GDPR Compliance

Introduction

Kampong Thom Learning Hub is committed to protecting and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws. This document outlines your rights under GDPR and explains how we process and protect your personal data.

While GDPR primarily applies to organizations operating within the European Union or processing data of EU citizens, we extend these privacy protections to all our students and website visitors as a matter of best practice and commitment to data protection.

1. Your Rights Under GDPR

Under GDPR, you have the following fundamental rights regarding your personal data:

• Right to be Informed: You have the right to know what personal data we collect, why we collect it, and how we use it
• Right of Access: You can request access to your personal data and receive a copy of the information we hold about you
• Right to Rectification: You can request correction of inaccurate or incomplete personal data
• Right to Erasure: You can request deletion of your personal data under certain circumstances
• Right to Restrict Processing: You can request that we limit how we use your personal data
• Right to Data Portability: You can request your data in a portable format for transfer to another service
• Right to Object: You can object to certain types of processing, including direct marketing
• Rights Related to Automated Decision Making: You have rights regarding automated processing and profiling

2. Right to Access

You have the right to request confirmation of whether we are processing your personal data and, if so, to access that data along with specific information about the processing.

What You Can Request:

• The categories of personal data being processed
• The purposes of the processing
• The recipients or categories of recipients to whom data has been or will be disclosed
• The retention period or criteria for determining the retention period
• Information about your other rights (rectification, erasure, restriction, objection)
• The source of the data if not collected directly from you

How to Exercise This Right:

To request access to your personal data, please contact us at [email protected] or call +855 62 961 234. We will provide the requested information within 30 days of receiving your request, free of charge for the first request.

3. Right to Rectification

You have the right to have inaccurate personal data corrected and incomplete personal data completed. This ensures that the information we hold about you is accurate and up to date.

When This Applies:

• When personal data is inaccurate or outdated
• When personal data is incomplete or misleading
• When you have updated contact information, educational background, or other details

How to Exercise This Right:

To request rectification of your personal data, contact us with details of the information that needs to be corrected or completed. We will respond to your request within 30 days and notify any third parties to whom the data was disclosed.

4. Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data under certain circumstances. This is also known as the "right to be forgotten."

When This Right Applies:

• The personal data is no longer necessary for the purposes for which it was collected
• You withdraw consent on which processing is based and there is no other legal ground for processing
• You object to processing and there are no overriding legitimate grounds
• The personal data has been unlawfully processed
• The personal data must be erased to comply with a legal obligation

Limitations:

We may not be able to delete your data if we need to retain it for:

• Compliance with legal obligations
• Establishment, exercise, or defense of legal claims
• Contractual obligations (e.g., course completion records)
• Legitimate business purposes (e.g., financial records)

5. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another organization.

What Data Can Be Ported:

This right applies to personal data that:

• You provided to us
• Is being processed based on your consent or for contract performance
• Is being processed by automated means

How to Exercise This Right:

To request data portability, contact us at [email protected]. We will provide your data in CSV, JSON, or another commonly used format within 30 days.

6. Right to Object

You have the right to object to certain types of processing of your personal data, including processing for direct marketing purposes.

Direct Marketing:

You can object to receiving marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us at [email protected]
• Calling us at +855 62 961 234

Once you object to direct marketing, we will stop processing your data for such purposes.

Other Processing:

You can also object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

7. Data Processing Legal Basis

We process your personal data only when we have a legal basis to do so. The legal bases we rely on include:

• Consent: You have given clear consent for us to process your personal data for specific purposes (e.g., marketing communications)
• Contract: Processing is necessary for a contract we have with you or to take steps at your request before entering into a contract (e.g., course enrollment)
• Legal Obligation: Processing is necessary to comply with legal or regulatory requirements
• Legitimate Interests: Processing is necessary for our legitimate interests or those of a third party, except where such interests are overridden by your rights and freedoms

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements.

Retention Periods:

• Student Records: Retained for 7 years after course completion for certification verification and regulatory compliance
• Financial Records: Retained for 10 years in accordance with accounting regulations
• Marketing Data: Retained until you withdraw consent or for 2 years of inactivity
• Website Analytics: Retained for 26 months
• Correspondence: Retained for 3 years from last contact

After the retention period expires, personal data will be securely deleted or anonymized.

9. How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us using the following methods:

Response Timeline:

We will respond to your request within 30 days. In complex cases, we may extend this period by an additional 60 days and will notify you of the extension and reasons for the delay.

Verification:

To protect your privacy and security, we may need to verify your identity before processing your request. We may request additional information to confirm your identity.

10. Contact Our Data Protection Officer

If you have questions or concerns about how we handle your personal data or wish to exercise your GDPR rights, you can contact our Data Protection Officer:

Right to Lodge a Complaint:

You have the right to lodge a complaint with a supervisory authority if you believe we have not handled your personal data properly or have violated your rights under GDPR.