Privacy Policy

Investment Academy for Training (the “Academy”) is committed to protecting the privacy of the beneficiaries of its services and to treating their personal data confidentially, in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended, and its Implementing Regulations (the “Law”), and the related laws of the Kingdom of Saudi Arabia.

This policy sets out the personal data we collect, its sources, the purposes and legal basis of processing, the parties with whom we may share it, retention periods, protection measures, and your rights as a data subject and how to exercise them.

It applies to the website ia.edu.sa, the learning platform, the Academy’s applications and all its training services, and to everyone who deals with the Academy — trainees, instructors, visitors and guarantor entities. It forms an integral part of the registration form terms and the Regulations and Policies published on the website.

The controller of the personal data covered by this policy is:

Any enquiry or request concerning personal data protection should be addressed to the channels above, marked “Data Protection” in the subject line.

The Academy limits collection to the minimum necessary for the purpose of processing. The categories of data we may collect include:

The Academy does not collect sensitive data, such as health or biometric data, unless you provide it voluntarily for a specific purpose such as substantiating an absence excuse; it is then processed only to the extent necessary for that purpose. The Academy does not use automated face or voice recognition, and visual identity verification or lecture recording does not constitute processing of biometric data.

• Directly from you: when you register, complete forms, contact us, or take part in lectures, activities and assessments.
• Automatically: through your use of the website and platform, via server logs, cookies and similar technologies.
• From third parties: government identity verification services, your employer or guarantor entity when you register through them, payment service providers to confirm transactions, and regulators to the extent required by law.

We process your personal data for the following purposes, on the legal basis stated for each:

The Academy does not sell or rent your personal data to anyone. We may share your data, to the extent necessary for the purpose, with the following categories:

Processors are contractually bound to process data on the Academy’s instructions, to protect it to a standard no lower than that required by the Law, and not to use it for their own purposes.

Data is stored with hosting providers contracted by the Academy. Some data may be processed by providers outside the Kingdom, including in connection with virtual classrooms, messaging, accounting systems, hosting and analytics. Any such transfer is made only in accordance with the provisions and controls of the Law, its Implementing Regulations and the Regulation on Personal Data Transfer outside the Kingdom, limited to the minimum data necessary, and with appropriate safeguards ensuring a level of protection no lower than that required by law.

• We send marketing messages about programs and offers only with your consent, by email, SMS or WhatsApp Business.
• You may unsubscribe at any time through the unsubscribe link in the message, by replying to a WhatsApp message, or through the official channels; your request is actioned without delay.
• Unsubscribing does not affect essential academic and operational notifications about your program, such as lecture and examination dates and payments.

The website uses cookies and similar technologies for the following purposes:

We retain personal data for as long as necessary to fulfil the purpose of collection and as required by law, as follows:

• Academic records and certificates: retained for the period required by the regulators’ instructions on keeping trainee files, and to evidence qualifications and verify issued certificates.
• Financial records and invoices: retained for no less than the periods required by commercial and tax laws.
• Account and contact data: for the duration of the relationship with the Academy, then for the period needed to settle any obligations or claims.
• Lecture recordings: for the period they are made available to trainees under the program policy, then deleted or archived.
• Marketing data: until consent is withdrawn or you unsubscribe.
• Technical and audit logs: for the period necessary for security, audit and incident investigation under the approved information security controls.

At the end of the retention period data is securely destroyed or anonymized so that it can no longer be linked to the data subject.

• Encrypted communication between beneficiaries and the Academy’s systems, and protection of the website and platform against common attacks.
• Permission-based access controls so that data is accessed only by those whose duties require it, with access and change logging.
• One-time code verification at login and electronic signature, and session restrictions.
• Periodic backups, a service recovery plan and continuous system monitoring.
• Confidentiality obligations on staff and processors, and training on data protection requirements.
• In the event of an incident affecting personal data, the Saudi Data and Artificial Intelligence Authority and affected data subjects are notified within the periods and in the manner prescribed by the Law and its Implementing Regulations.

The Law guarantees you the following rights, and the Academy undertakes to enable you to exercise them:

The Academy’s services are intended for persons aged eighteen and above. In programs where the regulator permits admission of younger persons, guardian consent is required and must be submitted with the registration form, and the guardian exercises the data subject rights on their behalf.

The website may contain links to external websites or services, such as regulators’ platforms, payment gateways and social media platforms. Those websites are governed by their own privacy policies; the Academy is not responsible for their practices or content, and we recommend reviewing their policies before providing them with any data.

• We may update this policy when laws or our services change; the version number and last update date are shown at the top of the page.
• Amendments are published on this page before they take effect, and registered beneficiaries are notified of material amendments by email or platform notification.
• The Arabic text of this policy prevails in case of any discrepancy with its translation.

For any enquiry, request or complaint concerning this policy or the processing of your personal data, contact us through the official channels:

We review and respond to complaints under the Complaints and Grievances Mechanism (IA-POL-08) published in the Regulations and Policies. In all cases you have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent personal data protection authority, in accordance with its procedures.