Terms, Conditions and Policies

KSU Aamal is an electronic platform owned by King Saud University and designated for displaying and providing consulting, professional, technical, research, and training services, as well as other paid or unpaid services approved by the University.

The services are provided by King Saud University, represented by [specify the entity responsible for owning or operating the Platform within the University], hereinafter referred to as the “University” or the “Service Provider.”

KSU Aamal does not have a legal personality separate from King Saud University. Any reference in these Terms to the rights or obligations of the Platform shall be construed as a reference to the rights or obligations of the University, as applicable.

For the purposes of these Terms, the following words and expressions shall have the meanings assigned to them below, unless the context otherwise requires:

1. Platform: KSU Aamal website or application and all pages, systems, and digital services associated with it.
2. University or Service Provider: King Saud University, represented by the entity responsible for operating the Platform or providing the relevant Service.
3. User: Any natural person or authorized representative of a legal person who accesses the Platform, creates an Account, or uses any of its functions.
4. Beneficiary: Any natural or legal person who requests or receives a Service offered through the Platform.
5. Consumer: Any person who qualifies as a consumer under the laws and regulations in force in the Kingdom of Saudi Arabia.
6. Services: Consulting, professional, technical, and research services; live, recorded, or interactive training programs; and any other services approved by the University and offered through the Platform.
7. Service Provider Professional: Any person who is qualified or licensed, where licensing is legally required, and who is assigned by the University to provide a consultation, training program, or professional Service.
8. Service Description: The specific information and terms published on the relevant Service page, including its scope, fees, duration, schedule, deliverables, and requirements.
9. Order: An electronic request submitted by the User through the Platform to obtain a Service.
10. Separate Agreement: Any contract, technical or financial proposal, work order, or separate document approved by the University and the Beneficiary to govern a specific Service.
11. Content: All texts, audiovisual materials, recordings, training materials, designs, logos, programs, templates, and other materials made available through the Platform.
12. Privacy Policy: The policy governing the Processing of Personal Data, as approved and published on the Platform.
13. Cancellation and Refund Policy: The document governing the cancellation of Services and the refund of amounts paid.

1. These Terms govern the use of the Platform and the general provisions applicable to Services requested through it.
2. Certain Services may be subject to special terms, a detailed Service Description, a technical and financial proposal, or a Separate Agreement. The User must review and accept such documents before completing the relevant Order.
3. In the event of any conflict, the following order of precedence shall apply:
   • The Separate Agreement or approved proposal governing the Service
   • The special terms set out in the Service Description.
   • The Cancellation and Refund Policy with respect to cancellations and refunds.
   • These General Terms and Conditions.
   • General information published on the Platform.
4. Nothing in these Terms shall be construed as limiting or excluding any mandatory rights granted to a Consumer or Beneficiary under applicable laws and regulations.

1. Browsing the Platform and using its general functions shall be subject to the provisions governing acceptable use, intellectual property, protection of technical systems, and the Privacy Policy.
2. The User shall be bound by these Terms upon creating an Account, selecting the electronic acceptance box, submitting an Order, or completing a payment, depending on the applicable User journey.
3. Merely browsing the Platform shall not constitute acceptance of a contract for a paid Service. A Service contract shall only be formed in accordance with Article 7 of these Terms.
4. The User acknowledges having reviewed the effective version of these Terms, the Privacy Policy, the Cancellation and Refund Policy, and the relevant Service Description before completing the Order.
5. The University shall maintain an electronic record identifying the version of the Terms accepted by the User and the date and method of acceptance, in accordance with applicable laws and regulations.

1. The User must have the legal capacity required to enter into the transaction relating to the requested Service.
2. A person lacking full or partial legal capacity may not request a Service except through their legal guardian or duly authorized representative and after satisfying all applicable legal requirements.
3. Where a person uses the Platform on behalf of a government entity, private entity, or nonprofit organization, that person represents that they possess the necessary authority or authorization to represent that entity, submit the Order, and accept its terms.
4. The University may request evidence of identity, legal capacity, representative authority, or authorization before accepting the Order or during its performance.
5. The User shall be responsible for the accuracy of any statement concerning their capacity or authority, without prejudice to the University’s obligation to conduct verification where required by law or by the nature of the Service.

1. The User shall provide accurate, complete, and up-to-date information when creating an Account and shall update such information whenever it changes.
2. An Account is personal and may not be transferred or made available to another person unless the Platform allows entity Accounts with designated authorized Users and specific access permissions.
3. The User shall maintain the confidentiality of their login credentials and take reasonable precautions to prevent unauthorized use.
4. The Platform must be notified immediately through its approved communication channels if the User becomes aware that their login credentials have been lost, compromised, or used without authorization.
5. The University shall not be responsible for transactions completed before it receives actual notice of unauthorized use, unless such use resulted from an act or omission attributable to the University or a person acting on its behalf.
6. Users are prohibited from creating multiple Accounts to circumvent usage restrictions, benefit limits, or promotional conditions.
7. The University may temporarily suspend an Account where it has reasonable grounds to suspect that the Account has been compromised or used unlawfully. The University shall take appropriate steps to verify the matter and restore the Account once the reason for suspension has ceased.

1. Depending on the nature of the Service, each Service page shall specify:
   • The essential characteristics and scope of the Service.
   • The target audience and any prerequisites.
   • The applicable fees, taxes, and additional charges, if any.
   • The period or scheduled date for providing the Service.
   • The deliverables to be received by the Beneficiary.
   • Attendance, access, performance, or delivery requirements.
   • Cancellation and refund conditions.
   • Technical requirements or required documents.
   • Whether the Service requires a Separate Agreement or proposal.
2. Submission of an Order by a User shall constitute an offer by that User to obtain the Service in accordance with the selected details. Displaying a Service on the Platform shall not, by itself, constitute final acceptance by the University.
3. A Service contract shall only be formed after:
   • The Order satisfies the applicable requirements.
   • The University accepts the Order.
   • Payment is completed where advance payment is required.
   • An electronic confirmation of acceptance or commencement of the Service is sent to the User.
4. The reservation or authorization of an amount, or the issuance of a notification by a payment gateway, shall not constitute acceptance of the Order unless the Platform sends a confirmation of acceptance.
5. Before accepting an Order, the University may request additional information or documents or may reject the Order if the Service cannot be provided, the requirements have not been satisfied, a conflict of interest or professional or legal impediment exists, or material information is found to be inaccurate.
6. Where an Order is rejected after payment has been collected, the amount paid shall be refunded in accordance with the Cancellation and Refund Policy, unless an amount has become payable for a portion of the Service performed with the Beneficiary’s approval and in accordance with applicable law.
7. The User shall receive an electronic confirmation containing a summary of the Order, the Service fee, the payment method, the performance terms, and the relevant communication channels.

1. Prices shall be displayed in Saudi Riyals unless another currency is clearly specified.
2. Before payment, the User shall be informed whether the displayed price includes or excludes Value Added Tax and any other applicable fees.
3. The total price displayed on the checkout page shall be the amount payable unless the Service requires a separate technical and financial proposal.
4. Payments shall be processed through payment methods approved by the Platform and shall be subject to the technical and security requirements of the relevant payment service provider.
5. Invoices and financial notices shall be issued in accordance with applicable statutory, tax, and electronic-invoicing requirements.
6. If an obvious technical error occurs in the price or Service Description, the University may correct the error before accepting the Order and notify the User of the correct price. The User may then confirm or cancel the Order.
7. If the Order cannot be performed due to a pricing error discovered after payment but before commencement of the Service, the Beneficiary shall be notified and the amount paid shall be refunded unless the Beneficiary expressly accepts the corrected price.
8. The Beneficiary shall bear any banking charges or currency-conversion costs imposed by their bank or financial service provider, unless otherwise stated.

1. The University shall provide an accepted Service in accordance with its approved description and any applicable Separate Agreement, through persons holding the qualifications or licenses required by the nature of the Service.
2. The Service shall be based on the information and documents provided by the Beneficiary. The Beneficiary shall disclose all material information accurately, completely, and in a timely manner.
3. The scope, period, or price of the Service may be amended by agreement between the parties where additional requirements arise that were not included in the original scope.
4. The University shall not be required to perform any work or provide any deliverable that is not included in the Service Description, proposal, or Separate Agreement.
5. The Beneficiary shall cooperate, provide the required information and documents, and respond to inquiries within the specified periods. The performance period may be extended by a period corresponding to any delay attributable to the Beneficiary, or performance may be suspended until the requirements are satisfied.
6. The University does not guarantee any particular outcome that is beyond its reasonable control or dependent on the decision of another party. The University shall perform the Service within its agreed scope and with the required professional standard of care.
7. The University may engage specialists or supporting entities to assist in providing the Service, subject to applicable confidentiality and Personal Data protection requirements.

1. A consultation shall be provided on the basis of the facts, information, and documents available at the time of its preparation and within the agreed scope.
2. The Beneficiary shall explain the purpose of the consultation and disclose all facts that may materially affect it. The University shall not be responsible for the consequences of concealed material information or inaccurate or incomplete data.
3. A consultation shall not extend to any subject, jurisdiction, or period outside its agreed scope and shall not constitute ongoing advice or an obligation to provide updates after delivery unless expressly agreed otherwise.
4. A consultation does not guarantee any particular decision, judgment, approval, or outcome from a government, judicial, regulatory, financial, or professional authority.
5. The Beneficiary remains responsible for making their final decision, provided that this responsibility shall not relieve the University or the Service Provider Professional of their contractual or professional obligations.
6. The University shall not be responsible for monitoring statutory, judicial, tax, regulatory, or professional deadlines applicable to the Beneficiary unless the agreed scope expressly includes such monitoring.
7. Medical consultation services offered through the Platform must not be used in emergency situations and shall not replace a physical examination or an in-person visit to a healthcare provider where required by the circumstances.
8. A consultation may be rejected or discontinued where a conflict of interest, legal or professional impediment, or unlawful purpose is identified. Any amount paid adjustment shall be handled in accordance with the Cancellation and Refund Policy.
9. Consultation sessions may not be recorded, photographed, or published without the prior written consent of the University, the Service Provider Professional, and all other relevant persons.

1. Each training program shall be governed by its published description, including its schedule, duration, delivery method, attendance requirements, assessment criteria, and certificate requirements.
2. The trainee shall be responsible for providing the devices, internet connection, and other technical requirements specified in the program description.
3. A User may not permit another person to attend the program, access the Content, or complete assessments in the User’s name unless substitution is permitted under the program terms and approved in advance.
4. Attendance or completion certificates shall only be issued after the applicable attendance percentage and other program requirements have been satisfied.
5. The University may change the trainer, schedule, or delivery method for organizational reasons, provided that the change does not materially impair the substance of the Service and that registered trainees are notified within a reasonable period.
6. If the University cancels a program or reschedules it to a time unsuitable for the Beneficiary, the Beneficiary may choose between attending on the alternative date or receiving a refund in accordance with the Cancellation and Refund Policy.
7. Training programs may not be recorded, rebroadcast, reproduced, or shared with third parties without prior written authorization.

1. Cancellation and refund requests shall be governed by the Cancellation and Refund Policy published on the Platform and the special terms applicable to the relevant Service.
2. The applicable cancellation and refund conditions must be presented to the Beneficiary before payment is completed.
3. Eligibility for a refund shall depend on the nature of the Service, the time at which cancellation is requested, whether performance has commenced, whether the Beneficiary has used or benefited from the Service, and whether specific resources have been reserved for its performance.
4. Nothing in this Article shall prejudice any mandatory rights granted to Consumers under the Electronic Commerce Law or other applicable laws and regulations.
5. Once approved, a refund shall be returned to the original payment method where practicable and within the period specified in the Cancellation and Refund Policy. The time required for the refund to appear may be affected by the procedures of the relevant bank or payment service provider.
6. Where a full or partial refund is made, the applicable tax treatment and credit notes shall be processed in accordance with the relevant laws and regulations.

1. Intellectual Property Rights in the Platform and its Content belong to King Saud University or to the relevant rights holders who have authorized the University to use such Content, as applicable.
2. Use of the Platform or purchase of a Service shall not transfer ownership of any Content or Intellectual Property Rights to the User unless a Separate Agreement expressly provides otherwise.
3. The User is granted a limited, non-exclusive, non-transferable, and non-sublicensable license to use the Content made available to them solely for the purposes and period specified in the relevant Service Description.
4. Without prior written authorization, Users may not:
   • Copy, reproduce, or modify the Content.
   • Record, photograph, or rebroadcast the Content.
   • Publish, share, or otherwise make the Content available to third parties.
   • Use the Content for independent commercial or training purposes.
   • Remove proprietary notices or watermarks.
   • Use the University’s or the Platform’s names or logos in a manner suggesting sponsorship or endorsement where none exists.
5. Ownership and permitted use of the deliverables of consultations, studies, or works specifically prepared for a Beneficiary shall be determined in the Service Description, proposal, or Separate Agreement.
6. The User retains their rights in the documents and Content submitted by them and grants the University a limited license to use such documents and Content to the extent necessary to assess the Order, provide the Service, and comply with applicable legal obligations.

The User shall not:

1. Use the Platform or its Services for any unlawful purpose or in breach of applicable laws, regulations, or public morals.
2. Provide false or misleading information or impersonate any person or entity.
3. Use another person’s Account or permit another person to use their Account without authorization.
4. Access the Platform without authorization, test its vulnerabilities, circumvent its security measures, or disrupt its systems.
5. Upload malware, malicious code, or files capable of damaging the Platform or its Users.
6. Collect information relating to Users or Service Provider Professionals or contact them for unauthorized purposes.
7. Infringe Intellectual Property Rights, privacy, confidentiality, or any other rights of the University or third parties.
8. Upload documents or Personal Data relating to third parties without appropriate authority or a lawful basis.
9. Record or rebroadcast consultations or training programs without the necessary authorization.
10. Resell or commercially exploit the Services or Content without prior written approval.
11. Use automated tools to extract Content or data or interfere with the operation of the Platform.

1. The University shall process Personal Data in accordance with the Privacy Policy published on the Platform and applicable laws and regulations.
2. The User must review the Privacy Policy before creating an Account or submitting an Order.
3. The Beneficiary shall not provide Personal Data relating to third parties except to the extent necessary and after verifying the existence of appropriate authority or another lawful basis.
4. Information and documents submitted in connection with consultations shall be subject to applicable statutory, professional, and contractual confidentiality obligations. Disclosure may nevertheless be made to the extent required by law or by a competent authority.
5. Information lawfully available to the public, or lawfully received by the University from an independent source not bound by a confidentiality obligation, shall not be considered confidential unless otherwise required by law or agreement.

1. The University shall use reasonable efforts to make the Platform available and maintain its operational continuity but does not guarantee uninterrupted availability at all times.
2. The Platform may be temporarily suspended for maintenance, updates, or the management of cybersecurity incidents, with prior notice where reasonably practicable.
3. The University shall not be responsible for interruptions resulting from Force Majeure Events or failures in telecommunications networks or third-party services beyond its reasonable control, provided that it takes reasonable measures to mitigate their effects.
4. A technical failure shall not relieve the University of its obligation to provide a paid Service, reschedule it, or refund any amount due where the Service cannot be provided, subject to the nature of the circumstances and the Cancellation and Refund Policy.

1. The University shall perform accepted Services within their agreed scope and with the professional and statutory standard of care required.
2. The University shall not be responsible for consequences arising from:
   • Inaccurate or incomplete information provided by the Beneficiary.
   • Use of the Service for a purpose or within a scope other than that for which it was provided.
   • Modification of the Content or deliverables by the Beneficiary or a third party.
   • A decision made by the Beneficiary contrary to the content of the Service.
   • Acts or decisions of independent entities beyond the University’s control.
3. The University shall not be liable for indirect or consequential losses, loss of opportunity, or anticipated profits, except to the extent that liability cannot lawfully be excluded or limited.
4. No exclusion or limitation of liability shall apply to fraud, gross negligence, a harmful act, or a breach of confidentiality or Personal Data requirements where such exclusion or limitation is prohibited by law.
5. Nothing in this Article shall be construed as relieving the University or a Service Provider Professional of any statutory, contractual, or professional obligation or any liability that may not lawfully be excluded.

The User shall be responsible for direct damage suffered by the University as a result of the User’s unlawful use of the Platform, material breach of these Terms, or infringement of the rights of the University or any third party, where such liability is established in accordance with applicable law.

The University may claim compensation for proven losses and for judicial or professional costs awarded or established as recoverable under applicable law. This provision shall not constitute automatic acknowledgment that any unproven amount is payable.

1. A User may stop using the Platform and request closure of their Account at any time, subject to continuing obligations relating to existing Orders, contracts, and outstanding amounts.
2. The University may suspend an Account or restrict its use where these Terms have been breached, provided that the measure is proportionate to the nature of the breach.
3. An Account may be immediately closed in cases involving fraud, unauthorized access, cybersecurity threats, impersonation, unlawful use, or a serious infringement of the rights of the University or a third party.
4. The User shall be informed of the reason for suspension or closure where reasonably practicable and where such disclosure does not conflict with security or legal requirements.
5. Closure of an Account shall not result in the immediate destruction of all associated Personal Data. The Processing, retention, and destruction of Personal Data shall be governed by the Privacy Policy and applicable legal requirements.
6. Termination of use shall not affect provisions which, by their nature, are intended to survive, including provisions relating to confidentiality, Intellectual Property Rights, liability, and dispute resolution.

1. Neither party shall be liable for delay or failure to perform resulting from circumstances beyond its reasonable control that could not reasonably have been anticipated or prevented, to the extent that such circumstances affect performance.
2. The affected party shall notify the other party within a reasonable period and take practicable measures to mitigate the effects of the Force Majeure Event.
3. If the Force Majeure Event continues and prevents the provision of the Service, amounts paid and unperformed Services shall be handled in accordance with applicable law, the Cancellation and Refund Policy, and the circumstances of each case.

1. The University may develop the Platform or amend or discontinue future Services to meet operational requirements, without prejudice to accepted Orders and existing contracts.
2. These Terms may be amended to reflect legal, regulatory, operational, or technical developments.
3. The version number and effective date shall be stated at the beginning of these Terms. Users shall be notified of material amendments through the Platform, their registered email address, or another appropriate means.
4. Amendments shall apply to use and Orders occurring after their effective date. They shall not apply to Orders accepted before that date where they would reduce the Beneficiary’s rights or increase their obligations, unless the Beneficiary consents or the amendment is required by law.
5. Where an amendment requires express consent, continued use alone shall not constitute such consent, and the Platform shall request new electronic acceptance.

Inquiries, complaints, and technical support requests may be submitted through the following channels:

Responsible Department: (………………………………)

Email Address: (………………………………)

Telephone Number: (………………………………)

Address: King Saud University – (………………………………)

Electronic Complaint Form: (insert link)

Business Hours: (………………………………)

The Platform shall acknowledge receipt of a complaint and shall review and respond to it within [specify the approved period], without prejudice to the Beneficiary’s right to refer the matter to the competent authorities.

Requests relating to Personal Data shall be submitted through the channels and within the periods specified in the Privacy Policy.

1. These Terms and all relationships arising from them shall be governed by the laws and regulations of the Kingdom of Saudi Arabia.
2. The parties shall endeavor to settle amicably any dispute arising from the use of the Platform or provision of a Service within thirty (30) days from the date of written notice of the dispute, unless the nature of the dispute requires a shorter period.
3. Amicable negotiations shall not prevent either party from taking urgent or precautionary measures or complying with applicable statutory limitation periods.
4. If an amicable settlement cannot be reached, the dispute shall be referred to the judicial authority having subject-matter and territorial jurisdiction in the Kingdom of Saudi Arabia, according to the nature of the relationship and dispute and the applicable laws and regulations.

1. If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions shall remain valid and effective. The valid provision that most closely reflects the lawful purpose of the invalid provision shall apply.
2. Any delay or failure by the University to exercise a right shall not constitute a waiver of that right.
3. The User may not assign their rights or obligations arising from an Order or contract to a third party without the University’s prior written approval, unless otherwise required by law.
4. Electronic notices and communications sent to the contact details registered in the Account shall have legal effect in accordance with applicable laws and regulations. The User shall keep such details up to date.
5. These Terms, together with the Service Description, Privacy Policy, Cancellation and Refund Policy, and any Separate Agreement, constitute the documents governing the relationship between the parties in accordance with the order of precedence stated in Article 3.
6. Nothing in these Terms shall create an employment, agency, partnership, or joint venture relationship between the University and the User.

These Terms may be made available in both Arabic and English. In the event of any discrepancy or inconsistency between the two versions, the Arabic version shall prevail and constitute the authoritative version, without prejudice to the laws and regulations in force in the Kingdom of Saudi Arabia.

King Saud University is committed to protecting the privacy of beneficiaries and safeguarding their Personal Data when they use KSU Aamal and its related services, in accordance with the Saudi Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended by Royal Decree No. (M/148) dated 5/9/1444H, its Implementing Regulations, the Regulation on Personal Data Transfer Outside the Kingdom, and the applicable national data management and cybersecurity policies and controls.

King Saud University is the “Controller” of the Personal Data for which it determines the purposes and means of Processing through the Platform. KSU Aamal Platform is operated by [specify the operating entity within the University].

This Policy explains the Personal Data collected through the Platform, the methods and sources of collection, the purposes and legal bases of Processing, the parties to whom the data may be disclosed, the applicable retention periods, and the rights of Data Subjects and how such rights may be exercised.

Merely viewing this Policy or using the Platform shall not constitute consent to any Processing activity for which separate consent is required by law. Where consent is relied upon as a legal basis, the Platform shall obtain such consent separately and expressly in accordance with the applicable legal requirements.

This Policy applies to the Processing of Personal Data relating to individuals who use the Platform, create accounts, submit requests for services, consultations, or training programs, or otherwise communicate with the Platform.

Where information relates to a government entity, company, or other organization, this Policy applies to the Personal Data of its representatives, employees, and other natural persons associated with it.

This Policy does not apply to external websites or services that may be accessed through separate links available on the Platform. The Processing of Personal Data through such websites or services is governed by their respective privacy policies.

Depending on the nature of the requested service, the Platform may collect the following categories of Personal Data:

1. Identity Data: such as full name, nationality, national identification or residency permit number, and date of birth, where necessary.
2. Contact Data: such as mobile number, email address, and address.
3. Account and Authentication Data: such as username, identity-verification information, account preferences, and login records. Password-related information shall be protected using appropriate security measures and shall not be accessible to Platform personnel in readable form.
4. Professional and Educational Data: such as job title, employer, qualifications, and professional experience, where required for the relevant service.
5. Request and Transaction Data: such as the services or programs for which the beneficiary has registered, appointments, correspondence, request status, and any contracts, quotations, or work orders associated with the requested service.
6. Payment and Billing Data: such as transaction amount, transaction reference number, payment status, and invoice details. Bank card details are processed through approved payment service providers, and the Platform does not store complete bank card details unless expressly stated otherwise.
7. Consultation and Submitted Content Data: such as questions, documents, and information submitted by the beneficiary in connection with a service request. Depending on the nature of the request, such content may include Personal Data relating to other individuals or Sensitive Personal Data.
8. Training Program Data: such as attendance, participation, assessments, tests, and certificate information.
9. Technical and Usage Data: such as Internet Protocol address, device type, operating system, browser type, login times, pages accessed, and technical and security logs.
10. Cookies and Similar Technologies: as described in Article 11 of this Policy.

The Platform may collect Personal Data through one or more of the following methods:

1. Directly from the Data Subject when creating an account, completing electronic forms, purchasing a service, uploading documents, or communicating with the Platform.
2. Automatically when the Platform is used, through system logs, cookies, analytics technologies, and technical security tools.
3. From entities or systems integrated with the Platform, such as identity-verification services, payment gateways, or the entity represented by the User, to the extent permitted by the applicable legal basis and the specified purpose of Processing.
4. From other lawful or publicly available sources, where permitted under applicable law.

At or before the point of collection, the Platform shall indicate whether the provision of particular Personal Data is mandatory or optional. Failure to provide mandatory Personal Data may prevent the creation of an account, completion of a request, issuance of an invoice, or provision of the requested service.

Personal Data may be processed for the following purposes:

1. Creating and managing accounts and verifying the identity of Users and their authority to represent the entities on whose behalf they are acting.
2. Receiving, reviewing, accepting, performing, and following up on requests for services, consultations, and training programs.
3. Managing registration, attendance, examinations, assessments, and the issuance of certificates.
4. Preparing quotations, contracts, work orders, and deliverables relating to the requested service.
5. Processing payments, issuing invoices and financial notices, and administering cancellations and refunds.
6. Communicating with Users regarding their accounts, requests, appointments, or service-related updates.
7. Responding to inquiries, complaints, and requests to exercise Data Subject rights.
8. Evaluating service quality, measuring beneficiary satisfaction, and improving the performance of the Platform, using the minimum Personal Data necessary or using aggregated or anonymized data whenever practicable.
9. Protecting the Platform and User accounts, detecting fraudulent or unauthorized access attempts, and investigating technical or cybersecurity incidents.
10. Complying with applicable statutory, regulatory, financial, tax, oversight, and judicial requirements.
11. Sending marketing or informational communications where the required consent has been obtained, while providing a clear mechanism to unsubscribe.

Personal Data shall not be used for any purpose that is incompatible with the purpose for which it was collected unless the applicable legal basis and statutory requirements have first been satisfied and the Data Subject has been notified where required.

Depending on the relevant purpose, the Processing of Personal Data shall be based on one or more of the following legal bases:

1. Performance of an agreement to which the Data Subject is a party, including taking necessary steps at the Data Subject’s request before entering into such agreement and providing the requested service.
2. Compliance with an obligation or requirement imposed by applicable laws, regulations, or official instructions.
3. The achievement of a specific public interest connected with the statutory functions and responsibilities of King Saud University, subject to the applicable legal requirements.
4. The Data Subject’s consent in relation to optional Processing activities that require consent, such as direct marketing and certain non-essential cookies.
5. Satisfaction of security or judicial requirements, protection of public health or safety, or preservation of individuals’ vital interests, where permitted under applicable law.

A Data Subject may withdraw their consent at any time. Withdrawal shall not affect the lawfulness of any Processing carried out before the withdrawal or any Processing based on another lawful basis.

The collection of mandatory Personal Data shall be limited to the minimum amount necessary to provide the requested service or satisfy the applicable statutory requirements.

Personal Data used for marketing, non-essential content personalization, voluntary surveys, or non-essential analytics cookies shall be optional. Refusal to provide such data shall not result in the denial of an essential service unless the requested data is inherently necessary for that service.

King Saud University does not sell or lease Personal Data to third parties. The minimum Personal Data necessary may, however, be disclosed to the following categories of recipients:

1. Relevant departments and administrative units within King Saud University where access is necessary to provide the service or process the request.
2. Trainers, consultants, experts, and project teams assigned to provide the relevant service, subject to applicable confidentiality and Personal Data protection obligations and strictly on a need-to-know basis.
3. Providers of hosting, technical support, cloud computing, communications, identity verification, electronic payment, and invoicing services, acting as Processors under documented instructions and appropriate contractual arrangements.
4. Financial or banking entities involved in processing payments and refunds.
5. Competent government, judicial, regulatory, or oversight authorities where disclosure is required or permitted pursuant to a lawful basis.
6. Any other party to whom the Data Subject has validly consented to the disclosure of their Personal Data.

The University shall verify that its Processors provide sufficient guarantees for the protection of Personal Data. Processing agreements shall specify the purposes and duration of Processing, categories of Personal Data, confidentiality and security obligations, incident-management requirements, conditions governing sub-processing, and the return or destruction of Personal Data.

Consultation requests may contain confidential information, Sensitive Personal Data, or Personal Data relating to third parties. Users must not submit Personal Data relating to other individuals unless they have the appropriate authority or lawful basis to do so. In all cases, Users should limit submitted information to the minimum necessary for the requested service.

The Platform may request the redaction of unnecessary information, require the anonymization of individuals, or reject documents containing Personal Data that is not proportionate or relevant to the purpose of the service.

Access to consultation requests and their content shall be restricted to authorized persons and limited to what is necessary to provide the service, without prejudice to any applicable professional, contractual, or statutory confidentiality obligations.

Personal Data shall be stored and processed in [specify the actual location and geographical scope of hosting and Processing before approving this Policy].

Where the provision of a service requires the transfer of Personal Data outside the Kingdom of Saudi Arabia or its disclosure to a party located outside the Kingdom, such transfer or disclosure shall only take place in accordance with the Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom.

The University shall verify the availability of an appropriate level of protection, limit the transfer to the minimum Personal Data necessary, and complete any required risk assessment, safeguards, approvals, or statutory exemptions.

The Platform may use cookies and similar technologies for the following purposes:

1. Strictly Necessary Cookies: to operate the Platform, secure User sessions, enable login functions, and complete service requests.
2. Functional Cookies: to store User preferences and improve functionality.
3. Analytics Cookies: to analyze the use and performance of the Platform.
4. Marketing Cookies: where applicable, to measure marketing campaigns or personalize marketing communications.

Non-essential cookies shall not be activated until the required consent has been obtained. Users may accept, reject, or modify their cookie preferences through the Platform’s cookie-management tool and may also manage cookies through their browser settings.

Disabling strictly necessary cookies may prevent certain Platform functions from operating correctly.

Before the Platform is launched, an up-to-date list of the cookies used, their providers, purposes, and retention periods shall be made available to Users.

The University shall retain Personal Data for as long as necessary to fulfil the purpose for which it was collected or for the period prescribed by applicable laws, regulations, and approved policies, depending on the nature of each category of Personal Data.

Applicable retention periods or the criteria used to determine them shall be documented in an approved retention schedule covering, at a minimum, account data, contracts and service requests, invoices and financial records, consultation content, training records, complaints, and technical logs.

Personal Data shall be destroyed without undue delay when the purpose of its collection has ceased, unless a lawful basis requires its retention for a specified period or the Personal Data is closely connected with an existing claim, investigation, or judicial proceeding.

Personal Data shall be destroyed securely in a manner that prevents its recovery or the identification of the Data Subject. Destruction shall include available copies and backups, subject to applicable technical and statutory requirements.

The University may retain data after it has been irreversibly anonymized so that the relevant individuals can no longer be identified.

The University shall implement appropriate organizational, administrative, and technical measures to protect Personal Data against unauthorized access, use, alteration, disclosure, loss, or destruction, taking into consideration the nature of the Personal Data and the level of associated risk.

Such measures shall be implemented in accordance with the controls issued by the National Cybersecurity Authority and the policies approved by the University.

In the event of a Personal Data breach, the University shall take appropriate containment, investigation, remediation, and risk-mitigation measures and shall notify the Competent Authority and affected Data Subjects in the circumstances and within the periods prescribed by applicable law.

Although no technical environment can be guaranteed to be entirely free from risk, the University remains committed to implementing appropriate safeguards and responding to security incidents in accordance with applicable statutory requirements.

Subject to the applicable statutory conditions and exceptions, Data Subjects shall have the following rights:

1. The right to be informed of the legal basis and purpose for collecting and Processing their Personal Data.
2. The right to access their Personal Data held by the University.
3. The right to request and obtain a copy of their Personal Data in a readable and clear format.
4. The right to request the correction, completion, or updating of their Personal Data.
5. The right to request the destruction of Personal Data that is no longer required, unless a lawful basis requires its continued retention.
6. The right to withdraw consent in relation to Processing activities based on consent.
7. The right to lodge a complaint concerning the application of Personal Data protection requirements.

Requests to exercise Data Subject rights shall be completed within a period not exceeding thirty (30) days from the date on which the completed request is received and the identity of the applicant is verified.

The period may be extended for no more than an additional thirty (30) days in the circumstances permitted under the Implementing Regulations, provided that the Data Subject is notified in advance of the extension and the reasons for it.

Data Subjects may exercise their rights or submit inquiries and complaints through the following channels:

• Responsible Department or Unit: (………………………………)
• University Data Protection Officer: (………………………………)
• Email Address: (………………………………)
• Telephone Number: (………………………………)
• Address: King Saud University, (………………………………)
• Electronic Request Form: (insert link)

To protect Personal Data from unauthorized disclosure, the University may request information necessary to verify the identity of the applicant before processing the request.

If the complaint is not resolved or the Data Subject is dissatisfied with the outcome, the Data Subject may lodge a complaint with the Saudi Data and Artificial Intelligence Authority through the National Data Governance Platform within the period prescribed by law.

Under the Implementing Regulations, a complaint may be lodged within ninety (90) days from the date of the relevant incident or the date on which the Data Subject became aware of it. The Competent Authority may, at its discretion, accept a complaint submitted after this period where factual circumstances prevented its earlier submission.

Personal contact information shall not be used to send marketing materials or promotional offers unless the required consent has been obtained.

A clear and free mechanism shall be provided to enable recipients to unsubscribe from marketing communications at any time.

A User’s decision to unsubscribe from marketing communications shall not affect essential communications relating to their account, requests, transactions, appointments, or the performance of the requested service.

Where any service offered through the Platform is directed at persons lacking full or partial legal capacity, their Personal Data shall not be processed on the basis of consent unless the consent of their legal guardian has been obtained and appropriately verified.

Any such consent and Processing shall be carried out in the best interests of the Data Subject and in a manner that safeguards their statutory rights.

Where the Platform regularly or extensively provides services to such persons, an appropriately simplified privacy notice shall be prepared and made available in language suitable for the relevant audience.

The University shall periodically review this Policy. The version number, effective date, and date of the latest update shall be stated at the beginning of the Policy.

Users shall be notified of material amendments through the Platform, their registered email address, or any other appropriate means.

Where an amendment introduces a new purpose of Processing or requires a new legal basis or consent, the relevant Processing shall not commence until the applicable legal requirements have been satisfied. Continued use of the Platform shall not, by itself, constitute a substitute for consent where consent is required by law.

This Policy may be made available in both Arabic and English. In the event of any discrepancy or inconsistency between the two versions, the Arabic version shall prevail and constitute the authoritative version, without prejudice to the laws and regulations in force in the Kingdom of Saudi Arabia.

1. The services provided through the KSU Aamal Platform are subject to Value Added Tax in accordance with the classification and rate prescribed for each service under the tax laws and regulations in force in the Kingdom of Saudi Arabia.
2. Value Added Tax shall be added to the value of the service at the rate applicable at the time of purchase, unless the service is exempt from tax, subject to a zero rate, or outside the scope thereof.
3. The total amount due from the Beneficiary shall be displayed prior to completion of the payment process, inclusive of the value of the service and the applicable Value Added Tax.
4. An electronic invoice shall be issued upon completion of the payment process, setting out the description of the service, its value exclusive of tax, the tax rate, the tax amount, and the total amount inclusive of tax.
5. Billing details and the tax registration number, if any, must be entered correctly prior to completion of the payment process, and the Beneficiary shall bear responsibility for the accuracy of the information provided.
6. In the event of cancellation of the service or refund of its value, Value Added Tax shall be accounted for within the refundable amount due, and the requisite credit note or other statutory document shall be issued.
7. If the tax rate or its treatment is amended pursuant to applicable laws, the rate or treatment in effect on the date the tax becomes due shall apply, without the need to amend this Policy.
8. This Policy is subject to the Value Added Tax Law, its Implementing Regulations, and the e-invoicing requirements adopted by the Zakat, Tax and Customs Authority.