1. Who processes your data
The controller of the personal data collected through this website is the training institution set out below. It operates the academy published on this site and decides why and how your data is processed.
| Detail | Value |
|---|---|
| Operator | Investment Higher Training Academy |
| Legal form | Licensed private training institution |
| Commercial Registration | 1010292058 |
| Unified National Number | 7001554307 |
| TVTC licence | 224127931061 |
| Licensed by | Technical and Vocational Training Corporation (TVTC) |
| Electronic delivery accredited by | National eLearning Center (NELC) |
| Registered activity | Private vocational and professional training |
| Address | Northern Ring Road, Exit 8B, Al Shuhada District, Building 2969 Riyadh 13241, Kingdom of Saudi Arabia |
| P.O. Box | 1983 |
| Phone | +966 800 301 1100 |
| rihanabishop8389@gmail.com | |
| Administration | admin@ia.edu.sa |
Questions about this policy, or a request to exercise any of the rights in section 8, can be sent to the contact address above or raised at the academy reception during opening hours.
This policy covers this website only. It does not cover the separate systems the academy uses for enrolment, attendance and certificate issue, which are described to you at the point you register for a course.
2. The law this policy follows
Processing described here is governed by the Personal Data Protection Law of the Kingdom of Saudi Arabia, issued by Royal Decree M/19 dated 9/2/1443H and amended by Royal Decree M/148 dated 5/9/1444H, together with its Implementing Regulations. The supervisory authority is the Saudi Data and Artificial Intelligence Authority, SDAIA.
The lawful bases relied on, in the language of that law, are your consent, the performance of a contract to which you are a party or steps taken at your request before entering one, and the legitimate interests of the controller where those interests do not prejudice your rights. Each purpose in section 4 names the basis it stands on.
3. What is collected
3.1 Data you type into the enquiry form
The form collects your first name, your family name, your e-mail address and your mobile number, all of which are required in order to answer you, and an optional comment. Nothing else in the form is required and no other field exists.
3.2 Data collected automatically
Web server logs record your IP address, the time of the request, the page requested, the referring page and your browser identification string. These are technical records kept to run the site and to investigate faults and abuse.
3.3 Data we do not collect
- No payment data. This site takes no payments. There is no checkout, no card field and no payment provider embedded in any page. Course fees are settled with the academy directly after you have been quoted in writing.
- No financial information about you. The form does not ask about your income, your holdings, your debts or your financial circumstances, and you should not put that information into the comment field. It is not needed to answer an enquiry about a course and we do not want it.
- No national identity or Iqama numbers. Identification is checked once, in person at registration, from the original document. It is never requested through this website.
- No profiling or automated decisions. Nothing on this site makes an automated decision about you.
4. Why it is processed, and on what basis
| Purpose | Data used | Basis | Kept for |
|---|---|---|---|
| Calling you back and answering your enquiry | First name, family name, e-mail, mobile number, comment | Steps at your request prior to a contract | 12 months from the last contact, then deleted |
| Operating the site, diagnosing faults, security | Server log data | Legitimate interest in a working and secure site | Up to 12 months |
| Anonymous visit statistics | Analytics identifiers and page events | Your consent, through the cookie banner | Up to 14 months in the analytics account |
| Measuring advertising campaigns | Advertising identifiers and conversion events | Your consent, through the cookie banner | Up to 13 months in each advertising platform |
Your data is not used for any purpose beyond the ones listed here. It is not sold, rented or exchanged with anyone for their own marketing, and it is never passed to a financial firm, a broker or any other third party wishing to contact you about their own products.
5. What we will not send you
Sending an enquiry gives us a reason to call you back about the course you asked about. It does not sign you up to anything.
You will not be added to a marketing list on the strength of an enquiry alone. You will not receive material about financial products, because the academy does not sell any and takes no commission from anyone who does. If we ever wish to send you course announcements, we will ask you separately and you will be able to refuse without losing anything.
If an advisor calls and you say you are not interested, that closes the matter. Your record is marked and you are not called again about the same enquiry.
6. Cookies and similar storage
The banner you saw on arrival offers three equally weighted choices: reject everything beyond what is necessary, customise the categories, or accept everything. Refusing costs you nothing, no part of the site is withheld, and the banner does not reappear on every page to wear you down.
Until you choose, and if you reject, Google Consent Mode runs with ad_storage, ad_user_data, ad_personalization, analytics_storage and personalization_storage all set to denied, and advertising data redaction switched on. The advertising pixels described below are not loaded into the page at all in that state, rather than loaded and then asked to behave.
| Name | Set by | What it does | Category | Lifetime |
|---|---|---|---|---|
| si_consent | First party, this site | Stores which cookie categories you allowed, with a version number and a timestamp. | Necessary | 12 months |
| si_lang | First party, this site | Remembers whether you chose the English or the Arabic version. | Necessary | 12 months |
| si_pending | First party, this site | Holds your enquiry for the length of one browser session so the thank you page can show it back if automatic sending is not configured. Cleared when the tab closes. | Necessary | Until the tab closes |
| _ga, _ga_* | Google Analytics | Distinguishes visitors so visits can be counted anonymously. | Measurement | Up to 14 months |
| _gcl_* | Google Ads | Attributes a visit to an advertising click for conversion measurement. | Advertising | Up to 90 days |
| _ttp, ttclid | TikTok Ads | Attributes a visit to a TikTok advertising click. | Advertising | Up to 13 months |
| taboola and outbrain identifiers | Taboola, Outbrain | Attribute a visit to a native advertising placement. | Advertising | Up to 13 months |
6.1 The advertising platforms named
Where campaigns are running, conversion measurement may be provided by Google Ads, TikTok Ads, Taboola and Outbrain. Each is loaded only after you consent to the advertising category, each is a separate controller for what it then collects, and each publishes its own privacy policy. Withdrawing advertising consent in the footer stops them being loaded on subsequent pages.
6.2 Changing or withdrawing your choice
Select Cookie settings in the footer of any page. Your choice is recorded with a version number and a timestamp so it can be shown, if asked, when and to what you consented. You can also delete site data in your browser settings, which resets the banner.
7. Who else sees the data
Access inside the academy is limited to the admissions and learner support staff who need it to answer your enquiry. Beyond that, data reaches only:
- The hosting provider for this website, which necessarily processes server logs in order to serve pages.
- Google, for analytics and advertising measurement, and only after consent to the relevant category.
- TikTok, Taboola and Outbrain, for advertising measurement, and only after consent to the advertising category.
- Competent authorities, where disclosure is required by Saudi law or a valid legal order, including any inspection carried out by the Technical and Vocational Training Corporation in its supervisory capacity.
Some of these providers process data outside the Kingdom. Transfers outside the Kingdom are made in line with the Personal Data Protection Law and the SDAIA regulations on data transfer, using the safeguards those rules require. If you would rather no data left the Kingdom through this site, reject the analytics and advertising categories in the banner and nothing is sent to them.
8. Your rights
Under the Personal Data Protection Law you have the right to:
- Be informed of the legal basis and the purpose of collection, which is the function of this document.
- Access your personal data held by the controller, and to request a copy.
- Request correction of data that is incomplete, inaccurate or out of date.
- Request destruction of your personal data where it is no longer needed for the purpose it was collected for.
- Withdraw consent at any time where consent is the basis, including consent to cookies, without affecting what was lawful before the withdrawal.
Requests are answered within the period set by the Implementing Regulations. Identity is verified before data is disclosed or destroyed, so that nobody else can obtain or delete your data by asking for it. If you are not satisfied with the response, you may complain to SDAIA as the supervisory authority.
Note that where you have completed a course, the academy is required to keep the training and attendance record that supports the certificate it issued. A request to destroy data does not extend to a record we are obliged to retain, and we will tell you plainly which part that is.
9. Security and retention
The site is served over HTTPS. Form submissions travel over an encrypted connection, and the site holds no database of learners, because it has no learner area, no login and no account.
Retention periods are in the table in section 4. When a period ends the data is deleted, or reduced to figures that no longer identify anyone, such as a monthly count of enquiries.
No system is beyond failure. If a breach occurs that is likely to harm you, the controller will notify SDAIA and the affected individuals as the Implementing Regulations require.
10. Children
Courses are for adults, and this site is not directed at children. We do not knowingly collect data about anyone under eighteen through this website. If you believe a child has sent us data through this site, tell us and it will be deleted.
11. Changes to this policy
If this policy changes, the version date below is updated and the new text is published on this page. A change that materially affects how your data is used will also reset the cookie banner, so you are asked again rather than moved silently onto new terms.
Last updated: 30 September 2026. The companion document is here: Terms and conditions