Privacy Policy

GCTI ("GCTI", "we", "us") is committed to protecting your personal data in accordance with the Law on Personal Data Protection of the Kingdom of Cambodia (LPDP), the EU General Data Protection Regulation (GDPR), and applicable ASEAN data protection frameworks.

This Privacy Policy describes how we collect, use, store, transfer, and protect your personal data when you use our website (gcti.app) and educational services.

GCTI is the Data Controller for the purposes of this Privacy Policy. We have appointed a Data Protection Officer (DPO) who can be contacted at: privacy@gcti.app

3.1. Data collected during admissions:

Full name, email address, phone number, country of residence

Government-issued national ID or equivalent

Resume/CV

Selfie (biometric data for identity verification)

Soka™ AI interview responses and notes

Entrance exam score

3.2. Data collected during enrollment and study:

Student ID, course enrollment records, academic progress and grades

Payment records and transaction history

Dashboard access logs

Communications with faculty and staff

3.3. Data collected automatically: IP address, browser type and version, device information, usage analytics, cookies (see Cookie Policy).

3.4. Sensitive personal data (as defined under the LPDP): We collect biometric data (selfie) and government-issued ID for identity verification purposes only, with your explicit consent. This data is encrypted, stored securely, and access is restricted to authorized admissions personnel only.

4.1. Contractual necessity: Processing your data to provide educational services you have enrolled in.

4.2. Consent: Processing biometric data, marketing communications, and any optional data you provide.

4.3. Legal obligation: Maintaining records as required by Cambodian law, including educational records and financial transaction records.

4.4. Legitimate interests: Platform security, fraud prevention, and service improvement.

5.1. To process your admissions application and conduct the Soka™ AI interview.

5.2. To enroll you in courses and track academic progress.

5.3. To process payments via KHQR, Wing, ABA Bank, and Bakong Credit Transfer.

5.4. To issue certificates and maintain blockchain-anchored credential records.

5.5. To communicate with you regarding your studies, payments, and program updates.

5.6. To maintain audit trails and compliance records as required by law.

5.7. To improve our educational content, platform, and services.

6.1. Personal data is retained for the duration of your enrollment plus seven (7) years, as required by Cambodian educational and financial record-keeping requirements.

6.2. Biometric data (selfie) and national ID copies are retained for the duration of your enrollment plus one (1) year, after which they are permanently deleted.

6.3. Payment records are retained for seven (7) years in accordance with Cambodian financial regulations.

6.4. You may request earlier deletion of certain data, subject to legal retention obligations.

Under the LPDP and GDPR, you have the following rights:

7.1. Right to information: To be informed about how your data is processed.

7.2. Right to access: To request a copy of your personal data.

7.3. Right to rectification: To correct inaccurate or incomplete data.

7.4. Right to erasure: To request deletion of your data (subject to legal retention requirements).

7.5. Right to restriction: To request that we limit processing of your data.

7.6. Right to data portability: To receive your data in a structured, machine-readable format.

7.7. Right to object: To object to processing based on legitimate interests or for marketing.

7.8. Right to human intervention: To request human review of AI-automated decisions, including Soka™ admissions recommendations.

To exercise these rights, contact: privacy@gcti.app

8.1. We do not sell your personal data to third parties.

8.2. We share data with the following categories of recipients:

Payment processors (KHQR, Wing, ABA Bank, Bakong) for transaction processing

Blockchain networks for certificate anchoring and verification

Cloud hosting providers for platform infrastructure

Email service providers for transactional communications

Government authorities when required by law

8.3. All third-party processors are bound by data processing agreements that comply with the LPDP and GDPR.

9.1. Your personal data may be transferred to and stored in countries outside Cambodia, including cloud servers located in the United States and European Union.

9.2. Such transfers are conducted in compliance with the LPDP, GDPR, and applicable ASEAN frameworks.

9.3. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) with all international data processors.

10.1. We implement appropriate technical and organizational measures to protect your personal data, including:

Encryption in transit (TLS/SSL) and at rest

Access controls and authentication

Regular security assessments

Staff training on data protection

Incident response procedures

10.2. Access to personal data is restricted to authorized personnel on a need-to-know basis.

11.1. In the event of a personal data breach, GCTI will notify the Ministry of Post and Telecommunications (MPT) of Cambodia within seventy-two (72) hours, as required by the LPDP.

11.2. Affected data subjects will be notified without undue delay if the breach is likely to result in a high risk to their rights and freedoms.

12.1. GCTI does not knowingly collect personal data from individuals under 18 years of age without parental/guardian consent.

12.2. If you believe a minor has provided us with personal data, contact privacy@gcti.app and we will take steps to delete such data.

Our use of cookies is described in our separate Cookie Policy.

We may update this Privacy Policy from time to time. Updated versions will be posted on this page with the revised "Last Updated" date.

Data Protection Officer: privacy@gcti.app

General inquiries: info@gcti.app

Admissions: intake@gcti.app