Privacy policy
Effective date: 29 October 2026.
The Association of Thai Professionals in European Region (ATPER), สมาคมนักวิชาชีพไทยในภูมิภาคยุโรป, is responsible for the personal information described here. Our registered address is 8 rue Greuze, 75116 Paris 16e, France. Contact contact@atper.eu about this notice or your information.
Information we use
When you contact us, we receive your name, email, message, and any optional phone number you provide. We use these details to handle your inquiry.
When you apply for membership or to help with ATPER activities, we receive your name, verified email, nationality, residence, professional or student status, education, and the relevant institution or occupation details you provide. We also record your application choices, the notice version acknowledged, application and review dates, staff decisions and relevant correspondence. These details help our officers assess your request and administer the association.
We also maintain historical member records supplied by ATPER from its former CRM. Those records retain their source and import history. An imported contact is not treated as having completed website email verification or given a new consent. An unknown active/inactive status remains unclassified until an officer reviews it.
Email verification codes and limited technical/security records help prevent misuse. A code expires after ten minutes. Codes, verification proofs and rate limits are handled separately from membership decisions.
Purposes and legal bases
Our legitimate interests under GDPR Article 6(1)(f) are to respond to requests, review applications, maintain an accurate association register, organize requested participation and protect the website. We limit access and collection to those purposes and consider their effect on the people concerned. You can object to processing based on legitimate interests.
Optional event invitations and community updates rely on your separate consent under Article 6(1)(a). The box is initially unchecked. You may withdraw that choice at contact@atper.eu without affecting the review of your application. Essential messages about your request, verification or membership administration are separate from optional updates.
Google Analytics is optional and runs only after analytics-cookie consent. Necessary website security and consent-preference functions do not require you to agree to analytics. A required acknowledgment of this notice is a record that the notice was presented; it does not create blanket consent for every use of data.
Where a specific legal obligation requires a record to be kept, we retain the required information under Article 6(1)(c), separately from routine association use.
Who can access information
Authorized ATPER officers review applications, maintain member status and export records when needed for their work. The technical maintainer has access needed to operate, secure and recover the service. Access is limited by staff role.
We use Hetzner for website hosting, Cloudflare for recovery storage and browser abuse checks, and Microsoft 365 for correspondence and website email. Google processes analytics information only when you permit analytics. These providers process information to supply their services under their applicable data-processing arrangements. Their services can involve processing in countries outside the EEA; applicable adequacy decisions or appropriate contractual safeguards, including EU standard contractual clauses where required, must cover such processing. Contact us for information about the applicable provider and transfer safeguards.
The website does not automatically synchronize applications to HubSpot or send membership records to MHESI in Thailand. Sponsor reports should use aggregate or anonymized information. Before any new disclosure of identifiable information to a sponsor or other organization, ATPER will document its purpose, recipients, lawful basis and any required international-transfer safeguards and inform the people concerned. This notice does not authorize an unrestricted sponsor transfer.
We do not sell personal information. We do not use the application workflow for automated membership decisions or profiling. Officers review requests.
Retention
We use the following operating periods, subject to a documented legal obligation or unresolved dispute that requires limited, restricted retention:
| Information | Period / review trigger |
|---|---|
| Pending applications | Review after six months without applicant contact; close unresolved requests after twelve months through officer review. |
| Declined, withdrawn or closed applications | Twelve months after closure, then remove identifying information no longer needed. |
| Member register and approved membership records | While membership continues, then three years after it ends. Review imported records with unknown status within six months of import. |
| Activity participation records | Twelve months after the activity or last relevant contact, unless another continuing purpose is documented. |
| Optional email updates | Until withdrawal, or three years without contact initiated by the individual. Keep only a justified minimal suppression record to respect an opt-out. |
| Contact inquiries | Twelve months after resolution. |
| Routine delivery metadata | Ninety days unless needed for an unresolved inquiry, incident or dispute. |
| Staff CSV working copies | Remove within seven days after the task is complete; any official retained copy follows the corresponding record's retention rule. |
| Security records under ATPER's control | Normally up to ninety days; restrict and document any incident-specific extension. |
These periods require supervised review; they do not claim that the website automatically erases every record. Requests to exercise data rights can be made at any time. Verification and rate-limit records also have short technical expiry/cleanup rules. Live membership mail bodies are not stored in the membership plugin's delivery log.
Restricted recovery copies follow their configured backup retention. If data must be erased, remaining backup copies stay restricted until they expire; the erasure must be reapplied before a restored copy returns to normal service.
Cookies, analytics and embedded services
Use Cookies in the footer to change or withdraw analytics consent. Analytics cookies named _ga and ga* last for up to one year. Advertising features and automatic enhanced measurement are disabled. Analytics receives usage and technical information, approximate location and aggregate completion events; our setup does not send contact or application contents, URL query strings or URL fragments to Google.
Cloudflare Turnstile checks the browser when a public form requires an abuse check. Older articles may embed external content, such as calendars or videos. If you load third-party content, its provider may receive technical information and apply its own privacy/cookie practices.
Your rights
You can ask to access or correct your information, request erasure or restriction, object where processing relies on legitimate interests, and request portability where applicable. You can withdraw optional consent at any time. These rights do not depend on having a website account.
Write to contact@atper.eu. We may request proportionate information to confirm your identity. We normally respond within one month. If a lawful extension is needed because a request is complex or there are multiple requests, we will explain it within the initial month.
You can complain to the French supervisory authority, the CNIL, or another competent data-protection authority. See CNIL: exercise your rights. Member self-service login is currently unavailable; contact ATPER for help.
Security and breach handling
We restrict staff access and use technical and organizational measures to protect information. We investigate and document suspected personal-data breaches. Where notification to the supervisory authority is required, we notify it without undue delay and, where feasible, within 72 hours of becoming aware. If a breach is likely to create a high risk for individuals, we inform affected people without undue delay unless a relevant legal exception applies. The 72-hour rule is not a blanket promise to notify every individual within that period.
Changes and contact
We update this notice when our processing changes and record the effective date. A new notice does not rewrite the choices or acknowledgments saved in earlier applications. Contact contact@atper.eu or write to ATPER at the address above.