Privacy Policy

Data controller and scope

The person or legal entity that operates this deployment of KU Spark is the controller of your personal data. This Policy refers to that person or entity as the “Operator.” The identifying and contact information currently available for the Operator appears under Service information below.

KU Spark is a student community service. It is not an official service of Kasetsart University unless expressly identified as such. You may contact the Operator through Feedback and Request. If a data protection officer has been appointed, the available contact information for that officer also appears below.

Data we collect

• Account and eligibility data: your name, KU email address, password information processed by the authentication system, verification status, account role, active sessions, eligibility information, and account-related dates and times.
• Profile and discovery: your display name, date of birth or age, gender, faculty, study year, campus, graduation status, bio, interests, relationship goal, discovery filters, profile visibility, likes, passes, matches, blocks, and other profile activity.
• Content you and others provide: profile photos, messages, media in messages, links or references to GIFs, reports, safety evidence, feedback posts, comments, votes, and conversations with support.
• Technical and security data: your IP address, browser or device information, request time and method, domain, page path, protocol, a session identifier derived without directly using your name, sign-in events, upload details, and administrator activity records. Application security traffic logs do not include message content or URL query strings.
• Cookie-free usage analytics: page-view time, page URL or route pattern, referring page, filtered query parameters, approximate country, region, or city, browser, operating system, device type, analytics script version, and an anonymous visitor hash that resets after 24 hours. This information is used in aggregated form and is not linked to an account by the analytics tool.
• Your choices and legal records: the version of each legal document you accepted or acknowledged, cookie choices, privacy requests, instructions to preserve data for legal reasons, and valid requests from authorities.
• Information from other people: reports about you, messages sent to you, activity involving you, and content that another user shares with the service.

Purposes and legal grounds

The legal ground required for processing depends on the applicable law, the purpose of the processing, and the circumstances. Where a legal ground is required, the Operator relies only on a ground available under applicable law.

• Performance of a contract: to create and verify your account and provide profile, discovery, matching, messaging, upload, settings, and support functions that you request.
• Legitimate interests: to prevent fraud and misuse, protect users, review reports, maintain security and reliability, produce aggregated usage statistics, retain necessary audit evidence, and establish, exercise, or defend legal claims. The Operator must balance those interests against your rights where applicable law requires that assessment.
• Compliance with legal obligations: to retain records required by law, respond to valid legal demands, handle privacy-rights requests, and comply with security and accountability duties.
• Consent: to store or read optional cookies and to carry out other processing for which the Operator has requested and obtained valid consent. Consent is separate from acceptance of the Terms. You may withdraw consent at any time. Withdrawal does not affect processing lawfully completed before withdrawal.
• Vital interests: to act where reasonably necessary to protect a person from a serious threat to life, body, or health.

Required and optional data

KU Spark requires a valid @ku.th email address, authentication details, the profile and eligibility fields marked as required, and technical data needed to verify and protect requests. The Operator cannot create or operate your account without this information. Fields marked optional and optional cookies are not required. Refusing optional cookies does not prevent access to the core service.

Sensitive personal data

Profile fields, discovery preferences, written content, photographs, and reports may reveal sensitive personal data. Depending on applicable law, this may include information concerning sexual behaviour or orientation, health, disability, religion, ethnicity, political opinions, or biometric characteristics. KU Spark does not use profile photographs for facial recognition.

Acceptance of this Policy does not by itself constitute separate consent to process sensitive personal data where such consent is required by law. Before relying on consent for that processing, the Operator must obtain consent that satisfies the applicable legal requirements. The Operator may otherwise process sensitive personal data only where another condition under applicable law permits it. You must not submit another person’s sensitive personal data without their permission or another lawful basis.

Who we share data with

• Other users can see the profile and content you choose to show them, based on your settings and whether you have matched.
• Service providers may process data only as necessary to perform services for the Operator. Those services may include authentication, data hosting, private media storage, service email delivery, security, aggregated usage analytics, and optional media search.
• Authorized moderators and administrators may access only the data needed for support, safety, security, legal, and service-management purposes. Sensitive administrative actions are recorded for review.
• Courts, regulators, police, or other authorities receive data only when their request has a valid legal basis or when the law otherwise requires or allows disclosure.
• If KU Spark is merged, reorganized, or transferred to a new Operator, the new Operator may receive the data needed to continue the service. This will be handled as required by law and with appropriate notice.

When data moves between countries

Personal data may be processed in a country other than the country in which you live. Where applicable law restricts an international transfer, the Operator must use a permitted transfer mechanism and any safeguards required by that law. You may contact the Operator for available information about current transfers.

How long we keep data and when we delete it

• The retention registry includes a rule to schedule incomplete uploads and uploads that are not attached to any record for deletion after 1 day. That rule applies only after it has been reviewed and activated.
• When media is replaced, deleted, or removed, KU Spark places the media and related records in a deletion queue. The deletion process verifies whether removal from storage has completed.
• Technical, security, and traffic records are kept only as long as needed to run and protect the service or follow the law. They may be kept longer if required by applicable law, a valid legal order, or a recorded instruction to preserve data for a legal matter.
• Expired sessions and one-time verification codes are removed when no longer needed. User content remains subject to the retention rules that apply to accounts, conversations, reports, feedback, and safety records.
• Some records may be kept after you delete your account. These include reports, moderation decisions, administrator activity records, evidence of privacy requests or legal acceptance, and material needed for legal claims. When KU Spark no longer needs to know who you are, identifying details should be reduced or removed.
• Retention periods are maintained in the retention registry. A retention rule is enforced only after legal and operational review and explicit activation.

Your privacy rights

The rights available to you depend on applicable law, and statutory exceptions may apply. You may submit a request through Settings → Privacy or Feedback and Request. KU Spark records the request and verifies identity where necessary. The Operator will respond within the period required by applicable law. If the Operator lawfully limits or refuses a request, the response will state the reason and any available complaint process.

• Request access to, or a copy of, your personal data and information about its processing.
• Request correction of inaccurate data or completion of incomplete data.
• Request deletion or anonymization, restriction of processing, or data portability where applicable law provides the relevant right.
• Object to processing where applicable law provides a right to object.
• Withdraw consent at any time. Withdrawal does not affect processing lawfully completed before withdrawal.
• Submit a complaint to a competent privacy or data-protection authority.

How we protect data and respond to a breach

KU Spark uses technical and organizational measures designed to protect personal data. These measures include access controls, monitoring, retention controls, and deletion verification. No system can eliminate all risk. The Operator will assess a suspected personal-data breach and will notify the competent authorities and affected persons when and within the period required by applicable law.

Changes and contact

A material change to this Policy will be issued under a new version and effective date. Where a change requires new consent, the Operator must obtain that consent before relying on it for the new processing. You may submit questions or privacy-rights requests through Feedback and Request or through the privacy contact shown under Service information.