Your data, handled with care.

1) Information we collect

We collect account details such as name and email, profile information, and activity data required for scheduling, attendance tracking, and platform features.

2) How we use your information

Your data is used to operate the platform, personalise your experience, maintain system security, and communicate important updates such as account or policy changes.

3) Sharing and disclosure

We do not sell personal data. Information may only be shared with trusted service providers supporting core operations or when required by law.

4) Data retention and security

Data is retained only as long as necessary for legitimate business or legal purposes. We implement reasonable technical and organisational safeguards to protect your data.

5) Data breach management

A data breach refers to any unauthorised access, use, disclosure, or loss of personal data. This may result from malicious activity, human error, or system weaknesses.

All employees must immediately report breaches to the Data Protection Officer (DPO) and Data Breach Management Team. An initial assessment will determine:

• Cause of the breach and whether it is ongoing
• Number of affected individuals
• Type of personal data involved
• Affected systems and platforms
• Required containment and remediation actions

6) Breach response and containment

• Isolate compromised systems
• Block unauthorised access and reset accounts
• Filter or reroute malicious traffic
• Identify and eliminate root causes
• Recover lost data where possible

All incidents are recorded in an Incident Log, including forensic data for investigation and legal purposes.

7) Notification obligations

Activity Alligator will assess whether a breach meets PDPA notification thresholds.

• Mandatory notification to PDPC and affected individuals where required
• Notification to individuals as soon as practicable
• Voluntary reporting where beneficial for risk mitigation

8) Prevention and improvement

• Root cause analysis after every breach
• System fixes and improved safeguards
• Policy and procedure updates
• Review of third-party data handlers

9) Security measures

Login:

• Limited login attempts
• Strong password requirements (8–24 chars, mixed types)
• Passwords hashed (e.g. bcrypt)

Session security:

• Randomised session keys
• CSRF protection (Flask-WTF)
• HTTPS enforced

Access control:

• Role-based access control (RBAC)
• Users only access authorised data

Database security:

• Parameterized SQL queries (prevent injection)
• Transaction control for consistency