for public interest, or for purpose relating to research or statistics, in which suitable measures to safeguard the data subject's rights and freedoms are put in place;

6. Public interest: when it is necessary for the performance of a task carried out in the public interest by the foundation, or it is necessary for the exercising of official authority vested in the foundation.

Sources of personal data include:

1. Personal data collected directly from you (“the data subject”) that you have given when using services via our websites or other channels of the foundation, such as the information in the enquiry form on the websites, asking about counseling services and trainings of the foundation, the Client Information Form, counseling services received onsite and online, information given at the registration counter or any other information you have given voluntarily in a survey, a feedback form, correspondences via emails, telephone, digital devices or social media platforms, applications, in a job application form or via other communication channels between you and the foundation.

2. Personal data collected using technology that detects use of foundation websites, such as IP address, Mac address, Cookie ID, Location, the data usage of Application, Device ID, Browsing history, etc.

3. Personal data collected during workshops, seminars or any other activities of the foundation, such as photos, videos, survey, feedback forms, etc.

Purposes of Personal Data Processing

The foundation may use personal data according to the purposes listed below or according to other purposes notified during the time of collecting such data or according to the consent that you have given to the foundation when the foundation has collected such data.

1. Coordinating and making an appointment with a counselor, psychologist, psychiatrist of the foundation for mental health services you may receive onsite or online, as well as coordinating with a facilitator for trainings.

2. Verifying the identity of the service recipient.

3. Sending reminder notifications of appointments with a counselor, psychologist or psychiatrist of the foundation.

4. For evaluation and improvement of operating procedures in order to increase the quality of the services provided by the foundation.

5. Performing accounting and financial transactions such as the donation summary report for counseling services received, donation receipts, and proof of any other transactions performed according to the legal requirements.

6. For use in the legitimate interest of the foundation, such as the video records via CCTV and security.

7. For use in operations according to the regulations of the foundation.

8. For use in the recruitment of new hires and in the onboarding of employees of the foundation or for any other related purposes.

9. For use in the investigation and compliance to the laws, regulations and lawful duties of the foundation.

10. For use in communication in order to answer questions or respond to requests such as enquiries about counseling services, trainings and other services provided by the foundation, as well as receiving complaints about problems with provided services.

11. Facilitating and informing service recipients about the list of their benefits.

12. Conducting satisfaction surveys of service recipients as well as statistical analysis in order to improve the qualities of services.

Protection of Personal Data

The foundation collects the personal data by using systems that have technology mechanisms that are appropriate, and which ensure the safety and security of personal data according to the Personal Data Protection Act of Thailand and other related laws. The foundation controls and limits access to your personal data from unauthorized employees and representatives of the foundation in order to protect your personal data.

Disclosure of Personal Data

The foundation collects personal data for the purposes of operating and providing mental health services for the foundation. The personal data of service recipients will not be disclosed without an authorization, except in cases where the law or legal procedures mandate the disclosure of the personal data or the personal data is disclosed on the lawful bases to the governmental officers or offices and also in the cases where the service providers have the right to report due to ethical and professional obligations when the service providers have come to know, beyond a reasonable doubt, that you may pose a danger to yourself or to others.

Personal Data of Minors or Individuals with compromised decision making:

When the foundation knows that the data subject is a minor or is an individual whose decision making has been temporarily or permanently compromised, the foundation will not collect the personal data of such an individual unless the foundation has received a consent from another individual who has been authorized by law to legally take actions for the individual or a consent from a legal guardian of the data subject, as specified by law.

If the foundation has already collected personal data, but later comes to know that the data subject is a minor, or is an individual with compromised judgment, and the foundation has not received a consent from another individual who has been authorized by law to legally take actions for the individual or consent from a legal guardian of the data subject, as specified by law, the foundation will erase or destroy such personal data as soon as possible if the foundation does not have any other lawful basis, except receiving a consent for such collection, use and disclosure of such personal data.

The Transferring of Data Overseas

The foundation may transfer personal data overseas for the purposes of providing you services such as transferring data to the cloud-based system that has platforms or servers overseas (such as United States of America, Canada, etc.) in order to support information systems located outside of Thailand. The foundation ensures that the destination country or work unit has sufficient standards and a privacy protection policy.

Time Period of Data Retention

The foundation will retain your personal data only for the time period that such personal data are needed for the purposes stated in Purposes of Personal Data Processing. When the time period is completed and your personal data is no longer needed, the foundation will erase or destroy or make your personal data unidentifiable, according to the standard methods of destroying personal data that the committee or the law has announced or according to international standards.

Privacy Notice Updates

The foundation may periodically update the privacy notice on the website https://www.ccfthailand.org. Therefore, the foundation recommends that you review the privacy notice on our website regularly. Use of foundation services after an updated website privacy notice indicates acceptance of the updated privacy notice.

The Rights of Data Subject

Under the Personal Data Protection Act 2019 of Thailand, you have the rights of the data subject, with the details in this privacy notice as specified below:

1. Right to be informed: You have the right to be informed about the purposes of collecting, using and disclosing personal data.

2. Right of access: You have the right to request access to a copy of the personal data that is relevant to you, except in cases where the foundation has the right to deny your requests according to the laws or court orders and in cases where obtaining access or receiving a copy of the personal data may have impact that could cause damage to the freedom and rights of other individuals.

3. Right to data portability: You have the right to ask for your personal data to be transferred to an individual, a service provider or other work units that assist in providing you with the mental health treatment, for example, a legal guardian, psychiatrist or psychologist from a hospital, etc; for personal data that the foundation can convert into a machine – readable format that can be used or disclosed automatically via devices. To use the right of data portability, you need to fill out and sign the document, called “Authorization of Release or Exchange of Confidential Client Information.”

4. Right to object: You have the right to object to the collection, use or disclosure of your personal data at any time, except in cases where the foundation needs to deny your requests due to legal reasons.

5. Right to erasure / right to be forgotten: You have the right to ask for your personal data to be erased or destroyed or made unidentifiable, when the personal data is no longer needed, when the data subject withdraws his or her consent, or when personal data is not collected, used, or disclosed, according to legal guidelines.

6. Right to restrict processing: You have the right to restrict the processing of your personal information in certain cases. You can limit the way organizations use your data and this could be used as an alternative to requesting the erasure of your information. You have the right to restrict the processing of or to erase your personal information when it becomes irrelevant, is beyond the purpose necessary, or the data retention period ends.

7. Right to rectification: You have the right to update your personal data to be accurate, complete and current.

If you have any questions or would like to amend or delete your personal data, or exercise the rights of a data subject or discuss other matters related to your personal data, you may contact us via the information below.

Contact Information

Cornerstone Counseling Foundation

Address: 285/86 Moo 4 Soi Surapol 1 T. Thasala A. Muang Chiang Mai 50000 Thailand

Telephone number: 053-262-136, 053-262-137 and 081-960-8242

Email: intakethai@ccfthailand.org (for Thai clients)

Email: intake@ccfthailand.org (for Expatriate clients)

Announced on

11 December 2023

Executive Director