Privacy Policy

How NUM iLAW collects, uses, and safeguards your personal information when you use this website.

Last updated: September 21, 2026

The National University of Management – International Program of Legal Studies ("NUM iLAW", "we", "us", or "our") respects your privacy and is committed to protecting the personal information of everyone who visits this website or interacts with our programs — including prospective and current students, faculty, alumni, event registrants, and job applicants. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

NUM iLAW is based in the Kingdom of Cambodia, and we aim to handle your personal information in line with Cambodia's Law on Personal Data Protection — which, as of the date of this policy, remains a draft law under consideration by Cambodia's National Assembly and administered by the Ministry of Post and Telecommunications ("MPTC") once it enters into force — as well as the EU General Data Protection Regulation ("GDPR") for visitors located in the European Economic Area or United Kingdom. Where this policy refers to obligations under Cambodian or EU law before either is fully applicable to us, we do so because we intend to align our practices with those frameworks as a matter of good practice, not as a representation that they currently bind us as a matter of law.

1. Information We Collect

Depending on how you interact with our website, we may collect:

Contact and identity details you provide directly, such as your name, email address, phone number, and mailing address — for example when you submit an admission inquiry, register as an alumnus, apply for a job posting, or register for an event or moot court program.
Academic and professional information submitted as part of an admission application, faculty profile, or job application, such as educational background, work history, and uploaded documents (CVs, transcripts, certificates).
Account credentials for administrators and staff who log in to manage site content, stored as a securely hashed password — we never store passwords in plain text.
Technical data collected automatically, such as your IP address, browser type, device information, and pages visited, gathered through standard web server logs and session cookies.
Communications you send us, including messages through contact or registration forms.

We do not intentionally request sensitive personal data — such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, biometric or genetic data, health data, or data concerning sex life or sexual orientation — through our forms. Please do not include this type of information when submitting a form to us unless a specific field expressly asks for it and explains why it is needed.

2. Data Controller and Data Processors

Under both the GDPR and Cambodia's Law on Personal Data Protection, the National University of Management – International Program of Legal Studies ("NUM iLAW") acts as the Data Controller for the personal information described in this policy. This means we decide why your personal information is collected and how it is used — for example, why we collect admission inquiry details and how long we keep them.

Some of the information we collect is handled on our behalf by Data Processors — third-party organizations that process personal information only under our instructions, for the purposes we specify, and that are not permitted to use it for their own purposes. These currently include:

Our website hosting provider, which stores the website's files and database;
Email delivery services we use to send confirmations, updates, or responses to your inquiries;
Content delivery networks (such as Google Fonts and jsDelivr) that serve fonts and icon libraries used on this website — see the Cookies and Similar Technologies section below.

As Data Controller, NUM iLAW remains responsible for how your personal information is processed, including by any processor acting on our behalf, and we require our processors to protect your information under terms consistent with this policy and, as applicable, under a written agreement covering the subject matter, duration, nature, and purpose of the processing.

Cambodia's Law on Personal Data Protection also requires data controllers and data processors to appoint a qualified Data Protection Officer and to notify the MPTC of that appointment once the law enters into force. NUM iLAW is in the process of designating this role; in the meantime, questions or requests relating to personal data can be directed to the contact details in the Contact Us section below.

3. How We Use Your Information

We use the information we collect to:

Process admission inquiries, event and moot court registrations, and job applications;
Communicate with you about programs, events, deadlines, and opportunities you have expressed interest in;
Maintain and improve the security, performance, and content of this website;
Keep an accurate alumni and faculty directory with the details you choose to share publicly;
Comply with legal obligations and protect against fraud, abuse, or unauthorized access.

Our lawful basis for these uses is generally your consent (for example, when you voluntarily submit a form), our legitimate interest in operating and improving the university's programs and website, the need to perform a contract with you (for example, processing an admission application), or compliance with a legal obligation.

We do not sell your personal information to third parties.

4. Cookies and Similar Technologies

This website uses a small number of essential cookies — for example, to keep you signed in to the admin dashboard and to remember your selected language (English or Khmer). We also load fonts and icon libraries from trusted third-party content delivery networks (such as Google Fonts and jsDelivr), which may receive standard technical request information (like your IP address) as part of serving those files. We do not use third-party advertising or cross-site tracking cookies.

We only share personal information in limited circumstances:

With university staff and faculty who need it to process your inquiry, application, or registration;
With partner organizations or moot court organizers, where you have registered to participate in a jointly run program or competition;
With service providers who help us operate the website (such as hosting providers), under obligations to keep your data confidential;
Where required by law, regulation, or a valid legal process.

6. How We Protect Your Information

We apply reasonable technical and organizational safeguards to protect your information, including encrypted password storage, restricted administrator access, rate-limiting and bot-verification on our login system, and session security controls. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

If a personal data breach occurs that poses a risk to your rights and freedoms, we will take appropriate steps to notify the relevant supervisory authority (the MPTC, once Cambodia's Law on Personal Data Protection enters into force) within the timeframe that law requires, and we will notify affected individuals directly where the breach poses a high risk to their rights and freedoms, unless an exception applies (for example, where the affected data was already encrypted).

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy — for example, admission records are kept for the academic record-keeping periods required by university policy, and event or job application details are retained for a reasonable period after the event or hiring process concludes, unless a longer retention period is required by law.

8. International Data Transfers

NUM iLAW is located in Cambodia, and the personal information we collect is generally stored and processed in Cambodia by us and by the Data Processors listed above. Where we do transfer personal information to a data controller or data processor located outside Cambodia — for example, a cloud-based service provider — we take reasonable steps to ensure the recipient provides a level of protection for that information that is equivalent to or higher than what is required under Cambodian law, consistent with Article 31 of Cambodia's Law on Personal Data Protection. We remain accountable for personal information under our control even after it has been transferred outside Cambodia.

Separately, if you are accessing this website from the European Economic Area (EEA), the United Kingdom, or another region with data transfer restrictions, your information will typically be transferred to and processed in Cambodia, which may not have data protection laws formally recognized as equivalent to those in your home jurisdiction. By using this website and submitting information to us, you acknowledge this transfer. We require our Data Processors to protect your information consistently with this policy wherever it is processed.

9. Your Rights and Choices

Regardless of where you are located, we aim to honor the following rights regarding the personal information NUM iLAW holds about you as Data Controller — reflecting both the rights set out for data subjects under Cambodia's Law on Personal Data Protection and the GDPR, for visitors in the EEA, the United Kingdom, or a jurisdiction that grants similar rights:

Right to clear, accurate, and transparent information — understand what personal information we hold about you and how it is processed;
Right of access and rectification — ask us to confirm what personal information we hold about you, obtain a copy of it, and correct inaccurate or incomplete information (for example, in the alumni or faculty directory);
Right to erasure or updating ("right to be forgotten") — ask us to delete or update your personal information, where we are not required to keep it for legal, academic record-keeping, or other legitimate reasons;
Right to restrict processing — ask us to limit how we use your information in certain circumstances;
Rights concerning consent and objection — grant or withdraw consent at any time, and object to processing based on our legitimate interest, including for direct marketing communications;
Right to data portability — ask us for a copy of the information you provided to us in a structured, commonly used, machine-readable format;
Right to human intervention in automated decisions — NUM iLAW does not currently use automated decision-making or profiling that produces legal or similarly significant effects; if this changes, you will have the right to request human review of any such decision;
Right to file a complaint — raise a concern, request an investigation, and seek remedies if you believe your personal information has been processed in violation of applicable law.

We will respond to a verified request without undue delay, and in any case within one month of receiving it; where a request is complex or we receive a high volume of requests, we may extend this by up to two further months and will let you know if we do. Exercising these rights is free of charge, unless a request is manifestly excessive or unfounded, in which case we may charge a reasonable administrative fee or decline the request with an explanation. To exercise any of these rights, please contact us using the details below.

If you are not satisfied with our response, you have the right to lodge a complaint with the MPTC (Cambodia's competent authority for personal data protection, once the Law on Personal Data Protection enters into force) or, if you are located in the EEA or the United Kingdom, with your local data protection supervisory authority.

10. Children's Privacy

This website is intended for prospective and current university students, alumni, faculty, and the general public. It is not directed at children, and we do not knowingly collect personal information from children under 16 through our own initiative. Where a minor under 16 does submit personal information to us — for example, as part of a family member's registration — we require the consent of both the minor and their parent or legal guardian before processing it, consistent with Cambodia's Law on Personal Data Protection, and we may take reasonable steps to verify that consent.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this page periodically.

12. Contact Us

If you have questions about this Privacy Policy, how your information is handled, or wish to exercise any of the rights described above, please contact us: