Privacy policy

GradKub is the information system a graduate programme office uses to administer students' academic records from admission through to graduation — coursework, the qualifying examination (QE/CE), each stage of the thesis examination, and graduation.

The system is used inside the programme office. Those who can sign in are programme staff, programme administrators, thesis advisors — who see only the students in their care — and students who have opened an account to view their own record. Both advisors and students have read-only access; all data is recorded and maintained by programme staff.

Opening a student account is optional and is not a condition of being recorded in the system: the programme office creates and maintains a student's record whether or not an account is ever opened. If you do want one, the procedure is this. The programme office issues a registration link, which carries an expiry date and names one programme within the link itself, and sends it to that programme's students. You enter your student ID, the e-mail address you want to sign in with, and a password of your choosing, and confirm that you have read this notice. The system matches the student ID you entered against the records that programme already holds, and creates the account in a pending state, which cannot yet be used to sign in. Programme staff then review the request and approve or refuse it. The account works only once it has been approved.

The system holds the data below, by type of data subject. Not every field is filled in for every person; many are recorded only when the corresponding event actually occurs.

Student data

• Identity Student ID, Thai and English name, intake year, programme, and a photograph if provided
• Contact E-mail address, and a LINE account only if you link it yourself using a code the system issues
• Academic status Stage of study, enrolment state, current term, term of admission, and term of graduation
• Examinations and results Qualifying examination (QE/CE) results, examination dates, mode, venue, committee membership, results, and notes recorded with a result
• Thesis Thai and English thesis titles, publication status, and the uploaded proposal document
• Documents and attachments The per-stage document checklist, English-proficiency evidence, documents attached to requests and leave records, and any other uploaded files
• Other academic information English-proficiency status and expiry, human-research ethics (IRB) status, scholarships and amounts, leave of absence with its stated reason, requests, and deadline extensions with their reasons
• Staff notes Free-text notes written about the student by staff or an advisor, with the author's name and the time written
• User account, for students who open one The sign-in e-mail address — which need not be the same as the contact address the office holds — an encrypted password, the approval status and date, language preference, and the version number of this privacy notice you accepted when you registered

Faculty and staff data

• Identity and affiliation Name, academic title, English name, faculty, department, home institution, and a photograph if provided
• Contact E-mail address, telephone number, and a LINE account only if linked voluntarily
• Academic information An uploaded CV, and publication information retrieved from the OpenAlex database such as ORCID, h-index, number of works, and work titles
• Role in the programme Service as advisor, co-advisor or examiner, responses to committee invitations, opinions recorded on an examination, and declared available dates
• User account The sign-in e-mail, an encrypted password, role and access rights, language preference, and a log of changes made in the system

• To administer student records and academic status throughout the programme
• To track regulatory deadlines such as time-to-degree, stage examinations, and extensions
• To arrange examinations, appoint and coordinate examining committees, and record results
• To contact and send reminders to students, advisors, and committee members
• To produce programme reports and statistics for administration and quality assurance
• To verify that a request to open an account belongs to the student whose record it names, by comparing the e-mail address entered on the request against the one the office holds
• To record which version of this privacy notice you accepted, and when
• To keep an audit record of changes for accountability and later verification

We do not sell your data and do not use it for marketing; the system contains no advertising or behavioural tracking. Providing the service does, however, require sending some data to the following external service providers.

• E-mail provider The recipient's address, the subject and body of the message — which may contain a name, student ID, thesis title, examination date and venue, and the committee list — together with any file the office attaches to that message
• LINE (LINE Corporation) The recipient's LINE user ID and the same message text as the e-mail. LINE carries no attachments, but the message names the files sent by e-mail
• AI service provider (Anthropic) Only when the examiner-search function is used — the thesis proposal file, the opening part of the document, is sent so that keywords can be extracted. Such a document normally carries the author's and advisor's names on its title page
• Academic database (OpenAlex) Only research keywords, in order to find subject experts. No student name, student ID, or document is sent
• File storage provider (Google Cloud) All uploaded files are stored with the provider in a private bucket, and can be downloaded only through the system, which checks permission first

The public examination calendar

A programme may publish an examination calendar that anyone can view without signing in. Where it is switched on, that page shows the name, thesis title, examination date and time, mode, venue, and a meeting link for online examinations. It never shows examination results, the student ID, or contact details. The system default is off, and it must be switched on deliberately, per programme and per examination stage.

We keep your data for [Retention period — e.g. throughout enrolment and for N years after graduation or withdrawal], or for the period required by law and by the institution's records-retention rules, whichever is longer.

A request to open an account that has not been approved gives you no access to the system, and if staff refuse the request, the account created for it is deleted in full; the student's academic record is unaffected.

One exception you should know about. After your data has been deleted, the system still keeps (a) the audit log of changes, permanently and for accountability, with your name and student ID removed from it; and (b) the record of the deletion request and its outcome, as evidence that the request was acted upon.

We maintain security measures appropriate to the risk, as follows.

• Access each person sees only what their role allows. Advisors see only the students in their care, and students see only their own record
• Signing in a password must be at least twelve characters and may not be one of the commonly guessed ones; passwords are stored encrypted, never as plain text; and repeated failed sign-in attempts are slowed down and recorded
• Data in transit connections to the system, and between the system and its database, are encrypted
• Uploaded files held in private storage and downloadable only through the system, which checks the requester's permission each time
• Accountability every change is recorded with who made it and when. That record can only be added to — it cannot be edited or deleted

Security testing

In September 2026 the system was reviewed for security in two ways: a review of its source code against the OWASP Top 10, and a vulnerability scan using the OWASP ZAP tool. Every finding was recorded and has been fixed, except for items recorded as accepted risks with the reasons stated.

No information system is completely secure. The review above was carried out at a point in time and is not a guarantee that the system is free of vulnerabilities. In the event of a personal data breach, we will report it as required by the Personal Data Protection Act B.E. 2562.

Under Thailand's Personal Data Protection Act B.E. 2562 you have the following rights.

• To access your personal data and obtain a copy of it
• To have inaccurate or out-of-date data corrected
• To have data erased when it is no longer necessary, or when you withdraw consent
• To restrict the use of your data, or to object to its processing
• To receive your data in a machine-readable form and have it transmitted to another controller
• To withdraw consent at any time, without affecting processing already lawfully carried out
• To lodge a complaint with the Personal Data Protection Committee if you believe the processing is unlawful

To exercise a right, contact the programme office at the address in the next section. Anyone who holds an account in the system can also submit a request to delete their own record directly from their account page. A programme administrator decides on the request, and permanent removal from the database is reserved to the system administrator.

• Data controller [Organisation / Faculty / University]
• Address [Address of the organisation]
• Contact [Contact e-mail] / [Telephone]
• Data Protection Officer [Name and e-mail of the Data Protection Officer, if one is appointed]

The system uses only the cookies needed to sign you in and to remember your preferences. Each cookie, its purpose, its lifetime, and how to withdraw consent are listed on the cookie policy page.