What applies today
At this stage the site is a design preview: there is no registration form, no live payment gateway, and we collect no personal data from you through these pages. What follows describes what we will collect and how we will treat it once registration and payment open. We will update the date on this page when that happens.
Who is responsible for your data
Asmaa Al-Nujoom Training Academy, Commercial Registration 1010968848, based in Riyadh, Kingdom of Saudi Arabia, is the controller of your personal data — the party that decides why it is collected and how it is processed, and the party answerable to you for it.
What we collect
We collect only what running the training actually requires. This list is complete — there is no open-ended clause at the end of it.
Registration details
When you register for a course we ask for four fields, all of them required. Your full name, because it is printed on your certificate. Your email, because it is how you sign in and how your receipt reaches you. Your mobile number, because it is how we add you to your cohort's group and reach you if a session moves. And your country, because it sets the currency and the session times. Any field beyond these four will be optional and clearly marked as such when we ask for it.
Payment data
We never see your card number, never store it, and it never passes through our servers. Payment happens on the page of a payment gateway licensed by the Saudi Central Bank [to be completed: payment provider name], and you enter your card details with them, not with us. Four things come back to us: whether the payment succeeded, the amount, the currency, and a reference number. That is everything we keep about your payment.
Your learning data
Once you join a course we record the lessons you complete, your attendance, your quiz attempts and scores, and your certificate with its serial and verification code. This data is seen by your cohort's instructor — for their own cohort only — and by academy administration. By no one else.
Technical data
Like any website, our servers log the internet address you visit from, your browser type, and request times, for two purposes: site security and fault diagnosis. We use no advertising trackers, we build no interest profile of you, and we sell your data to no one.
The lawful basis for processing
Each kind of data rests on one clear lawful basis. There are four:
Performance of a contract
Your name, email, mobile and country, and your learning record, attendance, scores and certificate: we process these because we cannot deliver the training you signed up for without them. We do not ask for your consent to them, because they are not an extra alongside the course — they are the course.
Consent
Joining the WhatsApp group, subscribing to marketing emails, and publishing your course review under your name: each of these rests on your consent, asked for separately rather than buried inside registration, and withdrawable at any time without affecting your enrolment or your certificate.
Legal obligation
Some data we keep because the law requires it, not because we want it: invoices and financial records specifically, as required by the Zakat, Tax and Customs Authority.
Legitimate interest
Security logs, fraud prevention, and linking your registration to the marketing campaign it came from rest on our legitimate interest, after a written balancing of that interest against your privacy. You may object by writing to us. We never use this basis for sensitive data — Saudi law does not allow it.
The one cookie we set
If you reach us through a marketing campaign link that carries a campaign code in its address, we store that code — the code alone — in a first-party cookie for 30 days. It has a single purpose: so the campaign partner who referred you gets credited for your registration. The cookie holds no name, no email, no phone number and no browsing history, it does not follow you off this site, and it reaches no third party. Deleting it from your browser cancels its effect immediately, does not stop you registering, and does not change the price you pay.
Visit measurement
We use a visit-measurement service from our hosting provider that works without cookies and without any identifier that follows you between sites. It records which page you visited, from which country, and what kind of device, in aggregate — it cannot tell us who you are and cannot link one visit of yours to another. That is why this site shows no cookie consent banner: there is nothing to consent to. We use no advertising tracker and send your data to no ad network. The certificate verification page is specifically excluded: the verification code is never sent to the measurement service, because it is the equivalent of that certificate's password.
WhatsApp groups — please read this part
Every cohort has a WhatsApp group, and it is the heart of what the academy is: a community you stay in after you graduate. But know this before you agree: when you join, your mobile number, your WhatsApp display name and your profile photo become visible to every member of that group — the instructor and your fellow trainees — and we cannot hide them from each other. Joining is entirely optional, affects neither your course nor your certificate, and you can leave the group at any time. The group runs inside WhatsApp, owned by Meta, so what happens inside it is governed by WhatsApp's own privacy policy, not by this one.
Who else sees your data
We do not sell, rent or trade your data. It is seen by: academy staff who need it for their work and only as much as they need; your cohort's instructor, for their own cohort only; and service providers we contract with, under contracts that bind them to process it on our behalf alone and forbid them from using it for themselves — namely our site host, our database host, our email provider, the payment gateway, and the video platform that hosts recorded lessons [to be completed: names of the providers actually contracted]. We may also disclose to a court or a regulator where the law compels us, and we will tell you when that happens unless we are forbidden from telling you.
Transfers outside the Kingdom
Some of the service providers we rely on have servers outside the Kingdom, which means your data may be stored or processed outside it [to be completed: the countries our servers are hosted in]. The Personal Data Protection Law permits this on conditions we follow: transferring the minimum data needed, assessing the risk of the transfer beforehand, and relying on the standard contractual clauses issued by the Saudi Data and Artificial Intelligence Authority (SDAIA) where they are required. And if you are a trainee outside the Kingdom — in an Arab or African country — your data is processed in the Kingdom and at our providers' locations, and this policy governs it wherever it sits.
How long we keep it
We delete what we no longer need. The marketing cookie: after 30 days. A registration that was never paid for: after 12 months. Your learning record, attendance and scores: 5 years after the course ends, because they are the basis of your certificate. Your certificate record and its verification code: for as long as the certificate remains verifiable. Invoices and financial records: for the period the Zakat, Tax and Customs Authority requires of us, at least 6 years. Server logs: after 12 months. When any period ends we delete the data or strip it of everything that points to you, irreversibly.
Your rights over your data
The Saudi Personal Data Protection Law gives you five rights: to be informed of what we collect, why, and on what basis — this page is how we meet that one; to access the data we hold about you; to receive a copy of it in a clear, readable format; to correct anything wrong, incomplete or out of date; and to request its destruction once we no longer need it. One honest caveat: the right to destruction is not absolute. If the law requires us to keep your invoice, or your certificate has to remain verifiable, we will delete what we can and tell you plainly what remains and why. And unlike the European regulation, Saudi law sets out no general right to object to or restrict processing — even so, we will accept your objection, consider it and answer you.
How to use your rights
Send your request to asmaasafwa6@gmail.com with the word Privacy in the subject line. We may ask you to prove your identity, so that we do not hand your data to someone else. We answer within 30 days, and if your request takes unusual effort we may extend that by a further 30 days, telling you why before the first period ends. There is no charge. If our answer does not satisfy you, or no answer arrives, you have the right to complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) through its national data governance platform, within 90 days of becoming aware of the violation.
Withdrawing consent
Anything we based on your consent, you can withdraw as easily as you gave it: the unsubscribe link at the foot of every marketing email, leaving the WhatsApp group, or one message to us. Withdrawal stops the use from that moment on. It does not undo what was lawful before it, and it does not touch your course or your certificate.
How we protect it
The connection to the site is fully encrypted. The database is restricted row by row, so your account cannot read anyone else's rows even if the code gets something wrong. Signing in uses a link sent to your email rather than a password that can leak or be reused elsewhere. Staff permissions are limited to what each role needs. Even so, no system is impregnable, and we will not claim otherwise.
If there is a breach
If your data is leaked or accessed without authorisation, we notify the Saudi Data and Artificial Intelligence Authority within 72 hours of becoming aware of it, and we notify you without delay if the breach affects your data or your rights: what happened, what we are doing, and what we advise you to do.
Trainees under 18
Registration at the academy is for those aged 18 and over. Anyone younger does not register themselves: their guardian registers using the guardian's own details, confirms they are consenting on behalf of their son or daughter, and we may ask for proof of guardianship. Note also that Family and child is one of our training fields, but the training in it is aimed at adults — parents, teachers and specialists — not at children themselves, and we collect no data about our trainees' children. If we find that an account was created for a minor without their guardian's consent, we suspend it and delete the data.
The messages we send you
There are two kinds and no others. Operational messages, which cannot be switched off while you are enrolled because they are part of the service: registration confirmation, the receipt, your sign-in link, the reminder before your cohort starts, and your certificate. And marketing messages about new courses, which reach you only if you explicitly chose them, each carrying an unsubscribe link at the foot that works immediately, free of charge, and without questions.
Automated decisions
Quizzes are graded automatically: your answers are compared against a fixed answer key, with no personality analysis and no inferences drawn about you. Certificates are issued automatically once the conditions are met. If you believe an automatic grade treated you unfairly, ask for a human review and we will review it. Beyond that we make no automated decisions about you and build no models that predict your behaviour.
Changes to this policy
If we change something substantive — new data we collect, a new purpose, or a new provider who sees it — we change the last-updated date at the top of this page and email every registered trainee at least fourteen days before the change takes effect. For wording fixes and clarifications we simply update the date. We keep previous versions and will send any of them to anyone who asks.
Any question about your privacy
Write to asmaasafwa6@gmail.com, or call +966545299405, Sunday to Thursday, 9am to 5pm Riyadh time. We have not appointed a data protection officer, because our activity does not meet the law's mandatory appointment criteria; the person responsible for privacy requests is [to be completed: name and role].