The Creative Photography Program, Faculty of Fine Arts, Chiang Mai University ("we"), as the Data Controller of the system Portfolio Online | CreativePhotography CMU places great importance on protecting your personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA). This policy explains how we collect, use, disclose and protect your data.
1 Data we collect
Data type
Examples
Purpose
Legal basis
Personal data
Full name, student ID, date of birth, phone number, email address
Identify students in the system and communicate with them
Performance of a contract / legitimate interest
Work data
Images, videos, captions, work-type tags
Display works on the public website
Consent / legitimate interest
Sign-in data
Email, password (hashed with bcrypt), Session ID
Verify identity and keep accounts secure
Performance of a contract
Technical data
IP address (used only to estimate country / province), User-Agent, pages visited, visit time
System security and error diagnosis (logs)
Legitimate interest
Cookie data
Session cookie, cookie consent value
Website operation and saving settings
Necessary / consent (depending on type)
Website visit statistics do not store IP addresses — the system uses the IP only to estimate the visitor’s country and province when a page is opened, and stores just the country / province name (location data by DB-IP.com).
We do not collect sensitive data such as health, religion or financial information unless explicit consent is given.
2 Purposes of use
Display students’ work on the online platform for educational purposes and portfolio building
Manage user accounts and access rights
Provide features for sharing works on social media
Keep the system secure and prevent unauthorised use
Improve service quality and user experience
Communicate about your account and important system updates
3 Disclosure to third parties
We do not sell, rent or trade your personal data for commercial purposes. We may disclose data in the following cases:
🏛️
Chiang Mai University
As the parent institution, for educational and administrative purposes
🌐
Technical service providers
Hosting providers (servers located in Thailand) bound by data-protection agreements
⚖️
Government authorities
When required by law or a court order — we will notify you in advance where possible
🔗
Social media (when you share)
When you press a share button, the work’s URL is sent to Facebook / LINE / X as you choose. The data sent is governed by each platform’s own policy.
4 Data retention
Data type
Retention period
User account and profile data
For as long as the account is active + 3 years after cancellation
Works (images, videos)
For as long as the account is active, or until deleted
System access logs
90 days, for security purposes
Session Cookie
Until the browser is closed or the session expires
Cookie consent value
365 days (stored in localStorage)
5 Cookie Policy
A cookie is a small data file stored on your device when you visit a website. This website uses the following cookies:
Required
Strictly Necessary cookies
These cookies are essential for the basic operation of the website, cannot be turned off, and do not store data that identifies you.
Name
Purpose
Lifetime
PHPSESSID
Keeps your sign-in session, CSRF protection
Session
ckc_consent
Records your acceptance of the cookie policy (localStorage)
365 days
Functional
Functional cookies
Help the website remember settings and improve usability, e.g. installing it as a Progressive Web App (PWA)
Name
Purpose
Lifetime
Cache (SW)
Service Worker cache for offline use (PWA)
According to SW settings
Social
Social media cookies
Used when you press a button to share a work to social media such as Facebook, LINE or X (Twitter). These cookies are governed directly by each platform’s policy.
You can also delete or block cookies through your browser settings (Chrome ·
Firefox ·
Safari)
6 Rights of data subjects
Under the Personal Data Protection Act B.E. 2562 (2019) you have the following rights:
Right to be informed
To know whether your personal data is being collected
Right of access
To request a copy of the personal data we hold
Right to rectification
To request correction of inaccurate or incomplete data
Right to erasure
To request deletion of personal data (Right to Erasure / Right to be Forgotten)
Right to object
To object to processing that lacks a sufficient legal basis
Right to restrict processing
To request suspension of processing in specified cases
Right to data portability
To receive data in a machine-readable format for transfer to another controller
Right to withdraw consent
To withdraw consent at any time without affecting rights already exercised
We will act on your request within 30 days of receiving it.
7 Data security
All passwords are encrypted with the bcrypt algorithm before storage — no one can read the actual password.
All connections use HTTPS/TLS to prevent data interception in transit
We use CSRF Token to prevent Cross-Site Request Forgery attacks on every form
The database sits inside the server’s private network and is not exposed to the public
Data access rights are strictly separated by role (admin / student / public)
8 Transfer of data abroad
We normally do not transfer personal data abroad. However, when you choose to share a work on social media (Facebook, LINE, X), the work’s URL is sent to those platforms, which may have servers abroad. This transfer takes place at your own direction.
Google Fonts used on the website may send your IP address to Google LLC (USA), which operates under the EU-US Data Privacy Framework and Google’s policies.
9 Contacting the data protection officer
Data Controller
Creative Photography Program, Faculty of Fine Arts, Chiang Mai University 239 Huay Kaew Road, Suthep Subdistrict, Mueang Chiang Mai District, Chiang Mai 50200, Thailand
If you wish to exercise any right under the PDPA, please send a written request with a copy of your ID card to the email above.
10 Changes to this policy
We may update this policy from time to time to comply with changes in law or operations. Significant changes will be announced on the website at least 30 days before taking effect. The last-updated date is shown at the top of this page.
