CYBERSKILLS Academy privacy notice

1. Who controls your data

CYBERSKILLS is the data controller for Academy. You can reach us at contact@cyberskills.co.th

2. What we collect, and why

We collect only what is needed to communicate with you, deliver learning, verify results, and protect the service.

• Launch waitlist — your email, referral source, and the time and wording of your consent, used for the launch, course, and promotional updates you chose to receive.
• Academy account — the identifier from our shared account system, verified email, chosen display name, account creation time, and last activity, used to sign you in and attach records to the right person.
• Access rights — service activation and course entitlement status, source, grant, expiry, and revocation times, used to open only the content you are entitled to use.
• Learning and assessment record — lessons started or passed, answers, video-question results, simulation evidence, issued task sets, pass or fail outcome, and related times, used to resume across devices, verify results, and resolve disputes.
• Operational history — progress resets, consent withdrawals, and rights-request status. Complaint text is not stored in assessment rows.

The current release does not collect payment data or issue certificates. We will update this notice before collecting new categories of data.

3. Legal grounds and required data

Marketing email relies on consent. Account creation, course access, and learning progress are used to provide the service you request. Security, result integrity, support, and appeals are processed only as needed for legitimate interests. Some records may also be kept to comply with law or establish, exercise, or defend legal claims.

Without the verified email and assessment data required for the service, we cannot create the account or record learning results. Declining marketing does not affect course access you already hold.

4. How long we keep it

• Waitlist and withdrawal record — three years from the current grant, a fresh grant after expiry, or withdrawal, then deleted unless the law requires a longer hold.
• Exam attempts not used as passing evidence — 90 days after a result is issued, or 90 days after an unfinished attempt expires. You may appeal within 30 days after a result is issued. An open case pauses deletion until it is resolved.
• Account and learning record — two years after your last Academy activity, unless you ask us to delete it earlier, an appeal remains unresolved, an active system responsibility requires the account, or law requires a hold.
• Consent and rights-request evidence — three years after the latest event so we can show what was requested and how it was handled.
• Staff access history — access and its related history are kept while that access remains active; after revocation, the assignment and history are kept for three years for security and accountability.

5. Who processes or receives it

We do not sell or rent personal data. It is processed by authorized personnel, our shared account system, database infrastructure operated by CYBERSKILLS, and web-infrastructure providers acting on our instructions.

If service delivery involves processing outside Thailand, we will use the safeguards and transfer ground required by law. The final processor and location inventory must be verified again before public launch.

6. Your rights, withdrawal, and result appeals

Subject to the law, you may request access or a copy, correction, portability where applicable, restriction, objection, or deletion. You may also withdraw consent and complain to Thailand’s Personal Data Protection Committee.

Every marketing email must include a recipient-specific unsubscribe link. Unsubscribing stops Academy marketing without changing your account or learning record. You can also email us at contact@cyberskills.co.th

To appeal an assessment result, contact us within 30 days after the result is issued and identify the account, course, and approximate time. We will hold that attempt evidence until the case is closed.

A valid access or copy request will be handled without delay and within 30 days. Other requests will be handled without delay under the applicable legal timeframe after we verify identity and protect other people’s rights. Email us at

7. How we protect it

Academy limits data access to server-side services, checks account and course authorization, keeps answer keys away from learner pages, and records results and evidence in one transaction. Controls are reviewed as the system and its risks change.

8. Changes to this notice

If a change affects the purpose, data, or your rights, we will notify you through an appropriate channel and seek fresh consent where the law requires it.