Clause One: Introduction
The Data Management Office at the University of Hafr Al-Batin has developed this Privacy Policy to define how the personal data of beneficiaries is collected, used, and protected, in a manner that ensures transparency and compliance with the regulatory standards and legislation of the Kingdom of Saudi Arabia. The policy helps build trust by clarifying the rights and options available to beneficiaries regarding their information that is collected, processed, used, retained, and shared. It also sets out the procedures to be followed to ensure data security and protect it from potential risks.
Out of the University of Hafr Al-Batin's commitment to the privacy of the beneficiary's data and information, it undertakes to preserve the confidentiality and privacy of this data and to use it to reach the desired level in providing the necessary service to the beneficiary, in line with the applicable terms and conditions, in addition to the Personal Data Protection Law in force in the Kingdom of Saudi Arabia. Use of the University's website and its affiliated digital platforms is considered consent by the beneficiary to this Privacy Policy.
Clause Two: Entity Information
The University of Hafr Al-Batin is a Saudi governmental university located in the Governorate of Hafr Al-Batin, one of the governorates of the Eastern Province of the Kingdom of Saudi Arabia, and operates under the supervision of the Ministry of Education. The University was established by Royal Decree No. (20937) dated 02/06/1435 AH, corresponding to 03/04/2014 AD, and incorporated branches that had previously belonged to two long-established universities: King Fahd University of Petroleum and Minerals and the University of Dammam (now known as Imam Abdulrahman bin Faisal University). The University aims to provide higher education and scientific research across a wide range of academic disciplines, and comprises multiple colleges offering undergraduate and graduate study programs.
Clause Three: Contact Information
The University's Data Management Office and its staff (the Chief Data Officer and the Personal Data Protection Officer) can be contacted via:
Email: dmo@uhb.edu.sa
Clause Four: Updates to the Privacy Policy
The Privacy Policy was last updated on 30/06/2026 AD.
The beneficiary entity reserves the right to add or change any of the provisions of the Privacy Policy. The service provider will notify the data subject accordingly, and the service provider has the right to terminate the data subject's account should they not accept any change to the Privacy Policy.
Arabic is the language adopted in applying these terms and conditions. In the event of any dispute in interpreting any text provided in any other language, the text written in Arabic shall prevail.
Clause Five: Personal Data Collected
| Data Type | Illustrative Examples | Collection Status | Reason for Collection | Collection Method |
|---|---|---|---|---|
| Basic data for creating a user account | Full name: the beneficiary's name as it appears in official documents in both Arabic and English. | Mandatory | Verifying the personal identity of individuals, which helps manage the academic and administrative file in an organized manner. Performance management and evaluation of staff, which helps improve the quality of education and administration. Ensuring compliance with the legal and regulatory requirements relating to employees and students, such as security regulations and the regulations governing work, employment, and education. Planning, development, and improvement of the work environment. | Directly |
| Date of birth: the day, month, and year on which the person was born. | Mandatory | |||
| Gender: male or female. | Mandatory | |||
| Religion: the religious belief held by the person. | Mandatory | |||
| Place of birth: the country and city in which the individual was born. | Mandatory | |||
| Nationality: the nationality held by the individual according to official documents. | Mandatory | |||
| Personal identification data | National ID or passport number: the unique identification number issued to individuals. | Mandatory | Verifying the personal identity of individuals, which helps manage the academic and administrative file in an organized manner. Performance management and evaluation of staff, which helps improve the quality of education and administration. Ensuring compliance with the legal and regulatory requirements relating to employees and students, such as security regulations and the regulations governing work, employment, and education. Planning, development, and improvement of the work environment. | Directly |
| Social insurance number: a number used for insurance and retirement purposes. | Optional | |||
| Employee number: the number granted to the employee by the employer. | Mandatory | |||
| Job title: the title of the position the employee holds. | Mandatory | |||
| Contact data | Phone number: whether local or international. | Mandatory | For communication purposes, as this data helps facilitate communication between the University and individuals, whether via email, text messages, or any other means of communication. | Directly |
| Email: the person's electronic address. | Optional | |||
| Financial data | Bank account number, bank name. | Mandatory | For payment processing purposes. | Directly |
| Salary and income information: data on the individual's financial income. | Mandatory | |||
| Professional and educational data | Current occupation: job title and place of work. | Mandatory | Human resources management, as collecting professional data helps organize and manage human resources effectively. Performance planning and development and developing training and professional development strategies. Defining and distributing roles and responsibilities. Workforce planning by analyzing the University's needs, recruitment, and identifying required specializations and skills. Providing support and professional development appropriate to individuals' professional background and experience. | Directly |
| Curriculum vitae: details of professional and educational history. | Mandatory | |||
| Academic certificates: the degrees and academic qualifications obtained by the person. | Mandatory | |||
| Family and social data | Family details: information about relatives and individuals connected to the person. | Optional | Meeting legal and regulatory requirements. Emergency and crisis management. | Directly |
| Marital status: information about social and marital status. | Optional | |||
| Geographic data | Residential area: the geographic area comprising the city or neighborhood in which the person resides. | Mandatory | Meeting legal and regulatory requirements. | Directly |
| Geographic location: city, neighborhood, street, building number, postal code. | ||||
| Digital and behavioral data | Internet Protocol (IP) address: the digital address of the user's device on the internet. | Mandatory | Used to improve the user's experience of the electronic platforms and to understand their needs. Meeting legal and regulatory requirements. | Indirectly / Directly |
| Browsing history: the websites visited by the beneficiary and the activity log. | Optional | |||
| Cookies: pieces of data that uniquely identify the beneficiary. | Optional | |||
| Data generated by applications: such as usage information and in-app activities. | Optional | |||
| Social media account username, account link. | Mandatory | |||
| Health data | Medical examination forms. | Mandatory | Verifying medical fitness. Organizing administrative work. Complying with regulatory requirements. Keeping a record of leave for administrative and legal purposes. | Directly |
| Sick leave forms. | ||||
| Disability or special needs reports. | ||||
| Blood type. | ||||
| Biometric data | Fingerprints: fingerprint data. | Mandatory | Security and identity verification. Improving access to services. Speeding up registration and login procedures. For the purposes of registration in government services. | Directly |
Clause Six: Methods of Data Collection
The data that the personal data subject provides to the platforms is collected directly or indirectly, using various methods that include:
- Directly, for example through services: when registering on the University's official channels, including the University's mobile applications or electronic platforms, or by contacting the University through customer service channels, or through opinion surveys (electronic forms that include blank fields, drop-down lists, option buttons, and the like).
- Indirectly, such as data provided to us by other entities, or through cookies collected when visiting the website, or website analytics, or through linking and integration with other government entities.
Clause Seven: Use of Personal Data
Purposes of using personal data at the University:
- Completing the evaluation process.
- Improving the beneficiary's experience.
- Completing the registration and verification process.
- Assessing the level of services and otherwise.
- Completing planning and development processes.
- Implementing legal and regulatory requirements.
- Completing the process of providing the service or fulfilling the request.
Use cases at the University are as follows:
- Registering and managing beneficiaries: personal data is used to register students in academic programs, create their academic files, and manage their study records, including information on courses and grades. Personal data of employees and faculty members is also used to create their academic and administrative files, including their academic, financial, and employment data.
- Providing academic and administrative support: personal data helps customize academic services and manage administrative services such as applications for scholarships and financial aid.
- Managing employees and faculty members: personal data is used in managing the files of employees and faculty members, including recruitment, salaries, evaluations, and training and development.
- Internal communication: personal data is used to facilitate communication between students, faculty members, and the university administration, through email, text messages, and other electronic systems.
- Planning programs and activities: personal data helps plan and organize academic programs, student activities, and university events in a manner consistent with individuals' needs and preferences.
- Performance analysis and strategy development: personal data is used to analyze the performance of students, faculty members, and employees, which helps improve the quality of education and services provided and develop academic and administrative strategies.
- Emergency and crisis management: in emergencies or crises, personal data is used to identify affected individuals and provide appropriate support, whether in health situations or security crises.
- Handling legal and regulatory requirements: laws and regulations may require the collection and use of personal data to ensure compliance with academic and administrative registration and documentation requirements.
- Managing facilities and resources: personal data is used to manage access to university facilities, including libraries, laboratories, and electronic systems, and to allocate resources effectively.
- Issuing certificates and documents: personal data is used to issue academic certificates and official documents, and to prepare student reports for graduates or for employees after the end of their contract or period of service, or for external entities.
Clause Eight: Disclosure of Information
The beneficiary's data may be made available to authorized persons at the University or to legislative authorities in the Kingdom of Saudi Arabia as required by law in the exceptional circumstances in which such need arises. However, it will never be made available to the public without the beneficiary's prior consent.
Personal data will not be disclosed except in the following cases:
- If the beneficiary consents to its disclosure in accordance with the provisions of the law.
- If the personal data was collected from a publicly available source.
- If the entity requesting disclosure of the data is a public entity, or for security purposes, or to adopt another system, or to meet judicial requirements in accordance with the provisions specified by the regulation.
- If disclosure is necessary to protect the public interest, public safety, or the life or interest of a specific individual or individuals.
- If disclosure is limited to processing the data in a manner that does not lead to specifically identifying the personal data owner or any other individual. It will not be circulated, exchanged, or sold to any third party without the user's prior consent.
The University will not publish any personal data if any of the following conditions are met:
- Anything that poses a threat to security, harms the reputation of the Kingdom, or conflicts with its interests.
- Anything that affects the Kingdom's relations with other states.
- Anything that prevents the disclosure of a crime, infringes the rights of the accused to a fair trial, or affects the integrity of ongoing criminal proceedings.
- Anything that endangers the safety of an individual or individuals.
- Anything that constitutes a violation of the privacy of an individual other than the personal data owner, as specified in the regulations.
- Anything that conflicts with the interest of an incompetent or incapacitated person.
- Anything that violates applicable professional obligations.
- Anything that involves a breach of an obligation, procedure, or court ruling.
- Anything that reveals a confidential source of information that should not be disclosed in the public interest.
Clause Nine: Legal Basis for Collecting and Processing Personal Data
The legal purpose for collecting the minimum amount of personal data:
- Protecting vital interests.
- Achieving the University's interests and objectives.
- Meeting and fulfilling legal and regulatory requirements and obligations.
- Issuing policies and preparing studies that serve business requirements.
- Enabling and providing the services of the University of Hafr Al-Batin and fulfilling incoming requests.
- Resolving and handling inquiries and complaints of the beneficiaries of the University's services.
- Authenticating the user's identity upon registration in the University's various services.
- Raising the performance level of services, developing them, improving the beneficiary's experience, and ensuring the continuity of service delivery at the required quality.
In accordance with the Personal Data Protection Law, the legal justification on which the University relies for processing this data is based on:
- The Personal Data Protection Law issued by Royal Decree No. M/19 dated 9/2/1443 AH and amended by Royal Decree No. M/148 dated 5/9/1444 AH.
- The Implementing Regulation of the Personal Data Protection Law issued by Decision No. 1516 dated 19/2/1445 AH.
- The Data Sharing Policy document issued by the Saudi Data and Artificial Intelligence Authority.
- The consent of the personal data subject and the interest realized for them. Consent may be withdrawn at any time, provided this does not affect processing operations carried out on the basis of other legal justifications. To do so, you may contact the University's Data Management Office, whose contact details are set out in Clause Three of this policy.
- The University's interests and the service of its activity and objectives.
Clause Ten: Storage and Disposal of Personal Data
The personal data of beneficiaries is stored on the University's servers and the databases of the University's systems, platforms, and website inside the Kingdom of Saudi Arabia, except for email, which is retained on the service provider's servers, in addition to archiving non-automated data in paper form.
Data is also retained according to its type as shown in the following table:
| Type of Personal Data | Retention Period |
|---|---|
| Personal data | Maximum: permanent |
| Academic data | Maximum: permanent |
| Employment file | 10 years after retirement |
| Biometric data | 10 years |
| Health data | 10 years |
After the retention period expires, the University disposes of this data in a secure manner that prevents it from being accessed or recovered again.
- Digital data: through secure deletion techniques (Secure Deletion).
- Paper data: papers containing the data will be shredded using shredding machines.
Clause Eleven: Rights of the Personal Data Subject
- The right to be informed: the personal data subject has the right to know the methods of collecting their data, the legal basis for collecting and processing it, how it is processed, retained, and destroyed, and with whom it will be shared. You can review all details through this Privacy Policy, or you may contact us via the details set out in Clause Three.
- The right to access personal data: the personal data subject has the right to request a copy of their personal data, via the email set out in Clause Three. It will be provided to them — free of charge — within [seven working days], via email.
- The right to correct personal data: the personal data subject has the right to request the correction of their personal data that they consider inaccurate, incorrect, or incomplete, via the email set out in Clause Three. It will be reviewed and updated within [seven working days], and the personal data subject will be notified accordingly via email.
- The right to destroy personal data: the personal data subject has the right to request the destruction of their personal data in certain circumstances, unless there is a legal provision specifying a particular retention period or contractual requirements.
- The right to withdraw consent to the processing of personal data: the personal data subject may withdraw consent to the processing of their personal data — at any time — unless there are legitimate purposes requiring otherwise.
Clause Twelve: Sharing / Exchange of Personal Data
Beneficiaries' data at the University is shared with the following entities:
| Category of Beneficiaries | Sharing Entities |
|---|---|
| Faculty members and employees | Eltizam service. |
| Faculty members and employees | National Information Center – National Single Sign-On (Nafath) – Tawakkalna application – contact control services – external examiners for promotions – Ministry of Education (Safeer platform) – Ministry of Human Resources and Social Development – Eltizam service – General Organization for Social Insurance. |
| University graduates | Ministry of Education and regulatory bodies – Jamea system – employment entities. |
| Enrolled students | Training entities. |
Clause Thirteen: External Links
Where links to other websites are provided on the platform for the purpose of accommodating the user's needs, the University of Hafr Al-Batin is not responsible for any content on those websites, nor for any person's use of them or their proper functioning, nor for any problems that may arise from their use. The user is responsible for all actions they take while using any of the websites they visit through those links present on this website.
Clause Fourteen: Exercising the Rights of the Personal Data Subject
The personal data subject has the right to request access to / correction of / destruction of their data by contacting the Data Management Office at the University of Hafr Al-Batin at the email: dmo@uhb.edu.sa
Clause Fifteen: Personal Data Protection Officer
Name: Data Management Office at the University of Hafr Al-Batin.
Email: dmo@uhb.edu.sa
Clause Sixteen: Complaints and Inquiries
Should there be any complaints or inquiries related to the Privacy Policy or the handling of personal data, contact the platform administration via the official email of the beneficiary entity or the email of the entity providing technical support for the platform.
If no response is received within seven working days, the complaint or inquiry is submitted to the Data Management Office at the University of Hafr Al-Batin (dmo@uhb.edu.sa).
If the issue is not resolved or no response is received within seven working days, it is escalated to the National Data Management Office via the email: (pr@ndmo.gov.sa).
University Address
University of Hafr Al-Batin
Governorate of Hafr Al-Batin – Eastern Province – Kingdom of Saudi Arabia
Website: https://www.uhb.edu.sa/