Privacy Notice
How the BAT Omics Catalog collects, uses and protects your personal data under the Personal Data Protection Act, B.E. 2562 (PDPA).
Version 2026-06-21 · Bioinformatics Academic Association of Thailand (BAT), data controller.
1. Who we are
The BAT Omics Catalog (data.bat.or.th) is operated by the Bioinformatics Academic Association of Thailand, which acts as the data controller for the personal data described in this notice. For any privacy enquiry or to exercise your rights, contact our Data Protection Officer using the details in section 6.
2. What we process and why
We process personal data only for the purposes below, each with a documented lawful basis under the PDPA.
| Purpose | Data categories | Lawful basis | Retention |
|---|---|---|---|
| Create and manage your platform account and authenticate sign-in | Name, Institutional email, ORCID, OAuth provider, Last login | Contracts.24(3) | For the life of the account; deleted within 90 days of account closure. |
| Display your organisational affiliation and attribute datasets | University, Faculty, Department, Province | Legitimate Interests.24(5) | With the associated account or dataset record. |
| Register, publish and coordinate access to research datasetsmay include special-category data | Dataset metadata, Contact person, Contact email, Survey/CRF documents | Public Task / Scientific Researchs.24(1), s.26(5) | Retained as part of the scientific catalogue; reviewed on request. |
| Handle data-access requests between researchers | Requester email, Request message, Request status | Consents.19, s.24 | Retained while the request is active and for a defined audit period after closure. |
| Maintain security and audit logs for accountability | User ID, Action type, Target, Timestamp | Legal Obligations.37(1) | Defined retention period (e.g. 12–24 months) then deleted. |
| Send transactional notifications (registration, access requests) | Recipient email, Message content | Legitimate Interests.24(5) | Per the email provider's processing terms. |
| Measure platform traffic and usage | Aggregate visit counts, Unique-user-per-day (by user ID) | Legitimate Interests.24(5) | Aggregated; no IP addresses are stored. |
3. Special-category data
Survey, case-record-form and omics content uploaded to the catalogue may contain health or genetic information about research subjects, which is special-category personal data under PDPA section 26. Where this is the case, the submitting researcher must confirm they hold the explicit consent and ethical approval required, and access to such files is restricted to authenticated users via a controlled, time-limited link.
4. How we protect it
Access requires authentication through your institution's identity provider. Uploaded documents are stored privately and served only through short-lived, authenticated links. Access is governed by role and record-ownership checks, traffic is carried over HTTPS behind a web application firewall, and security-relevant actions are recorded in an audit log.
5. Your rights
Subject to the conditions in the PDPA, you have the following rights:
- Right to be informed about how your data is processed (s.23)
- Right of access to your personal data (s.30)
- Right to rectification of inaccurate data (s.35–36)
- Right to erasure / to be forgotten (s.33)
- Right to restrict processing (s.34)
- Right to data portability (s.31)
- Right to object to processing (s.32)
- Right to withdraw consent at any time (s.19)
To exercise any of these rights, contact our DPO. We will respond within the timeframe required by the PDPA.
6. Cross-border transfer & contact
Some processing relies on cloud providers (Microsoft Azure, Google Workspace and Cloudflare) that may process data outside Thailand under appropriate safeguards. If you have questions, a complaint, or wish to exercise your rights, contact:
Data Protection Officer, Bioinformatics Academic Association of Thailand (BAT)
dpo@bat.or.thYou also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.