Child Data & Safeguarding Privacy Notice

Purpose of this notice

Child protection records can include highly sensitive information about children, families, staff, witnesses, incidents, allegations, welfare concerns, CCTV-related requests, images, statements, and investigation materials. This notice is designed to explain the platform's safeguarding-focused privacy position.

Who controls the data

The school, tenant organization, or child-focused organization using the platform normally decides what safeguarding information is collected, who may access it, how long it is kept, and when it should be shared with relevant authorities. Child Protect Platform provides the controlled system used to process and protect that information under the customer's instructions and agreement.

Types of child-related data

• Safeguarding concern reports and incident descriptions.
• Names or identifiers of children, parents/guardians, witnesses, staff, and other relevant people.
• Case notes, review decisions, escalation records, and status changes.
• Evidence files such as documents, images, screenshots, CCTV-related materials, correspondence, or supporting records.
• Audit logs showing who accessed or acted on a record.

Safeguarding privacy principles

• Need-to-know access: child-related information should only be available to authorized users with a legitimate safeguarding role.
• Tenant and school scoping: users should not see unrelated organizations or schools unless their role and scope authorize it.
• Evidence preservation: evidence should remain linked to the correct report, school, tenant, timeline, and user context.
• Auditability: important access, administrative, case, and evidence events should be reviewable.
• Minimum necessary use: records should be used for safeguarding, investigation, accountability, compliance, and related operational purposes.

Sharing with schools, authorities, and safeguarding bodies

Child-related data may need to be shared with authorized school leaders, safeguarding staff, regulators, child protection officials, law enforcement, healthcare or welfare professionals, courts, or other bodies where lawful and necessary. The platform supports secure handling and auditability, but it does not replace the organization's professional judgment or statutory reporting duties.

Consent and children under Thai PDPA

Where processing relies on consent, child and guardian consent requirements must be assessed under Thailand PDPA and applicable Thai law. For safeguarding and child protection work, schools may also rely on legal obligations, vital interests, public interest, or other lawful bases where appropriate. The school or tenant organization should define the applicable basis in its own safeguarding and privacy notices.

Evidence preservation and deletion

Safeguarding evidence should not be casually deleted, overwritten, renamed, separated from context, or moved into informal channels. Where deletion, anonymization, restriction, or retention requests are received, the organization must balance individual rights with child protection, legal, audit, evidence preservation, and investigation needs.

Questions

Questions about a specific child safeguarding record should be directed to the relevant school or tenant safeguarding lead. General platform privacy questions may be sent to privacy@childprotect.co.