List of active policies

Full policy

Privacy Notice

1. Introduction

   The Fahad Bin Sultan University (FBSU) is committed to protecting personal data and preserving privacy of individuals who benefit from its services and systems by applying the necessary administrative rules and technical measures in accordance with the relevant regulations, laws, and policies, and never disclosing their personal date except in accordance with the specific rules stipulated in the law. The FBSU also ensures that your data is protected in accordance with the policies and legislation issued by the National Cybersecurity Authority.

   The Privacy Notice has been formulated to help the beneficiaries of the services and systems understand the nature and type of Personal Data that we collect and process through the university’s various channels, why we collect and process it, what we do with it, and with whom we share it.

   The use of FBSU services, accessing its e-platforms, and consenting to the below acknowledgement means that the data owner sees and consents to the Privacy Notice and substantive changes made to it. Therefore, the university urges the beneficiaries to constantly see the Privacy Notice to stay updated.

   You may withdraw consent at any time unless there is another legislative basis, by sending an email to the Data Protection Officer (dpo@fbsu.edu.sa).

2. Personal Data and processing

2.1.What is Personal Data?

Personal Data means any data by which you may be identified as an individual directly or indirectly when combined with other data. It may include but not limited to the following:

• name, address, contact details (e.g. phone number, email)
• age, data of birth, nationality
• bank account number, bank card number.
• sensitive personal data including information about your health, etc.

2.2. What is processing? 

Processing means doing anything with Personal Data, e.g. viewing, collecting, using, storing, sharing, modifying, printing, copying, archiving, erasing, transporting, blocking, disclosing, interconnecting, etc.

3. Lawful bases we use for processing your Personal Data

Data is processed in accordance with the regulations of Personal Data Protection System issued by Royal Decree No. (19/M) dated 9/2/1443 AH, and its amendments. In general, we may rely on the following lawful bases:

• Processing is performed upon your consent.
• Processing is performed in order to implement an agreement to which you are already a party.
• Processing is performed in accordance with applicable laws.
• Processing is performed in order to implement service obligations to you.
• Processing is performed to achieve public interest or to implement an official mission for a public entity.
• Processing is performed in order to achieve legitimate interests or definite interests and it is impossible or difficult to contact you.
• Processing is performed due to another law or in order to implement an agreement to which you are already a party.
• Processing is performed due to security purposes or to meet judicial requirements.

4. When we process your Personal Data, and why.

We may process your Personal Data in various ways including viewing, collecting, using, storing, sharing, modifying, printing, copying, archiving, deleting, etc., depending on specific purposes of processing, as specified below but not limited to:

• Provide you with our services, such as registering for courses or using the electronic library.
• Operate, maintain, and improve E-Systems, its features, and services provided by service providers.
• Improve educational outcomes, services and decision support.
• We use your information to customize your experience, such as remembering your favorites and settings.
• Communicate with you about our services or offers and to send newsletters.
• Conduct statistics, research, and analyses.
• Process payments and preparing tax reports.
• Implement share data requests with public institutions, our affiliated companies and contracts, strategic partners, or recruitment companies to send you job offers.
• Comply with legal requirements and applicable regulations.

Collection and processing of your personal data is mandatory to enable the university to implement its tasks as an academic institution and provide you with a high level of services. Please be aware that if you do not complete collecting your personal data, you will not be able to get services that the university provides to its students and staff both employees and faculty members, regarding the manner we use to collect your personal data, whether directly from you, or indirectly from third parties, for example Absher Platform, the Ministry of Human Resources and Social Development, as described in Section 5 below. If your personal data changes, please keep us updated by contacting our Personal Data Protection Officer at dpo@fbsu.edu.sa

5. Collection of Personal Data from other sources or for other purposes

We will ensure that your Personal Data will not be processed in a manner inconsistent with the purposes, as specified above. However, please note that pursuant to Personal Data Protection Law we may collect your Personal Data from other sources or process your Personal Data for purposes other than specified above. This will only occur in specific circumstances, for example:  

5.1. If you agree to such collection and processing.

5.2. If your Personal Data is publicly available, or if it was collected from a publicly available source.

5.3.  If collection and processing is required for your vital interests.

5.4.  If collection or processing of your Personal Data is necessary to protect public health or safety, or to protect the life or health of you or another individual(s).

5.5.  If your Personal Data is recorded or stored in a form that makes it impossible to identify you directly or indirectly. 

6. Your rights in relation to processing your Personal Data

This Privacy Notice provides information about your rights. Under certain circumstances and in accordance with the Law, you may exercise the following rights:

1	Right to be informed:	you are entitled to be informed of the valid legal or practical justification for collecting your Personal Data, and the purpose thereof, and that your Personal Data should not be processed later in a manner inconsistent with the purpose for which it was collected, or in cases other than those specified in section 5 of the Notice herein.
2	Right to have access to your Personal Data:	you are entitled to have access to your Personal Data that is available to us, which includes accessing it, and obtaining a copy thereof in a format that is clear and identical to the content of the records.
3	Right to request correction, completion or updating:	you are entitled to request correction, completion or updating of your Personal Data which is available to us.
4	Right to be notified	In the event of a data breach involving a leak, damage, or unauthorized access to your personal data, the data controller is legally obligated to promptly notify both the relevant regulatory authority and you, the data subject, if the breach poses a risk to your Personal Data.
5	Right to request erasure (destruction):	you are entitled to request erasure (destruction) of your Personal Data available to us, which is no longer required by us (subject to compliance of the requirements of the Law).
6	Lodge complaints – You have a right to lodge a complaint with the regulator.	If you wish to raise a complaint on how we have handled your personal information, you can contact our DPO at dpo@fbsu.edu.sa who will investigate the matter. We hope that we can address any concerns you may have, but you can always contact the competent authority for lodging complaints.

Please contact us if you would like to know more about the above rights or if you would like to exercise any of these rights.

7. Personal Data processing outside the Kingdom

We may be required to transfer your Personal Data for processing outside of the KSA. In such cases we will ensure that we obtain required authorization from the KSA regulatory authorities (as may be required) and will comply with the requirements of Personal Data Protection Law.

8. Personal Data Protection

The FBSU sets personal data protection one of its main priorities. It is committed to implementing the laws, regulations, and policies regulating Personal Data Protection in the Kingdom of Saudi Arabia. We will use your personal data only if you provide us with your consent. We may use your personal data to complete internal and external administrative, organizational, and academic procedures through university systems and e-platforms, for example, the student information system, the e-learning system (Moodle), the graduate’s platform, etc.

9. Disclosures of Personal Data

9.1. In accordance with the data sharing policy issued by the National Data Management Office, the university will not share the beneficiary’s personal data with non-governmental entities unless they are among the entities authorized to perform specific government services, or after obtaining the consent of the data owner to do so, and within the limits of the data that may be legitimately disclosed.

9.2. The university may share the necessary personal data of the beneficiary with government entities due to specific purposes based on a regulatory basis or a justified practical need aimed at achieving a public interest without causing any harm to national interests, entity activities, individual privacy, or the safety of the environment. Data and entities excluded by royal orders are excluded, without prejudice to the rights of the personal data owner.

9.3. When sharing the beneficiary’s personal data, the university is concerned to adopt a safe and reliable environment in accordance with the relevant laws, regulations and policies. We may take additional steps to ensure the protection of your data by signing an agreement to share data between the university and other parties according to specific terms and conditions consistent to the principles of data sharing.

9.4. We may, as required for the purposes listed above, disclose your Personal Data to:

•   our consultants or other contractors who provide us with data processing, professional or technical services, etc.
• any applicable regulatory authorities (government entities, other public authorities, etc.) or other third parties as required by laws and regulations or in accordance with other regulatory obligations or policies applicable to the university or to you.

10. Storing Personal Data

We will arrange safe storage of your Personal Data in systems and servers of the FBSU. The servers are protected and governed according to the regulations issued by the National Cybersecurity Authority and the Saudi Data and Artificial Intelligence Authority. Personal data will only be available to university employees who need to view and use it in accordance with the employees’ tasks and responsibilities.

11. Retention of Personal Data

Your personal data will be retained for as long as necessary to fulfill the purposes outlined here and as required by law, after which it will be securely disposed of.

 12. Disposal of Personal Data

If we no longer need your Personal Data and if we do not have any legal basis to hold it further, we will arrange its erasure, anonymization or return to you (unless we must return it to any other entity based on our legal obligations). We will ensure that:

• In case of anonymization: you will not be further re-identified after anonymization.
• In case of erasure: Personal Data will not be reconstructed after it was erased.

13. Contact details:

To contact the Data Protection Officer (DPO): dpo@fbsu.edu.sa

Consent to Use Personal Data

I acknowledge that I have read, understood, and agree to the terms of the Privacy Notice above. Privacy Notice explains how my personal data will be used and what my rights are.

I agree to use my personal data in accordance with the Privacy Notice. I acknowledge that the FBSU will use my personal data for the purposes described in the Privacy Notice. I understand that I can withdraw consent to use my personal data at any time.