Privacy Policy

Last updated: 19 July 2026

SchoolFlow respects your privacy and takes the protection of personal data seriously. This Privacy Policy explains how we collect, use, store, and protect personal data, and how we comply with Thailand's Personal Data Protection Act B.E. 2562 (2019), known as the PDPA.

This policy applies to our website at schoolflowfees.com, to people who contact us or request a demo, and to the personal data we handle when we provide our fee recovery service to schools. Please read it carefully. If you do not agree with it, please do not use our website or our service.

1. Who we are

SchoolFlow is a managed fee recovery service for schools in Thailand. The service is currently operated by Neville Richard Pollard as an independent operator based in Mueang, Surat Thani, Thailand. We are in the early stage of building the business and are working toward formal company registration. Once that is complete, we will update this policy with our registered company details.

For any question about this policy or your personal data, you can contact us at privacy@schoolflowfees.com.

2. Our two roles under the PDPA

The PDPA distinguishes between a data controller, who decides why and how personal data is processed, and a data processor, who processes data on behalf of a controller. SchoolFlow acts in both roles depending on the situation.

As a data controller. When you visit our website, contact us, or request a demo, we decide how your information is used. For that information, we are the data controller.

As a data processor. When a school becomes our client, the school remains the data controller of its students' and parents' data. We process that data only on the school's instructions, to deliver the fee recovery service. For that information, we are the data processor, and a separate Data Processing Agreement signed with each school governs how we handle it.

3. The personal data we collect

From website visitors and prospective clients:

• Your name and your role at your school
• Your school's name and approximate size
• Your contact details, such as your email address, phone number, or LINE ID
• Any information you choose to include in a message to us

When we deliver the service to a school client, on the school's behalf:

• Student names and class or grade
• Parent or guardian names and contact details, including LINE contact
• Fee amounts owed, due dates, and payment status
• Records of messages sent and payments received

We do not collect more data than we need to provide the service, and we do not use student or parent data for any purpose other than delivering the service to the school.

4. How we use personal data

For website visitors and prospective clients, we use your information to respond to your enquiry, arrange and conduct a demo, provide information about our service, and, with your consent, to follow up with you.

For school client data, we use it only to send fee reminders through LINE, to include payment links, to track payment status, to produce reports for the school, and to support and improve the service we provide to that school. We act on the school's instructions and within the terms of our agreement with them.

5. Legal basis for processing

Under the PDPA, we rely on the following legal bases:

• Consent, for example when you submit a contact form or agree to receive follow-up communication.
• Contractual necessity, when we process data to deliver the service a school has engaged us to provide.
• Legitimate interest, for example to operate, secure, and improve our website and service, where this does not override your rights.

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing carried out before the withdrawal.

6. How we share personal data

We do not sell personal data. We share it only as needed to deliver the service, and only with providers who are bound to protect it:

• LINE, to deliver messages to parents through a LINE Official Account.
• A licensed Thai payment provider that supports PromptPay, to enable one-tap payments. Payment is processed by the provider. We do not store full payment card details.
• Our cloud hosting, website, and software providers, who store and process data on our behalf under data processing terms.

We may also disclose personal data where required by law, court order, or a lawful request from a competent authority.

7. Where your data is stored

We store personal data on secure servers located in Singapore or Thailand. We take reasonable steps to keep data within the region and to ensure that any provider we use offers an adequate level of protection consistent with the PDPA. Where any transfer of data outside Thailand is necessary to run the service, we handle it under the cross-border rules in the PDPA and disclose it to the school in writing.

8. How we protect personal data

We use appropriate technical and organizational measures to protect personal data against loss, unauthorized access, alteration, or disclosure. These include access controls, encryption in transit, restricted access on a need-to-know basis, isolated environments so that no school's data is mixed with another's, and signed data processing terms with our providers. No system is perfectly secure, but we work to protect your data to a standard appropriate to its sensitivity.

9. How long we keep personal data

We keep personal data only as long as we need it. For prospective clients, we keep your contact information for as long as we are in discussion and for a reasonable period afterwards, unless you ask us to delete it. For school client data, we keep it for the duration of our agreement with the school and delete or return it after the agreement ends, in line with the Data Processing Agreement and any legal retention requirements.

10. Your rights under the PDPA

Subject to the conditions in the law, you have the right to:

• Access your personal data and request a copy of it
• Ask us to correct data that is inaccurate or incomplete
• Ask us to delete or destroy your data
• Object to or restrict certain processing
• Withdraw consent you have previously given
• Request that your data be transferred to you or another controller, where applicable
• Lodge a complaint with the Personal Data Protection Committee (PDPC) if you believe your rights have been breached

To exercise any of these rights, contact us at privacy@schoolflowfees.com. We will respond within the time required by law. If you are a parent or student whose data we process on behalf of a school, please contact your school first, as the school is the data controller, and we will support the school in handling your request.

11. Children's and students' data

We understand that much of the data we process relates to children. We treat it with particular care. Schools are responsible, as the data controller, for obtaining any consent required from parents or guardians. We process student data only on the school's instruction and only to deliver the service. We never use it for marketing or for any unrelated purpose.

12. Cookies and website analytics

Our website uses a small number of cookies and similar technologies to help the site work properly, remember your language choice, and understand in a general way how visitors use the site so we can improve it. These do not identify you personally. You can control or block cookies through your browser settings, though some parts of the site may not work as well if you do. We do not use cookies to build advertising profiles or to sell your information.

13. Changes to this policy

We may update this policy from time to time. When we do, we will change the date at the top. If the changes are significant, we will take reasonable steps to let affected people know. Please check this page from time to time.

14. Contact us and our data protection contact

For any question about this policy, your data, or to exercise your rights, contact:

Neville Richard Pollard
SchoolFlow
General enquiries: hello@schoolflowfees.com
Data protection and privacy: privacy@schoolflowfees.com
Mueang, Surat Thani, Thailand

Until we appoint a formal Data Protection Officer, Neville Richard Pollard handles all data protection questions and requests directly.