How we treat
your data.

This Privacy Policy explains how the Researcher Folio platform — operated by the Research Office of Chiang Mai University — collects, uses, and protects information when you browse the public directory, contact our team, or update a researcher profile.

We treat the directory as a public scholarly resource. The information published about each researcher is professional in nature and is shared with the explicit cooperation of the contributing faculty and clusters.

We separate the data we hold into two categories — content that is publicly indexed for the directory, and operational data we collect when you interact with our forms or back-office systems.

• Public profile data: name, position, affiliation, ORCID, Scopus ID, Scholar URL, research keywords, group affiliations, and selected publications.
• Contact submissions: when you use the Contact form, we collect your name, email, organization, the topic you selected, and the message body.
• Operational telemetry: anonymized request logs, browser type, and aggregate page metrics used solely to keep the platform reliable.
• Cookies: a single session cookie is used to keep authenticated sessions alive — no third-party advertising trackers are deployed.

We use the data we collect for narrowly scoped purposes that are visible to you at the point of collection.

• Operating the public directory and surfacing accurate researcher profiles.
• Routing contact form messages to the appropriate cluster lead or research office team.
• Diagnosing and improving the reliability of the platform through aggregated metrics.
• Honouring profile update or removal requests from researchers and authorised affiliates.

We do not sell, rent, or trade personal data. We share information only with infrastructure providers strictly necessary to operate the platform (hosting, email delivery), and only under contractual data-protection commitments.

Where Thai law or a binding court order requires disclosure, we will provide the minimum data necessary and notify the affected researcher unless prohibited from doing so.

Public profile data is retained for as long as the researcher is affiliated with CMU, or until the researcher requests removal. Contact submissions are retained for up to 24 months, after which they are anonymized for trend analysis or deleted.

You may request access to, correction of, or deletion of any information we hold about you. CMU researchers can update their directory entries through the Research Office; non-affiliates may write to us at the email below.

• Right of access — request a copy of the data we hold about you.
• Right to rectify — request a correction of inaccurate or out-of-date data.
• Right to erasure — request removal of your information, subject to legal obligations.
• Right to object — opt out of any processing not strictly required to operate the platform.

The platform is hosted on infrastructure that enforces TLS in transit and encryption at rest. Administrative access is restricted to authorised Research Office staff using multi-factor authentication, and access logs are reviewed quarterly.

We may update this policy as the platform evolves. Material changes will be highlighted on this page with the revised effective date, and where appropriate, communicated to registered researchers via the Research Office mailing list.

For privacy enquiries, write to the Research Office at research@cmu.ac.th, or use the Contact form. We aim to respond within five business days.