Privacy Notice

Draft — last updated November 2026

The Andaman Institute for Education and Conservation ("Andaman IEC", formerly TCEC, "we", "us") is a collaboration between Rajamangala University of Technology Srivijaya (RUTS) and Eco Vacations in Trang Province, Southern Thailand. We respect your privacy. This notice explains what personal data we collect through this website, why we collect it, who we share it with, and the rights you have.

1. Who is responsible for your data

Andaman IEC is the data controller for personal data collected on this website. You can contact our Data Protection Contact at [email protected].

2. What we collect

  • Enquiry form: first and last name, email address, organisation, programme of interest, preferred dates, group size, your message, the site language you used, and a record of your privacy consent (date, time, IP address and browser type).
  • Chat assistant: the questions you type and the answers given, the site language, and your IP address. Please do not enter health, payment or other sensitive details in the chat.
  • Analytics cookies (only if you click "Accept all"): Google Analytics 4 collects pages viewed, approximate location, device and browser type, and how you arrived at the site. Analytics stays off until you agree.
  • Basic visit counts: we keep an anonymous count of page views on our own server, without cookies, so we can understand visits from regions where Google services are unavailable.
  • Security checks: Cloudflare Turnstile checks that enquiry submissions come from a person, not a bot, and may process your IP address and browser information for that purpose.

3. Why we use it and our legal basis

  • To reply to your enquiry and prepare a proposal — your consent and steps before a contract.
  • To run, secure and improve the website and chat assistant, and prevent spam — our legitimate interests.
  • To measure website use with analytics — your consent, which you can withdraw at any time.
  • To keep records required by law, safety rules or university requirements — legal obligation.

We do not sell your personal data, and we do not use it for automated decisions about you.

4. Children and young people

Many of our programmes involve school and university students. If you are under 20 (the age of majority in Thailand), please ask a parent, guardian, teacher or group leader to contact us on your behalf.

5. Who we share it with

  • Our founding partners RUTS and Eco Vacations, and only the programme partners needed to answer your enquiry (for example accommodation or dive partners).
  • Service providers who act on our instructions: website and database hosting, email delivery, the AI service that powers the chat assistant, Google (analytics) and Cloudflare (bot protection).
  • Authorities, if the law requires it.

6. International transfers

Some service providers store or process data outside Thailand (for example in the United States or the EU). Where this happens we rely on providers with appropriate safeguards, as required by Thailand's Personal Data Protection Act (PDPA). Visitors in mainland China should note that analytics is provided by Google; if you prefer, choose "Necessary only" in the cookie banner.

7. How long we keep it

  • Enquiries that do not lead to a booking: up to 2 years after our last contact.
  • Booking and participation records: up to 7 years, for legal, insurance and safety reasons.
  • Chat conversations: up to 12 months, to improve answers.
  • Consent records: for as long as needed to show that consent was given.

8. Your rights

Under the PDPA (and, where they apply, the EU GDPR and China's PIPL) you can ask to access, correct, delete or receive a copy of your data, object to or restrict how we use it, and withdraw consent at any time. You can change your cookie choice by clearing this site's data in your browser. Contact us at [email protected]; we will respond within 30 days. You may also complain to Thailand's Personal Data Protection Committee (PDPC).

9. Security

We use encrypted connections, access controls, spam protection and limited staff access to protect your data. No system is completely secure, so please contact us immediately if you think your data has been put at risk.

10. Changes

We may update this notice. The date at the top shows the latest version.

This privacy notice is a draft and will be reviewed by a qualified Thai legal adviser before final publication.