Last updated: 31 March 2026 (B.E. 2569) · Version 1.0 · PDPA B.E. 2562 compliant. This is an English translation; in case of any difference, the Thai version prevails.
Introduction
DNATEC (the "we" or the "data controller") recognizes the importance of protecting your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA) and all related laws.
This privacy policy explains how we collect, use, disclose and manage your personal data when you use the Sample Receive System website at www.dnatec.org and https://dnatec.kps.ku.ac.th, and all related services.
Data controller
| Organization | DNA Technology Laboratory (DNATEC) |
| Websites | https://dnatec.org | https://dnatec.kps.ku.ac.th |
| System provided | Sample Receive System |
| Contact e-mail | prapasri_dnatec1@hotmail.com | cs2_dnatec@hotmail.com | anut.su@ku.th |
| Address | DNA and Genomics Building, 1 Moo 6, Kamphaeng Saen, Kamphaeng Saen District, Nakhon Pathom 73140, Thailand |
Personal data we collect
3.1 Data you provide directly (member system)
- Full name
- Username
- Password, stored only in hashed form
- E-mail address
- Telephone number (if collected)
- Information about submitted samples, such as sample details, date received and status
- Other information you enter in forms within the system
3.2 Data collected automatically
- IP address and network information
- Browser type and version
- Operating system and device type
- Pages visited, with date and time
- Referral URL
- Cookies and session data
3.3 Data from third-party services
Google reCAPTCHA
Bot protection: collects browser behavior, IP and Google cookies as a basic security measure.
Google policy →Purposes and legal bases for processing
| Purpose | Data used | Legal basis |
|---|---|---|
| Identity verification and member login | Username, password, e-mail | Contract, Sec. 24(3) |
| Providing the sample receive and status tracking system | Sample data, user data | Contract, Sec. 24(3) |
| Service notifications and communication | E-mail, telephone number | Contract, Sec. 24(3) |
| Bot prevention and security (reCAPTCHA) | IP, browser data | Legitimate interest, Sec. 24(5) |
| Usage statistics and website improvement (Analytics) | Usage data (anonymized) | Legitimate interest, Sec. 24(5) |
| Newsletter/marketing e-mails (if any) | Consent, Sec. 24(1) |
Cookie policy
| Cookie type | Source | Purpose | Can be disabled? |
|---|---|---|---|
| Website server | Login, session, security | No | |
| Google reCAPTCHA | Detecting and preventing automated bots | No | |
| Google Analytics | Usage statistics (anonymized data) | Yes |
You can manage cookies in your browser settings, or turn off analytics using the Google Analytics Opt-out.
Disclosure to third parties
We do not sell, rent or trade your personal data to outsiders, except in the following cases:
- External service providers acting on our behalf (Google LLC for reCAPTCHA, Analytics and Search Console), who are obliged to protect the data and not use it for other purposes
- Where required by law or ordered by a court, regulator or competent government official
- To protect the rights, property or safety of us, users or others
Transfers of personal data abroad
The Google services we use (reCAPTCHA, Analytics, Search Console) may process data on servers located abroad, including in the United States. Google LLC is the data controller for these services and follows international data protection standards.
Retention periods
| Member account data | For the duration of membership + 3 years after cancellation |
| Sample and test result data | At least 5 years, or as required by professional law |
| System access logs | No more than 90 days under the Computer Crime Act |
| Google Analytics data | 26 months (Google Analytics default) |
| Session cookies | Until the browser is closed or you log out |
When the period ends, we securely delete, destroy or anonymize the data.
Your rights as a data subject
Under the Personal Data Protection Act B.E. 2562 you have the following rights:
Right of access
Request to see the personal data we hold about you.
Right to rectification
Request correction of inaccurate or incomplete data.
Right to erasure
Request deletion when the data is no longer needed.
Right to data portability
Receive your data in a reusable format.
Right to object
Object to processing of your data in certain cases.
Right to restriction
Request temporary suspension of use of your data.
Right to withdraw consent
Withdraw consent at any time without affecting earlier processing.
Data security measures
HTTPS / TLS
Encrypts all data in transit.
Password hashing
Passwords are always stored in hashed form.
Role-based access
Access rights are controlled by role.
reCAPTCHA
Protects against brute force and bots.
Activity log
Access logs are recorded and reviewed.
Security updates
Regular system updates fix vulnerabilities.
If a high-risk data breach occurs, we will notify you and the relevant authorities within the period required by law.
Children and minors
Our website and systems are not directly intended for people under 20 years of age. If we find that we have collected a minor's personal data without parental consent, we will delete it as soon as possible.
Where a minor or incapacitated person uses the service, the consent of a parent or lawful representative is required first.
Contact and complaints
If you have questions or wish to exercise your rights under this policy, contact us at:
Duenthem Taya
cs2_dnatec@hotmail.com
+66 97 234 4461
Changes to this privacy policy
We may update this policy from time to time to reflect changes in law or operations. For significant changes, we will notify you through the website or by e-mail at least 30 days before they take effect.
By continuing to use the website after the policy takes effect, you are deemed to accept the revised policy.