Privacy Policy

Al Baha University collects the minimum amount of personal data from beneficiaries that fulfills the purposes for which it was collected and is in compliance with the Personal Data Protection Law and regulations in the Kingdom of Saudi Arabia. We collect your personal data directly from you, or we may collect your personal data indirectly or through a third party who provides it to us.

The personal data we collect includes the following:

• Your personal data you provide to us when you contact us by mail or when you register for the university's electronic services.
• When you apply for admission to the university, we collect your personal data: name, identity data, contact information, qualifications, city, region, health and employment information.
• When you enroll as a student at the university, the following additional data is collected: bank information.
• When you apply for a job, we collect your personal data: name, identity data, region, city, contact information, academic qualifications, experience, and professional certifications.
• When you join the university as an employee, the following additional data is collected: family information, religion, address, passport/residence information, banking information, health information, and biometric features such as fingerprints and health information.
• When you join the training programs offered by the Institute of Studies and Consulting Services as a trainee, the following data is collected: name, identity information, contact information, educational level, region, city, and job information.
• Your personal data is obtained through third parties, including, but not limited to: the Ministry of Education, the Ministry of Human Resources and Social Development, the National Information Center, and the Education Evaluation Commission.
• Your personal data is collected through your participation in questionnaires and surveys.
• If you have a contract or employment commitment with the university, your personal data is collected in accordance with regulatory and administrative requirements.
• Cookie data: Such as data collected through web logs, technologies, cookies, or similar technologies.
• IP address data: This includes your IP address and details of the web browser version used.

To carry out the university's work in accordance with its regulations, enable the provision of university services, meet its requirements, and respond to inquiries from those benefiting from university services, we collect your personal data in accordance with the university's activities so that we can provide you with services.

The main purposes for which we use your personal data include:

• Academic and administrative organizational purposes.

• To complete your requests and receive services.

• Conduct analyses and statistics for decision-makers.

• Send awareness messages or messages related to the services provided to you.

• Fulfill judicial or security requirements.

• If you are an applicant to study at the university, we also use your personal data to complete your admission process, monitor your academic career, and provide employers with your data after graduation.

• Username authentication when registering for various university services.

n accordance with the Data Sharing Policy, we may share your necessary personal data with governmental, private, or non-governmental entities authorized to perform government services for specific purposes based on regulatory grounds or a justified practical need aimed at achieving the public interest without harming national interests or individual privacy. When sharing your personal data, we ensure it is shared in a secure and reliable environment in accordance with the Personal Data Protection Law and its regulations. Al Baha University takes additional steps to ensure the protection of your personal data by signing a data sharing agreement between the university and other entities, subject to specific terms and conditions consistent with the principles of data sharing and exchange.

We collect and process your personal data based on the following legal principles:

• Regulatory Compliance: Compliance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443 AH, as amended by Royal Decree No. (M/148) dated 5/9/1444 AH.
• The new Universities Law issued by Royal Decree No. (M/27) dated 2/3/1441 AH.
• Consent: Obtaining explicit consent from the individuals concerned to collect and process their data. Consent must be informed, voluntary, and revocable.
• Public Interest: To advance the educational process to achieve the highest levels of quality in education and improve its outcomes.
• Compliance with Legal Obligations: If data collection and processing is necessary to comply with legal or regulatory obligations (in accordance with the laws, regulations, orders, decisions, and instructions in force in the Kingdom of Saudi Arabia).
• Legitimate Interest: If there is a legitimate or necessary interest to perform a task in the public interest, taking into account that this does not prejudice your rights or conflict with your interests, in accordance with the Personal Data Protection Law.
• Contractual Obligation: In fulfillment of a contractual obligation that requires the processing of your data (such as contracts concluded between you and the university to which you are a party).
• Your Consent to the Collection and Processing of Your Data: You may withdraw your consent to the collection and processing of your personal data at any time unless there is another legal basis. To do so, you can contact the university's Personal Data Protection Officer or the university's Data Management Office using the contact details below.

Your personal data is securely stored and maintained at the university's headquarters or on its approved servers within the Kingdom of Saudi Arabia. The best security standards and practices are applied to ensure data security and protection, such as access control management processes, data classification and encryption, and regular security assessment procedures. Data is retained for the period necessary to fulfill the university's regulatory obligations until the purpose for which it was processed is completed. It is then securely destroyed, preventing access to or retrieval of the data, in accordance with the provisions of Article (18) of the Personal Data Protection Law.

In accordance with the general rules for transferring personal data across geographical borders issued by the National Data Management Office, your personal data will be stored and processed in a secure manner within the geographical borders of the Kingdom of Saudi Arabia, in order to ensure the preservation of the national digital sovereignty of this data. This excludes the cases stipulated in Article (Twenty-Nine) of the Personal Data Protection Law and its regulations when it is necessary to transfer or process data outside the geographical borders of the Kingdom.

Under the Personal Data Protection Law, you have the following rights, which depend primarily on the purpose for which your personal data is collected and processed:

• The right to be informed: You have the right to know how we collect your personal data, the legal justification for collecting and processing it, how it will be processed, stored, and destroyed, and to whom it will be disclosed. You can view all details in this policy, or you can contact the Personal Data Protection Officer or the Data Management Office according to the details specified in this policy.
• The right to access your personal data: You have the right to access your personal data through the services available on the My University e-Services Portal or by submitting a request to the relevant university departments.
• The right to request access to your personal data: You have the right to request access to your personal data in a legible and clear format whenever technically feasible. This can be done through the My University e-services portal (employee file - employee profile), or by submitting a request to the relevant university departments.
• The right to correct your personal data: You have the right to request that we correct any personal data you believe to be inaccurate, incorrect, or incomplete. This can be done through the Employee Data Update Service, Faculty Data Update Service, or Student Data Update Service. Your personal data will be reviewed and updated within 10 working days of receiving your complete request, and you will be notified accordingly through the same service.
• The right to destroy your personal data: You have the right to request that we destroy your personal data in certain circumstances unless there are legal justifications that require otherwise.
• The right to withdraw your consent to the processing of your personal data: You have the right to withdraw your consent to the processing of your personal data at any time unless there are legal justifications that require otherwise.

Except as provided by law, you will not be required to pay any fees to exercise these rights. If a request is submitted to exercise one of these rights, you will receive a response within 10 business days of receiving the complete request.

For more details about the processing of your personal data and how to exercise your rights, you can contact the university's Personal Data Protection Officer or the university's Data Management Office, using the contact details below.

If you have any questions or concerns about how to exercise your rights regarding the processing of your personal data, or regarding the provisions of the Privacy Policy and Notice in general, or the rights of personal data subjects, you can contact the Data Management Office at Al Baha University.
Department/Relevant Team: Al Baha University - Data Management Office
Address: Kingdom of Saudi Arabia - Al Baha - Al Aqeeq 4781, Postal Code (65779), Additional Number (7738)
Phone: - 0177257700 - 15572 - 15554
Email: DMO@bu.edu.sa

For more information on the relevant regulations and legislation referenced in this policy, please visit one of the following links:

• Personal Data Protection Law
• Implementing Regulations of the Personal Data Protection Law
• Data Sharing Policy
• Basic Cybersecurity Controls

University of Al Baha

Address: Kingdom of Saudi Arabia - Al Baha - Al Aqiq 4781, Postal Code (65779), Additional Number (7738)

966-17-7257700

Email: contact@bu.edu.sa

This Privacy Policy was last updated on 02/01/2025, 02/08/1446 AH.

We may update this Privacy Notice from time to time. We will post any changes on our website and update the effective date. We recommend that you review this notice periodically to ensure you are aware of the most current information.

By using the University's Services, you consent to the collection, use and sharing of your personal information in accordance with this Notice.