Key Definitions
This section clarifies terms used in the policy so you can easily understand what data we refer to and how processing is described throughout.
Personal data means any information that identifies or can be used to identify an individual, such as name, email address, phone number, and learning records associated with a user account.
Processing refers to any operation performed on personal data, including collection, storage, organization, analysis, transmission, or deletion done to deliver our services.
User refers to any individual who registers for or interacts with realestai course content, support, or related communications.
Service refers to the suite of online IT security and literacy training products, including courses, labs, assessments, support, and community features provided by realestai.
Cookies are small data files stored on your device that help us recognize you, provide core functionality, analyze usage, and improve course delivery and user experience.
Data We Collect
We collect only the data necessary to deliver training, support course progress, process payments, and improve our offerings. Below are examples of the data provided directly by users and data collected automatically.
Data You Provide
When you register, enroll, or contact support, you provide information that enables access to courses, communication, and billing. Examples include:
- Identity details: full name and email address provided at registration
- Contact details: phone number (+66925898669) and mailing address if provided for invoicing
- Account and login information: chosen username and password (stored securely)
- Payment and billing information needed for paid plans (processed by third-party payment processors)
- Course activity and progress: quiz results, lab submissions, and completion records
- Support communications and feedback you submit via email or support forms
Data Collected Automatically
We automatically collect technical data to maintain and improve the service, ensure security, and analyze usage patterns. This data does not typically identify you personally on its own.
- Device and browser information used to deliver the platform effectively
- IP address and approximate location for fraud prevention and content localization
- Usage data such as pages visited, course modules accessed, and time spent on lessons
- Performance logs and error reports to diagnose issues and improve reliability
- Cookie identifiers used to remember preferences and session status
- When you use realestai's IT security and literacy courses we automatically collect technical and behavioral data to deliver and secure the learning experience. This includes device and browser information (user agent, screen size, operating system), IP address and basic city-level geolocation, unique device and cookie identifiers, page and video interaction events, course progress markers, quiz attempts and timestamps, authentication and session logs, error and crash reports, and limited network/security telemetry used to detect anomalous activity. This data helps optimize content delivery, personalize recommended learning paths, monitor platform health, and identify potential security incidents. Collection is limited to what is necessary for these operational and safety purposes, and retention is aligned with the purpose of supporting your course access and platform integrity.
Data From Third Parties
We may receive certain data about you from trusted third parties when necessary to provide services or comply with legal obligations.
- Payment processors that handle transactions and provide billing confirmations
- Identity verification or fraud prevention services where required for account security
- Analytics providers that supply aggregated usage statistics to help us optimize courses
Purposes of Processing
We use collected data only for specific, lawful purposes that support service delivery, security, and user experience improvements.
- To register you and provide access to your chosen courses and learning materials
- To process payments and billing for paid plans and promotions
- To deliver course content, assessments, certificates, and progress reports
- To respond to support requests and provide customer service
- To detect and prevent fraud, abuse, and security incidents
- To analyze usage and improve course quality and platform performance
- To communicate updates, promotions, and administrative notices relevant to your account
- To comply with legal obligations and law enforcement requests when required
Legal Basis for Processing
We rely on appropriate legal grounds to process personal data, including contractual necessity and legitimate interests where those interests do not override your rights.
- Contractual necessity: processing required to provide courses you sign up for
- Consent: where you have voluntarily agreed to optional communications or marketing
- Legitimate interests: for platform security, fraud prevention, and service improvements
- Legal compliance: when we must comply with legal obligations or protect rights
User Rights
Depending on your jurisdiction and applicable law, you may have rights regarding your personal data. We aim to make it straightforward to exercise those rights.
- Access: request a copy of personal data we hold about you
- Correction: ask us to correct inaccurate or incomplete data
- Deletion: request deletion of data when retention is no longer necessary and no legal reason to keep it exists
- Restriction or objection: request limited processing or object to certain processing activities
- Data portability: where applicable, request a machine-readable copy of data you provided
- To exercise any of these rights, contact us using the details in the Contact Information section. We review requests and respond within applicable legal timeframes.
Cookies and Similar Technologies
We use cookies to enable essential site functions, remember preferences, and analyze usage to improve course delivery. You can manage cookie preferences through your browser and our cookie settings.
Types include essential cookies for login and session management, preference cookies to store language and display settings, and analytics cookies to understand user behavior and improve content.
Essential: required for core functionality. Functional: remember user choices. Analytics: performance and usage tracking. Advertising: third-party tools used only with consent.
To manage cookies, use browser settings to block or delete cookies, or adjust cookie preferences on the site. Disabling non-essential cookies may limit some features.
Full Cookie Policy
Data Sharing
We share data only with trusted partners as needed to provide the service, comply with legal obligations, or when you direct us to share information.
- Service providers: payment processors, hosting providers, and platform analytics
- Support partners: third-party tools used to handle customer service and technical support
- Legal and regulatory bodies: when required to comply with law or respond to lawful requests
- Business transfers: in the event of a merger, acquisition, or sale of assets, data may be transferred according to applicable law
- Aggregated and anonymized data: shared for research or improvement but not personally identifiable
- realestai shares automatically collected data only with third parties who need it to support course delivery, platform security, or compliance. Typical recipients include cloud hosting and content delivery providers, payment processors for enrollment billing, analytics partners to assess engagement trends, certification or accreditation bodies to validate completions, instructors or corporate account administrators for course management, and specialized security vendors for threat detection and incident response. We may also disclose data when required by law or to protect the security of our systems. All partners are contractually required to process data only for specified purposes and to implement appropriate technical and organizational safeguards. For enterprise clients we can provide aggregated or pseudonymized performance reports to authorized representatives. Contact and governance: realestai, 59/17 Thanon Tiwanon, Amphoe Pak Kret District, Nonthaburi Province 11120, Thailand; +66925898669; Business ID 8832246446935. Effective 25-06-2026. See realestai.club/privacy for full details.
International Transfers
realestai may transfer data to service providers located outside Thailand. When transfers occur, we take reasonable measures to ensure an appropriate level of protection, such as standard contractual clauses or equivalent safeguards required by law. If you have concerns about cross-border processing, contact our data protection representative.
When personal data is transferred across borders to support course delivery, certification processing, or cloud services, realestai applies contract-based safeguards and selects processors with appropriate security credentials. Transfers from Thailand to partner servers in permitted jurisdictions are limited to what is necessary to deliver IT security training, assessments, and support. Standard contractual clauses, data minimization, and encryption in transit are applied to protect information during cross-border transfers.
Data Retention
realestai retains personal data only for as long as needed to provide educational services, manage accounts, comply with legal obligations, and improve learning experiences. Retention periods are set to balance operational needs with the rights of learners and data minimization principles.
Account information such as name, email, enrollment history, and certification records is retained for the duration of the learner relationship and for up to seven years afterward when required for compliance, reporting, or dispute resolution related to professional training and certification activities.
Messages and support interactions are stored for up to three years to maintain service continuity, verify training outcomes, and improve user support quality. Aggregate analytics derived from messages may be retained longer in anonymized form to inform course design and security awareness development.
System logs, access records, and security event data are retained according to operational and security needs. Typically, detailed logs are kept for 12 months for incident analysis and forensic purposes, while aggregated monitoring records may be archived for up to 36 months.
Upon request or account closure, personal data will be deleted or anonymized where retention is no longer necessary, except where retention is required for legal compliance or to preserve the integrity of certifications issued through realestai. Deletion requests are processed in accordance with applicable law and our rights handling procedures.
Security of Personal Data
Protecting learner data is central to delivering trustworthy IT security training. realestai operates technical and organizational security measures tailored to educational platforms, including encrypted storage, access controls, and regular security reviews. These controls are designed to reduce the risk of unauthorized access while allowing reliable course delivery and certification management.
- Encryption of data in transit and at rest using industry-standard protocols to protect sensitive information such as personal details and assessment results.
- Role-based access controls, multi-factor authentication for administrative accounts, and periodic access reviews to limit exposure of learner data.
- Regular vulnerability scanning, patch management, and annual security awareness training for staff involved in platform operations and support.
Your Rights
As a learner or visitor to realestai, you have rights related to your personal data. We outline how to exercise these rights and how we respond to requests to access, correct, or manage your information.
- Right to access: request a copy of the personal data we hold about you and details of its use.
- Right to rectification: request corrections to inaccurate or incomplete personal information in your account.
- Right to erasure: request deletion of personal data where retention is no longer necessary and legal grounds do not require otherwise.
- Right to restriction: ask us to limit how we process your personal data in specific circumstances, for example during dispute resolution.
- Right to data portability: request a machine-readable copy of personal data you provided to realestai for transfer to another provider when technically feasible.
- Right to object: object to certain processing activities such as marketing-related communications where applicable.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting processing already carried out.
- Right to lodge a complaint: file a complaint with a competent authority if you believe your rights have not been respected in line with applicable law.
How to Make a Rights Request
Submit requests regarding your rights by contacting our privacy team with a clear description of the request and verification information. Include your full name, email associated with the account, and the specific right you wish to exercise. We may request additional information to verify your identity before processing sensitive requests.
[email protected]
We aim to acknowledge rights requests within 7 business days and to provide a substantive response within 30 calendar days where reasonably possible. Complex or multiple requests may require additional time; we will notify you if an extension is needed.
Marketing Communications
realestai may send promotional emails about new IT security courses, time-limited offers, or updates relevant to enrolled learners. Marketing content is based on your communication preferences and engagement with our training services. Email content is designed to help you advance practical security skills and career readiness.
You can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing message or by updating preferences in your account settings. Transactional communications about course access, billing, and certification will still be sent as needed.
Children and Minors
Our training programs are intended for adult learners and professionals. realestai does not knowingly collect personal data from children under the age of 16 without verifiable parental consent. If you believe we have collected such information, contact us to request deletion or correction.
Third-Party Links
Our site and course materials may include links or integrations with third-party services for payment processing, video hosting, and certification verification. These third parties have their own privacy policies and practices. realestai is not responsible for the privacy practices of external sites; review their policies before providing personal data.
Changes to This Privacy Policy
We may update this privacy policy to reflect changes in our services, legal requirements, or best practices. Significant changes that affect your rights or the way we process personal data will be communicated via email or a prominent notice on the site. Continued use of our services after changes indicates acceptance of the updated policy.