Privacy Policy - MBSC College of Business and Entrepreneurship

Privacy Notice

Prince Mohammed Bin Salman College (MBSC), located in the Kingdom of Saudi Arabia, is committed to protecting the privacy and personal data of our students, employees, faculty, staff, and website visitors. As the “Controller” of your personal data, MBSC determines the purposes and methods of processing your data in compliance with the Personal Data Protection Law (PDPL) and its Implementing Regulations.

Depending on your relationship with MBSC we may process your data differently. We uphold transparency in our data practices to safeguard your privacy and ensure compliance with applicable data laws.

Purpose for Data Processing

We collect and process data for specific, clear, and legitimate purposes such as:

Provision of Educational Services: Enrolling students, managing academic records, providing educational resources, facilitating communication, and supporting teaching, learning, and research activities.
Administrative Functions: Conducting billing, accounting, payroll, human resources operations, managing facility and IT infrastructure.
Compliance and Legal Obligations: Meeting regulatory requirements such as taxation, labor law, and accreditation standards.
Improvement of Services: Conducting research, surveys, and analyses to enhance educational offerings, workplace productivity, and service delivery.
Health and Safety: Protecting the vital interest of individuals, particularly during emergencies requiring immediate actions, providing accommodation, health insurance, and ensuring a safe environment.
Legitimate Business Interest: Support workforce planning, operational efficiency, organization effectiveness, and monitoring IT systems and networks to maintain security and prevent misuse.

Legal Bases for Data Processing

Processing data is conducted based on one or more of the following bases:

Consent: Explicit consent is obtained when required, particularly for sensitive data.
Contractual Necessity: Processing necessary to fulfill a contract with the data subject.
Legal Obligation: Compliance with applicable laws and regulations.
Legitimate interest: processing necessary for the legitimate interests pursued by MBSC, provided it does not adversely affect the rights and freedoms of the data subject.

Types of Personal Data Collected

To meet the above purposes, we collect only the data necessary, such as:

Identification Data: Name, nationality, date of birth, and government IDs when required for verification or regulatory compliance.
Contact Information: Address, email, and phone numbers.
Academic Information: Education history, transcripts, and qualifications.
Financial Information: Bank account details, payments records, and scholarship information.
Health Information: Medial records as necessary for health services and accommodation.
Employment Information: Employment history and qualifications.
Technical Data: IP addresses, login data, browser type, and usage data.

Mandatory or Optional Provision of Data

Data Subject Rights

You have the following rights regarding your personal data:

Right to Be Informed: To know how your data’s being collected, used, and processed.
Right to Access: To request access to your personal data held by MBSC within 30 days.
Right to Rectification: To request correction of inaccurate, incomplete, or outdated data.
Right to Erasure: To request the deletion of your data when it’s no longer necessary or if you withdraw consent, subject to legal or contractual retention obligations.
Right to Restrict Processing: To request the suspension of processing under certain circumstances.
Right to Data Portability: To obtain a copy of your personal data in a commonly used electronic format.
Right to Withdraw Consent: You may withdraw your consent at any time by using the contact information at the end of this policy. Withdrawal will not affect the lawfulness of prior processing, and processing will cease unless another legal basis applies.

Data Processing and Sharing

Processing Methods: Personal data is processed using secure electronic and manual methods, ensuring confidentiality and integrity.
Third-Party Processors: We may engage third-party service providers under strict contractual obligations to process data on our behalf.
Data Sharing: Personal data may be shared with government entities or in response to legal requests.
Data Transfers Outside the Kingdom: Personal data may be transferred outside the Kingdom only when necessary and in compliance with the PDPL standards.

Data Retention and Secure Destruction

Storage Period: Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected or required by law.
Criteria for Determination: If exact periods cannot be specified, we use criteria such as legal obligation, potential disputes, and the necessity of ongoing services.
Secure Destruction: Upon expiration of the retention period, personal data is securely destroyed in a manner that prevents unauthorized access or reconstruction.

Data Security Measures

We implement appropriate organization, administrative, and technical measures to protect data, such as:

Security Controls: Adoption of cybersecurity standards issued by the National Cybersecurity Authority (NCA) and recognized best practices.
Access Controls: restricting access to personal data to authorized individuals.
Encryption: Use of encryption technologies for data at rest and in transit.
Regular assessments: Conducting regular assessments and impact analysis to identify and mitigate potential risks.
Pseudonymization and Anonymization: Techniques are applied to minimize identification risk during data processing.

Data Breach Notification

We notify the relevant authority within 72 hours of any personal data breach that might impact your rights. If we suspect a data breach poses risks to you, we will inform you without undue delay, detailing the breach and our mitigation actions.

Direct Marketing and Awareness Materials

We require your consent before sending marketing or awareness materials, and you can opt out at anytime by using the contact information at the end of this policy.

Website Content Disclaimer

The content on the official MBSC website is provided solely for informational purposes. While we strive for accuracy and completeness in the information, products, and services presented, we cannot guarantee all information is complete, consistent, accessible, or up-to-date. Users should verify relevant facts before making any financial or contractual commitments, as reliance on website content alone is at the user’s own risk.

MBSC reserves the right to update website content as new information becomes available and disclaims any liability for any damages, data loss, or misuse resulting from this website. Unauthorized use of MBSC trademarks, logos, electronic media, or print publications is strictly prohibited without prior consent.

External Links and Pop-Up Advertisement

The MBSC website may contain links to external websites. These external sites and resources are beyond MBSC’s control, and we do not endorse or assume responsibility for their content or privacy practices. We encourage users to review each external site’s privacy policies independently.

While browsing, you may encounter pop-up advertisement generated by other websites or software. MBSC does not endorse or recommend any products or services promoted in these pop-up advertisements.

Log File and Cookies

MBSC website automatically collects and stores log file data such as page visits, dates, IP addresses, refereeing URLs, and domain names.

Cookies are small files stored on your browser to enhance browsing experience. MBSC uses cookies to recognize returning users or carry information across pages. You can disable cookies in your browser settings, though some website features may not function correctly without them.

This data helps us analyze site usage and improve our services without infringing on your privacy. MBSC does not share or release personal information collected through cookies or log files to third parties without your explicit consent.

Changes to This Privacy Policy

We may update this privacy policy as required by law or to reflect our data practices. Updates will be posted on our website, indicating effective date.

Contact Information

For any questions, concerns, or exercising your rights regarding personal data, please contact:

Upon contact, we may need to verify your identity to process your request. We will respond to your request within 30 days. If an extension is necessary, we will inform you of the reason and the extended period, not exceeding an additional 30 days.

PrivacyPolicy