← Back

Privacy Policy

Last updated: March 2026

This Privacy Policy explains how Unishare ("we", "us", or "our") collects, uses, discloses, and protects your personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and applicable data protection laws.

1. Data Controller

The operator of this Unishare instance acts as the data controller. For questions about your personal data, contact the platform administrator via the email address provided during account setup or displayed in the platform footer.

2. Personal Data We Collect

We collect the following categories of personal data:

  • Identity data: name and profile picture (from Google/Microsoft or provided directly)
  • Contact data: email address
  • Academic data: department and enrollment year (optional)
  • Content data: posts, uploaded files, comments, and reactions you create
  • Usage data: post views, saved posts, reading lists, follow relationships
  • Technical data: session tokens, login timestamps, IP address (for security)
  • Consent record: timestamp of when you consented to this policy

3. Lawful Basis for Processing

We process your personal data on the following lawful bases under PDPA Section 24:

  • Consent (Section 24(1)): collected at account registration for data processing activities described in this policy
  • Contractual necessity (Section 24(3)): to provide the platform services you have signed up for
  • Legitimate interests (Section 24(5)): platform security, fraud prevention, and abuse detection

4. How We Use Your Data

  • Operate and maintain the Unishare platform
  • Display your name and profile on content you share
  • Send account-related notifications (new comments, reactions, moderation outcomes)
  • Enforce our Terms of Service and maintain platform safety
  • Generate anonymised aggregate statistics for administrators

5. Data Sharing and Disclosure

We do not sell your personal data. Data may be shared with:

  • Other users: your name, profile picture, department, and content you post are visible to other platform users
  • Service providers: cloud storage (file hosting) and email delivery, under data processing agreements
  • Legal obligations: when required by Thai law or a competent authority

6. Data Retention

  • Account data: retained while your account is active and deleted within 30 days of account deletion
  • Content (posts, comments): deleted with your account; anonymised soft-deleted copies may be retained for up to 90 days for abuse investigation
  • Security logs: retained for up to 12 months
  • Consent records: retained for 3 years after account deletion as required by PDPA

7. Cookies and Sessions

We use strictly necessary session cookies to keep you signed in. Session cookies expire after 7 days of inactivity. We do not use advertising or third-party tracking cookies. No cookie consent banner is required for strictly necessary cookies under PDPA.

8. File Storage

Files you upload are stored in cloud object storage. Access is controlled via short-lived signed URLs. Files are deleted when you delete your account or the associated post.

9. Your Rights Under PDPA

As a data subject under Thailand's PDPA, you have the following rights:

Right to be informed

To know what data we hold and how we use it — covered by this policy.

Right of access

To obtain a copy of your personal data. Use the "Download my data" option in your profile settings.

Right to rectification

To correct inaccurate data. Update your profile directly in settings.

Right to erasure

To request deletion of your account and personal data. Use "Delete account" in profile settings.

Right to data portability

To receive your data in a machine-readable format. Use "Download my data" in profile settings.

Right to object

To object to processing based on legitimate interests. Contact us at the address in Section 1.

Right to withdraw consent

To withdraw consent at any time without affecting prior processing. Delete your account or contact us.

Right to lodge a complaint

To file a complaint with the Personal Data Protection Committee (PDPC) of Thailand.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, including encrypted connections (HTTPS), hashed passwords, and access controls.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via a notice on the platform or by email. Continued use after notice constitutes acceptance of the updated policy.

12. Contact

To exercise your rights or ask questions about this policy, contact the platform administrator. We will respond to verified requests within 30 days as required by PDPA.