Regional Data Notice

This text is a draft for review by counsel before launch.

What this notice is for

This notice adds to the privacy notice for learners in different parts of the world. aali teaches in Arabic and English and welcomes learners from the Gulf, the wider Arab world and beyond. The law on personal data differs from one country to another, so here we explain how we apply the privacy notice according to where you live.

Learners in the Gulf and the Arab region

Most of our learners are here. We handle your data under the personal data protection rules that apply where you live and where we operate. In practice:

• we tell you what we collect and why before we collect it;
• we ask for your consent where the rules require it, and let you withdraw it;
• we keep your data no longer than needed;
• we let you see, correct and delete your data, and reply in your language, Arabic or English;
• we tell you and the competent authority if a serious breach occurs.

[Applicable regional rules, authority and any registration: to be confirmed after legal review]

Learners in the European Economic Area and the United Kingdom

If you live there, the data protection rules of that region protect you, and the rights in the privacy notice apply as those rules describe them. If we are required to have a local representative, we will name one here [local representative: to be confirmed]. You may complain to the data protection authority of your country.

Learners elsewhere

If you live in another country, we apply the rules of your country where they give you more protection than we describe, and the privacy notice in every other case.

Where your data is kept

Our main systems and those of our providers are hosted in [hosting region: to be confirmed]. Some providers, such as those that send email or manage support requests, may be in other countries. We choose providers that commit by contract to protect data to the standard we set.

Moving data across borders

When data leaves your country, we rely on a lawful way to protect it: contract terms approved for that purpose, a finding that the destination gives adequate protection, or your explicit consent to a specific transfer [methods we rely on: to be confirmed]. You may ask us to describe the safeguards that apply.

Payments and currency

Payments are in Saudi riyals unless the course page says otherwise [currency: draft]. Card details go straight to our payment provider, which may be in a different country.

How we decide which rules fit you

We rely on the country of residence you gave in your account, not on where you happen to be while travelling. If you move to another country, update your account so that we apply the right rules. If you are unsure, ask us.

Requests from authorities

We answer only a valid written request from a competent authority, give no more than the request requires, and tell you about it unless the law forbids us.

How to use your rights

The way is the same wherever you live: open your account page or write to us through the contact page, and say what you ask for. We check your identity in a way that suits the request, reply in Arabic or English, and if we need longer than the law of your country allows, we tell you why before the time runs out.

Sensitive data

We do not ask for your religion, your health or your affiliations. If you ask for support because of a disability or a health condition, we treat what you give with extra care: as few staff as possible see it, and it does not appear in your study record. The rules of your country may require explicit consent for this, and then we ask for it.

Marketing messages

We send our news only with your consent where the rules require it, and in practice we do that everywhere to keep things simple. You can unsubscribe at any time from the message itself, and it does not affect your study.

Age

The minimum age to enrol is 18 everywhere, even if the law of your country would allow less.

Keeping data longer where the law requires

The laws of some countries require payment and invoice records to be kept for a set period. We comply, use what we keep only for that purpose, and delete it when the period ends.

Language and meaning

This notice and the privacy notice exist in Arabic and English with the same meaning. If you find a difference in meaning, tell us. The version that prevails if they conflict: [to be confirmed].

Organisations in other countries

When an organisation abroad enrols its team at aali, we receive limited data about the people in it. The organisation must tell you and must have the right to give us the data. We handle it under the privacy notice and this one.

Regional contacts

• Data protection contact: [to be confirmed].
• Local representative, where required: [to be confirmed].
• Complaints: to the competent data protection authority where you live.

Changes

We may update this notice when the rules or our services change, and show the date of the latest update at its top.