Privacy policy

First: Scope

This policy applies to personal data processed by Majmaah University, as the controller, through the Institute of Studies and Consulting Services platform, its registration forms and its related communication channels.

Second: Data we collect

We collect the data needed to provide each service, which may include:

• Identity and contact data: name, national ID or residency number where needed, mobile number and e-mail.
• Educational and professional data: qualifications, specialisation, employer and the documents required for admission.
• Enrolment and learning data: programs enrolled in, attendance records, learning progress, assessments and certificates.
• Financial transaction data: invoices, payment status, transaction references and refund details where needed.
• Technical data: IP address, browser and device type, and login and interaction logs on the platform.
• Communication and support data: enquiries, requests and feedback submitted by beneficiaries.

Data is collected directly from you, automatically when you use the platform, or from legally authorised parties where needed. Registration forms show which data is mandatory and which is optional; not providing mandatory data may prevent the service from being completed.

Third: Purposes of processing

We use your data to:

• Create beneficiary accounts, verify identities and manage admission and registration requests.
• Deliver diplomas and educational programs, manage attendance and assessment, and issue certificates.
• Process payments, invoices and refund requests.
• Send notifications about registration, schedules, updates and services.
• Answer enquiries and handle complaints and support requests.
• Improve service quality and platform performance and protect it from unauthorised use.
• Meet legal obligations and the requirements of competent authorities.

Processing is based on your consent or another legal basis depending on the service, including performing agreements you are party to and meeting legal obligations. Data collection and use are limited to what is needed for the stated purposes.

Fourth: Sharing data

We do not sell or rent your personal data. Where there is a legal basis, we may share the minimum necessary with:

• Technical, operational and payment service providers, to the extent needed for their services.
• Educational, professional or accreditation bodies related to the program, where needed.
• Competent authorities, to meet a legal obligation or a legally valid request.

Data sharing is subject to confidentiality and protection controls and limited to the stated purpose. If providing the service requires transferring data outside the Kingdom, the applicable legal requirements and safeguards are observed.

Fifth: Protecting data

We take appropriate organisational and technical measures to protect personal data from unauthorised access, loss, alteration or disclosure, and limit access to authorised people according to their duties.

If an incident affects personal data, response, reporting and notification of affected people are carried out in line with legal requirements.

Sixth: Retention and destruction

We keep personal data for as long as needed for the purposes it was collected for, or to meet the relevant legal, educational and financial retention requirements. When it is no longer needed, it is securely destroyed or de-identified, unless there is a legal basis to keep it.

Deleting an account does not necessarily destroy records that must be kept by law.

Seventh: Data subjects' rights

Subject to legal provisions and limits, you may:

• Know the purposes of collecting your data and the legal basis for processing it.
• Access your personal data and request a copy in a clear, readable format.
• Ask for inaccurate data to be corrected, completed or updated.
• Ask for data that is no longer needed to be destroyed, subject to legal retention requirements.
• Withdraw consent where processing is based on it, without affecting the lawfulness of earlier processing.
• File a complaint about the processing of your data with the competent authority.

Requests to exercise these rights are made through the contact channel below, and identity verification may be required to protect your data. Requests are handled within the legal time limits, with reasons given for any limits or exceptions that apply.

Eighth: Cookies

The platform may use cookies to run its core functions, remember preferences and analyse performance. Consent is requested for non-essential cookies where required, and preferences can be managed or consent withdrawn. Disabling some cookies may affect some platform features.

Ninth: Marketing messages

Marketing messages are sent only with the necessary consent, and you can easily unsubscribe through the method shown in the message or by contacting us. Unsubscribing does not stop essential notifications about the programs and services you are enrolled in.

Tenth: Updates to this policy

We may update this policy to reflect changes in our services or legal requirements. The updated version is published with its effective date, beneficiaries are notified of material changes through appropriate channels, and new consent is requested whenever the law requires it.