Human Rights Commission Academy Platform presents this policy to outline the procedures and practices followed to protect the privacy of the Learning Management Platform’s users and safeguard the confidentiality of their personal data. It also explains the mechanisms for data collection, usage, and protection, in accordance with the laws and regulations applicable in the Kingdom of Saudi Arabia.

Definitions

· Platform: The Learning Management Platform belonging to Human Rights Commission Academy Platform.

· User: Any person who uses the Platform or registers for any of its programs, courses, or services.

· Personal Data: Any data—regardless of its source or form—that leads to the specific identification of the user or makes their identification possible, whether directly or indirectly.

Data Collected

Upon registration on the Platform or enrollment in a program, data necessary to complete registration and provide services may be requested—such as name, email address, mobile number, date of birth, nationality, gender, educational or training details, and other information depending on the nature of the service. Data collection is limited to what is necessary for the specified purpose. The legal basis for processing depends on the specific case and may include service provision, fulfillment of a legal obligation, consent (where required), or any other basis permitted by law.

Data of Minors

If the Authority provides a service to individuals under the age of eighteen, their data is processed only to the extent necessary to provide the service and in compliance with legal requirements. Data regarding a parent or legal guardian—as well as their consent and verification—may be requested when required. The guardian or custodian is responsible for the accuracy of the data they provide in this context.

**Data Collection**

Data provided by the user during registration and use of the platform is collected. Additionally, technical usage data—such as access time and date, login frequency, programs the user has registered for or joined, device or browser type, and technical performance information—may be collected when necessary to operate the platform and improve its services.

The Authority or its authorized service providers may use technical or analytical tools to measure platform usage and enhance performance. Data generated by these tools is processed in accordance with statutory requirements, contracts, and controls approved by the Authority.

**Data Usage**

Data is used for purposes related to providing platform services, including managing registration and program enrollment, communicating with the user, verifying data, managing payments and certificates, improving the user experience, measuring service quality, and ensuring compliance with statutory and regulatory requirements.

Contact information may also be used to send notifications, newsletters, and informational or marketing messages regarding the Authority’s programs, courses, events, and services, in accordance with applicable laws and regulations. Users may opt out of marketing messages via the unsubscribe link (if available in the message) or by contacting Aca@sca.sa; this will not affect operational messages necessary for service delivery.

**Data Protection and Disclosure**

The Authority maintains the privacy and confidentiality of personal data and implements appropriate technical and organizational measures to protect it against unauthorized access, disclosure, alteration, or destruction. Such data shall not be disclosed or shared except within the limits permitted by laws and regulations, when necessary to provide services through service providers or relevant entities, or upon the request of competent authorities.

In the event of a personal data breach or leak, the Authority shall take the necessary legal measures, including notifying the competent authority and the data subjects, where applicable and within the legally prescribed timeframes.

User Rights Regarding Personal Data

Users enjoy the rights granted to them under relevant laws and regulations, which may include, as applicable:

· The right to be informed of the legal basis and purpose for collecting and processing the data.

· The right to access their personal data and request a copy thereof, in accordance with legal requirements.

· The right to request the correction, completion, or updating of their personal data.

· The right to request the destruction of their personal data in cases permitted by law.

· The right to withdraw consent when consent serves as the legal basis for processing, without prejudice to processing activities lawfully conducted prior to such withdrawal.

· The right to lodge a complaint with the Authority regarding the processing of their data, as well as the right to approach the competent authority in accordance with applicable laws. Data Retention

The Authority retains personal data for the period necessary to fulfill the purposes for which it was collected, or for periods mandated by laws, regulations, or financial and regulatory requirements. The Authority applies internal retention controls and schedules based on data categories and purposes; once the legal or operational need for retention ceases, the data is deleted, destroyed, or anonymized in accordance with approved requirements.

Transfer of Data Outside the Kingdom

Certain technical or operational services may require the transfer of personal data or access to it from outside the Kingdom. In such cases, the Authority adheres to the requirements and safeguards established for transferring personal data outside the Kingdom, limiting the transfer to the minimum data necessary and for legitimate purposes related to the service.

The Platform may use cookies that are essential for service operation, functional for saving preferences, analytical for measuring usage and improving performance, and—where necessary and in compliance with regulatory requirements—marketing-related. Users may manage or disable cookies via their browser settings; however, please note that disabling essential cookies may affect certain Platform functions. Consent is requested for non-essential cookies whenever required.

Messaging
The Platform may provide a messaging service enabling communication between users or with service providers via messages or other available communication tools. Users are obligated to use this service solely for its intended purposes and must not misuse it or use it in a manner that violates regulations or causes harm to the Authority, the Platform, or its users.
The Authority may, when necessary—and for purposes such as service operation, verification of reports and violations, or ensuring quality and security—access or retain the content of communications. This will be done within the limits permitted by regulations and for the duration required for the specific purpose, while adhering to approved access controls and authorization protocols.
Hyperlinks
The Platform may contain links to third-party websites or resources; these links are provided solely for convenience. To the extent permitted by law, the Authority bears no responsibility for the content or services of such websites or resources, and their use is subject to the terms and policies of the respective providers.
Communication and Data Protection Requests
Human Rights Commission Academy Platform handles inquiries and requests regarding this policy and personal data rights via email: Aca@sca.sa. Requests are processed and responded to within the legally prescribed timeframes, depending on the nature and requirements of the request.
If a user is dissatisfied with the processing of their request or complaint regarding personal data, they may file a complaint through the Authority’s official channels. They also have the right to seek recourse with the competent authority in accordance with applicable laws and regulations.
Privacy Policy Updates
The Authority may update this policy as needed. Updates take effect upon announcement via the Platform. In the event of a material change affecting current users, the Authority may notify them via email or other registered contact methods, depending on the nature of the change.

Marketing and sales managemnet

Contact Email