Privacy policy

The privacy of our trainers and trainees matters greatly to us, and we are fully committed to protecting it. We do not disclose any of your personal information to a third party except for lawful requests from the competent authorities under the laws of the Kingdom of Saudi Arabia, or to the service providers described in this policy to the extent needed to run the platform.

We keep the data you provide when you create an account or enrol in a course, and use it only to manage your enrolment and deliver the training service to you.

General registration data: when you register through the site we collect your name in Arabic and English, your national ID or resident ID (iqama) — a 10-digit number — your mobile number, your email, and the course you are interested in. These requests are stored so they can be followed up and converted into an actual enrolment.

Affiliate application data: when you apply as an affiliate marketer we collect — in addition to your personal details — your bank name and IBAN, in order to pay out the commissions due to you. This banking data is treated in strict confidence and is used only to pay your earnings.

Contact and enquiry data: when you send a message through the "Contact us" form we store your name, mobile number, email (if provided), and the text of your message in order to answer and follow up on your enquiry.

Identity and sign-in data: you sign in with your email and a password that is stored only as a one-way hash by our authentication provider, with email ownership confirmed via an activation link. Your national ID or iqama is used to prevent duplicate records and to verify trainee identity when certificates are issued.

Training data: we keep records of your course enrolments, attendance, exam scores, and certificates to manage your learning journey and to issue and verify your certificates.

We collect and keep your data for specific operational purposes: to complete your registration and manage your enrolment; to deliver the training service, track your attendance, and issue your certificates; to process payments and pay out commissions; and to communicate with you about your services and answer your enquiries. We do not use your data for anything beyond your courses and services with the center, and we do not sell it to any third party.

We handle all payments and financial information with complete confidentiality and keep them strictly private. Card payments are processed through a third-party payment gateway, which is the party that handles your card details directly; we do not store your full card number or its verification details on our systems. We keep the invoice and payment records associated with your account for accounting and regulatory-compliance purposes.

We review and periodically update our privacy policy and procedures to ensure your data stays protected.

We rely on trusted service providers to operate the platform, and we share only the data necessary for them to perform their service, under their obligation to keep it confidential:

Hosting and database: your data and our platform are hosted with a cloud infrastructure provider (Supabase) that handles data storage and authentication.

Email provider: we use an email service provider to send account activation, password-reset, and course-related notification messages to your registered email address.

Payment gateway: an electronic payment-gateway provider securely processes card payments.

Email: we may use an email service provider to send notifications and messages related to your account and courses.

TODO(client): confirm the final trade names of the SMS, payment-gateway, and email providers and list them here before publishing.

We retain your personal data for as long as needed to provide our services to you and while your account remains active, and thereafter for the period required by the applicable laws of the Kingdom of Saudi Arabia (such as accounting and regulatory requirements relating to invoices and payments). Once the purpose of retention and the statutory periods have ended, we delete your data or anonymise it.

TODO(client): define the specific retention periods for each data type (account data, financial records, contact requests) and list them here.

In accordance with the applicable data-protection laws of the Kingdom of Saudi Arabia, you have the right to access your personal data and request its correction or update, and to request its deletion within the limits the laws allow. To exercise any of these rights, contact us using the details below.

For any question or request regarding the privacy of your data, you can reach us by email at info@cstc.edu.sa or through the "Contact us" page, and we will respond to your request as soon as possible.

TODO(client): add the data protection officer's details (name / dedicated email) if one is appointed.