Privacy Policy

Effective Date: 12 November 2026
Last Updated: 12 November 2026

1. Introduction

Aldenham School Riyadh, operated by Aldenham Education Group (“Aldenham School Riyadh”, “Aldenham Riyadh”, “the School”, “we”, “us” or “our”), respects the privacy of prospective students, parents, legal guardians, family members, website visitors and other persons who communicate with us.

This Privacy Policy explains how we collect, receive, record, organise, store, use, analyse, disclose, transfer, restrict, delete and otherwise process Personal Data when you:

• access or use https://aldenham-riyadh.pages.dev/;
• access any page, form, feature or service made available through that website;
• respond to an advertisement concerning Aldenham School Riyadh;
• submit an admissions enquiry;
• request information about the School;
• request or book a school tour;
• communicate with us by telephone, WhatsApp, SMS, email, online form, social media or another channel;
• provide information about a prospective student;
• interact with the School’s admissions representatives or authorised service providers; or
• otherwise provide Personal Data in connection with admission, enrolment or an expression of interest in the School.

For the purposes of applicable data protection legislation, Aldenham School Riyadh is the Controller of Personal Data processed for the School’s admissions and educational purposes.

The School may appoint authorised third parties to assist with advertising, enquiry generation, admissions communications, lead qualification, appointment scheduling, website management, customer relationship management and related services.

This includes Enrolia L.L.C-FZ (formerly VNSCO L.L.C-FZ) (“Enrolia”), which may process Personal Data for and on behalf of Aldenham School Riyadh in accordance with the School’s instructions and the applicable service arrangements.

This Privacy Policy applies to the initial enquiry and prospective admissions process. If a prospective student proceeds to a formal application or enrolment, additional admissions terms, consent forms, student privacy notices, safeguarding policies and record-retention requirements may apply.

2. Scope of This Privacy Policy

This Privacy Policy applies to Personal Data collected through or in connection with:

• the admissions website at https://aldenham-riyadh.pages.dev/;
• web forms hosted on or connected to the admissions website;
• advertising lead forms;
• telephone calls;
• WhatsApp communications;
• SMS communications;
• emails;
• school tour requests;
• admissions appointments;
• admissions events and open days;
• customer relationship management systems;
• advertising and analytics platforms;
• communications initiated by the School or Enrolia following an enquiry; and
• other authorised admissions channels.

This Privacy Policy does not replace the privacy terms of third-party platforms that you independently use, including Google, Meta, Facebook, Instagram, WhatsApp, HubSpot or other external services.

Those platforms may independently process information under their own privacy terms.

3. Applicable Law

We process Personal Data in accordance with applicable laws and regulations of the Kingdom of Saudi Arabia, including, where applicable:

• the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended, and its Implementing Regulations;
• the Regulation on Personal Data Transfer outside the Kingdom;
• applicable Saudi consumer protection legislation;
• applicable telecommunications and electronic communications regulations, including those of the Communications, Space and Technology Commission;
• applicable education, safeguarding and student-record requirements;
• applicable requirements of the Ministry of Education;
• applicable telecommunications and digital services requirements; and
• other applicable legislation and regulatory directions of the Kingdom.

Nothing in this Privacy Policy is intended to exclude, restrict or override any right, obligation or protection that cannot lawfully be excluded or restricted.

4. Definitions

For the purposes of this Privacy Policy:

“Controller” means the person or organisation that determines the purposes and means of Processing Personal Data.

“Data Subject” means the identifiable individual to whom Personal Data relates.

“Personal Data” means any information relating to an identified or identifiable natural person.

“Processing” means any operation performed on Personal Data, including collection, receipt, recording, organisation, storage, use, consultation, analysis, adaptation, transfer, disclosure, restriction, deletion or destruction.

“Processor” means a person or organisation that processes Personal Data on behalf of and under the instructions of a Controller.

“Prospective Student” means a child or other person in respect of whom an enquiry, application or request for information is made.

“Sensitive Personal Data” includes categories of information afforded additional protection under applicable law, including health, biometric, genetic, religious or other protected information where applicable.

“Site” means https://aldenham-riyadh.pages.dev/ and its associated pages, forms and functionality.

5. Personal Data We May Collect

The Personal Data we collect depends on how you interact with us and what information is reasonably required to respond to your enquiry.

5.1 Parent, guardian and enquirer information

We may collect:

• full name;
• first name and surname;
• telephone number;
• mobile number;
• WhatsApp number;
• email address;
• country of residence;
• nationality;
• area or community of residence;
• preferred language;
• preferred communication channel;
• relationship to the Prospective Student;
• employment or employer information where relevant to an authorised corporate discount;
• information about siblings who currently attend or may apply to the School;
• appointment and tour preferences;
• communication preferences; and
• any other information you voluntarily provide.

5.2 Prospective Student information

We may collect:

• full name;
• first name and surname;
• age;
• date of birth;
• gender, where relevant and lawfully requested;
• nationality;
• current country or city of residence;
• intended academic year;
• intended date of admission;
• current grade or year group;
• requested grade or year group;
• current or previous school;
• curriculum currently followed;
• language information;
• sibling information;
• general academic background;
• information required to understand grade eligibility;
• information relevant to arranging an assessment, meeting or tour;
• general information about educational needs where voluntarily disclosed; and
• other information relevant to the initial admissions enquiry.

We do not generally require detailed medical, psychological, disability, biometric, passport, Iqama or national ID or financial information through a general marketing enquiry form.

Such information should be provided only where specifically requested through an authorised and appropriately secured formal admissions channel.

5.3 Admissions enquiry information

We may collect:

• the date and time of the enquiry;
• the source of the enquiry;
• the advertisement, campaign or webpage that generated the enquiry;
• the academic year or intake of interest;
• the School programme or grade of interest;
• questions submitted by you;
• notes made during telephone or WhatsApp discussions;
• tour and appointment history;
• communications and follow-up history;
• the status and outcome of the enquiry;
• reasons for postponing or not progressing an enquiry, where provided;
• records of requested actions;
• records of whether an application was started;
• records of whether the Prospective Student enrolled; and
• attribution information used to evaluate admissions and marketing performance.

5.4 Communications information

When you communicate with the School or Enrolia, we may collect and retain:

• emails;
• WhatsApp messages;
• SMS messages;
• online chat messages;
• social media messages;
• web-form submissions;
• telephone call logs;
• call dates and times;
• call duration;
• call outcomes;
• voicemail messages;
• correspondence attachments;
• admissions notes;
• tour confirmations;
• reminders;
• records of communication preferences;
• records of consent;
• records of withdrawals of consent;
• do-not-contact requests; and
• complaint or dispute correspondence.

5.5 Call recordings

Where permitted by applicable law and following any notice required by law, telephone or online calls may be recorded for:

• staff training;
• quality assurance;
• accurate record-keeping;
• service supervision;
• complaint investigation;
• dispute resolution;
• fraud prevention;
• safeguarding;
• security; and
• legal or regulatory compliance.

Where recording is used, you may ask whether the relevant call is being recorded.

5.6 Information collected automatically

When you access the Site, we or our authorised technology providers may automatically collect:

• Internet Protocol address;
• approximate location derived from an IP address;
• browser type;
• browser version;
• device type;
• device identifiers;
• operating system;
• screen size;
• language settings;
• time-zone settings;
• referring website or application;
• pages viewed;
• buttons or links selected;
• date and time of access;
• duration of a visit;
• form interactions;
• form submission events;
• errors or failed submissions;
• cookie identifiers;
• advertising identifiers;
• traffic-source information;
• campaign identifiers;
• click identifiers;
• conversion events;
• network and diagnostic information;
• security logs; and
• other technical usage information.

5.7 Advertising and referral information

If you access the Site or contact us through an advertisement, search engine, directory, social media service, partner, referral website or lead-generation platform, we may receive:

• the advertisement or campaign you responded to;
• the platform through which the enquiry was generated;
• a campaign, ad-set or advertisement identifier;
• search terms or referral information;
• click and conversion identifiers;
• information submitted through an advertising lead form;
• contact information you authorised the platform to share;
• audience and attribution data;
• information indicating that you viewed or interacted with an advertisement; and
• aggregated campaign-performance data.

5.8 Information from other persons

A spouse, family member, relocation adviser, employer, education consultant or other authorised person may contact us on behalf of a Prospective Student.

Where this occurs, we may collect information from that person and may take reasonable steps to verify that they are authorised to provide the information.

5.9 Information from public or official sources

Where reasonably necessary and permitted by law, we may verify or supplement information using:

• official educational records;
• regulatory sources;
• information supplied by a previous school;
• publicly available professional or contact information;
• authorised education platforms; or
• other lawful sources.

Formal verification generally occurs only if an enquiry progresses to a formal application.

6. Children’s Personal Data

The Site is intended primarily for use by parents, legal guardians and adults authorised to make an admissions enquiry.

Children should not independently submit Personal Data through the Site without the knowledge and involvement of a parent or legal guardian.

By providing Personal Data concerning a child, you represent and confirm that:

• you are the child’s parent or legal guardian; or
• you are otherwise properly authorised to provide the information;
• you are authorised to communicate with the School concerning the child;
• the information is accurate to the best of your knowledge;
• providing the information does not unlawfully infringe the child’s or another person’s rights; and
• the information may be processed to respond to the enquiry and manage the prospective admissions process.

We seek to collect only the information reasonably necessary for an initial enquiry.

If we reasonably believe that a child submitted Personal Data without appropriate adult involvement, we may:

• restrict use of the information;
• seek confirmation from a parent or guardian;
• delete the information;
• discontinue communication; or
• take another appropriate protective action.

7. Sensitive Personal Data

You should not submit Sensitive Personal Data through a general admissions enquiry form unless it is directly relevant and specifically requested through an authorised channel.

Sensitive Personal Data may include:

• detailed medical information;
• diagnoses;
• psychological assessments;
• disability information;
• special educational needs documentation;
• biometric information;
• genetic information;
• religious information beyond what is reasonably required by law;
• passport copies;
• Iqama or national ID copies;
• visa documents;
• financial information; and
• safeguarding information.

If you voluntarily provide such information before it is requested, we may:

• restrict access to it;
• transfer it to an appropriate authorised School team;
• request that it be resubmitted through a secure channel;
• delete unnecessary copies; or
• retain it where required by law or necessary to protect the child.

Where an application progresses, the School may issue additional notices or requests explaining how formal student and Sensitive Personal Data will be processed.

8. Purposes of Processing

We may process Personal Data for the following purposes.

8.1 Responding to enquiries

We may process Personal Data to:

• identify you;
• contact you;
• respond to your request;
• provide general information about Aldenham School Riyadh;
• answer questions regarding admissions;
• provide information about year groups and academic programmes;
• discuss approximate availability;
• provide information about tuition and other charges;
• explain the application process;
• provide directions and contact details;
• send requested materials;
• arrange a call;
• arrange a tour; and
• determine the appropriate next admissions step.

8.2 Managing prospective admissions

We may process Personal Data to:

• create an admissions enquiry record;
• identify the relevant Prospective Student;
• understand the requested academic year and grade;
• identify potentially suitable year-group placement;
• assess whether the enquiry falls within the School’s current admissions scope;
• coordinate between authorised admissions personnel;
• avoid duplicate records;
• maintain an enquiry history;
• schedule follow-up;
• request additional information;
• arrange assessments or meetings;
• support progression to a formal application;
• transfer information into a formal admissions system;
• analyse the admissions funnel; and
• determine whether the Prospective Student ultimately enrolled.

Submitting an enquiry does not guarantee admission, availability, assessment, enrolment, any particular fee or any other outcome.

8.3 Telephone, WhatsApp, SMS and email communications

We may use the contact details you provide to communicate with you through:

• telephone;
• WhatsApp;
• SMS;
• email;
• online messaging; or
• another channel requested or reasonably expected in connection with the enquiry.

Communications may relate to:

• your enquiry;
• grade or intake information;
• school tours;
• appointments;
• admissions deadlines;
• incomplete information;
• requested documents;
• application steps;
• availability updates;
• admissions events;
• open days;
• reminders; and
• other directly related admissions matters.

8.4 Advertising and campaign attribution

We may process Personal Data and technical data to:

• identify which advertisement or campaign generated an enquiry;
• measure website and advertisement performance;
• calculate enquiry and enrolment conversion rates;
• distinguish new enquiries from repeated or duplicate enquiries;
• measure cost per enquiry or enrolment;
• understand which audiences are engaging with the School;
• improve advertisement relevance;
• allocate advertising expenditure;
• prevent advertising fraud;
• exclude existing enquirers from unnecessary advertising where permitted;
• create, use or measure advertising audiences where permitted;
• optimise marketing campaigns;
• evaluate the performance of Enrolia and other providers; and
• generate aggregated admissions and marketing reports.

8.5 School tours and admissions events

We may process Personal Data to:

• book a school tour;
• confirm attendance;
• send reminders;
• manage visitor access;
• identify persons expected on campus;
• communicate changes or cancellations;
• follow up after a visit;
• obtain feedback; and
• maintain operational and security records.

Additional visitor, security, photography or CCTV notices may apply while you are present on School premises.

8.6 Service quality and training

We may process Personal Data to:

• monitor response times;
• evaluate communications;
• train admissions representatives;
• supervise service providers;
• review call or message quality;
• investigate missed communications;
• identify recurring questions;
• improve scripts and workflows;
• improve the Site;
• improve the admissions experience; and
• maintain consistent and accurate communications.

8.7 Analytics and reporting

We may process information to:

• understand Site usage;
• measure page performance;
• identify technical issues;
• evaluate form completion;
• understand visitor sources;
• generate aggregated reports;
• forecast admissions demand;
• assess grade-level interest;
• analyse conversion;
• improve admissions resources; and
• support management decisions.

Where reasonably possible, analytics and reporting may use aggregated, pseudonymised or anonymised data.

8.8 Security, fraud prevention and misuse

We may process Personal Data to:

• prevent spam;
• identify fraudulent or false enquiries;
• detect malicious automated submissions;
• maintain Site and system security;
• investigate unauthorised access;
• protect accounts and communication channels;
• prevent impersonation;
• maintain audit logs;
• investigate suspicious activity;
• protect children, families and staff;
• respond to cyber incidents; and
• protect the rights and property of the School and other persons.

8.9 Legal and regulatory compliance

We may process Personal Data to:

• comply with applicable law;
• comply with regulatory directions;
• respond to courts or government authorities;
• maintain consent records;
• manage privacy requests;
• investigate complaints;
• establish, exercise or defend legal claims;
• maintain evidence;
• cooperate with law enforcement;
• fulfil education or safeguarding obligations;
• fulfil audit requirements; and
• meet record-retention obligations.

9. Legal Grounds for Processing

Depending on the context and purpose, we may process Personal Data where:

• you have provided consent;
• you have requested information or contact;
• processing is necessary to take steps at your request before a possible admissions or enrolment arrangement;
• processing is necessary to perform a contract;
• processing is necessary to comply with a legal or regulatory obligation;
• processing is necessary to establish, exercise or defend legal rights;
• processing is necessary to protect the interests of the relevant person or another person;
• processing is necessary for security, fraud prevention or safeguarding;
• processing is necessary for the operation and administration of the School, where permitted by law;
• Personal Data has been made public by the Data Subject, where applicable;
• processing is necessary for statistical or research purposes subject to applicable safeguards; or
• another legal ground or exception applies under applicable legislation.

Where we rely on consent, you may withdraw that consent at any time.

Withdrawal of consent:

• does not affect Processing lawfully carried out before withdrawal;
• does not require deletion where another lawful retention ground applies;
• does not prevent communications necessary to manage an active request, application or contractual relationship; and
• may affect our ability to provide a requested service where the relevant Processing is necessary.

10. Admissions Enquiries and Consent to Contact

When you submit an admissions enquiry and request contact, you authorise Aldenham School Riyadh and its authorised admissions service providers, including Enrolia, to respond using the details and communication channels you provide.

This may include a reasonable number of follow-up communications where they relate to:

• the Prospective Student;
• the academic year or grade identified in the enquiry;
• a requested tour;
• a requested call;
• an active enquiry;
• an incomplete enquiry or application;
• information you requested;
• availability relevant to the enquiry; or
• an admissions event relevant to the enquiry.

An admissions enquiry does not provide unlimited permission to send unrelated marketing communications indefinitely.

Where required by law, separate consent will be requested for general promotional communications that are not reasonably connected to an active enquiry.

11. Direct Marketing

Subject to applicable law and consent requirements, we may send communications about:

• admissions opportunities;
• open days;
• School tours;
• academic programmes;
• School events;
• relevant deadlines;
• promotional fee arrangements;
• scholarships;
• news;
• future academic-year availability; and
• other School services that may reasonably be relevant to you.

You may opt out of general promotional communications at any time by:

• using an unsubscribe facility where available;
• replying “STOP” or “UNSUBSCRIBE” where appropriate;
• informing a caller or representative that you do not wish to receive further marketing;
• emailing the School; or
• otherwise contacting us using the details in Section 27.

Opting out of promotional communications does not prevent us from sending:

• responses to an enquiry;
• tour confirmations;
• appointment reminders;
• requested information;
• application-related communications;
• safeguarding communications;
• legally required notices; or
• service messages concerning an existing relationship.

We may retain a limited suppression record containing your contact details and opt-out status to ensure that your request is respected.

12. Telemarketing and Messaging Controls

Where applicable, the School and its authorised providers will seek to comply with Saudi requirements governing marketing calls and marketing messages.

This may include controls relating to:

• permitted calling times;
• caller identification;
• use of registered business telephone numbers;
• call frequency;
• opt-out requests;
• refusal to continue a marketing discussion;
• suppression of numbers where required;
• record-keeping;
• transparency;
• avoidance of misleading statements; and
• avoidance of unjustified pressure.

Communications responding to a request initiated by you may be treated differently from unsolicited general marketing, subject to applicable law.

13. Cookies and Similar Technologies

The Site may use cookies, pixels, tags, web beacons, scripts, local storage, software development kits and similar technologies.

These technologies may be operated by the School or authorised third parties.

13.1 Strictly necessary technologies

Strictly necessary technologies may be used to:

• deliver the Site;
• maintain security;
• prevent spam;
• balance traffic;
• maintain form functionality;
• remember privacy choices;
• identify technical failures;
• protect systems; and
• provide functionality requested by you.

Where permitted by law, these technologies may operate without optional consent because they are necessary for the Site’s operation.

13.2 Functional technologies

Functional technologies may be used to remember:

• language settings;
• location preferences;
• form selections;
• communication preferences;
• accessibility settings; and
• user-interface choices.

13.3 Analytics technologies

Analytics technologies may be used to measure:

• numbers of visitors;
• traffic sources;
• pages viewed;
• duration of visits;
• form interactions;
• form completion;
• technical errors;
• device types;
• aggregated visitor behaviour; and
• website performance.

13.4 Advertising technologies

Subject to applicable requirements, advertising technologies may be used to:

• attribute enquiries to advertisements;
• measure conversion;
• optimise advertisements;
• build or use advertising audiences;
• exclude irrelevant audiences;
• measure campaign effectiveness;
• limit repeated advertising;
• understand interactions with advertisements; and
• report aggregated campaign results.

13.5 Technology providers

Depending on the Site’s configuration, providers may include:

• Google;
• Google Analytics;
• Google Ads;
• Google Tag Manager;
• Meta;
• Facebook;
• Instagram;
• HubSpot;
• hosting providers;
• website form providers;
• anti-spam providers;
• analytics services; and
• other authorised technology providers.

The inclusion of a provider in this list does not mean that every provider is active at all times.

The Site’s actual configuration may change.

13.6 Managing cookie preferences

Where a cookie consent tool is provided, you may use it to:

• accept non-essential technologies;
• reject non-essential technologies;
• select categories;
• withdraw consent; or
• change earlier preferences.

You may also block or delete cookies through your browser settings.

Blocking cookies may affect:

• Site functionality;
• form operation;
• language preferences;
• campaign attribution;
• security checks; and
• user experience.

14. Do Not Track and Browser Signals

Some browsers transmit “Do Not Track” or similar privacy signals.

There is not always a uniform technical or legal standard for responding to every browser signal.

We may respond to consent preferences through the Site’s cookie management tool and other controls supported by the relevant technologies.

Where applicable law requires recognition of a particular technical signal, we will take reasonable steps to comply.

15. Disclosure of Personal Data

We may disclose Personal Data only where reasonably necessary for an authorised purpose.

15.1 School personnel

Personal Data may be accessible to authorised members of:

• the admissions team;
• School leadership;
• administration;
• finance, where relevant;
• student support;
• inclusion teams;
• safeguarding personnel;
• information technology personnel;
• security personnel;
• legal and compliance personnel; and
• other authorised School employees with a legitimate need to access it.

15.2 Enrolia

Aldenham School Riyadh may provide Personal Data to Enrolia L.L.C-FZ as an authorised admissions, advertising, lead-management and communications service provider.

Enrolia may assist with:

• running advertising campaigns;
• designing or operating admissions landing pages;
• collecting enquiries;
• receiving advertising leads;
• contacting prospective families;
• responding to initial enquiries;
• qualifying enquiries;
• maintaining communication records;
• scheduling school tours;
• scheduling admissions calls;
• following up on enquiries;
• coordinating with the School’s admissions team;
• updating enquiry status;
• measuring campaign performance;
• reporting enrolment attribution; and
• improving admissions processes.

Enrolia is not authorised to use Aldenham School Riyadh enquiry data for unrelated independent purposes.

Unless expressly authorised by the School, Enrolia:

• does not make final admissions decisions;
• does not guarantee admission;
• does not independently determine official tuition fees;
• does not determine grade placement;
• does not provide educational services in place of the School; and
• cannot waive the School’s formal application requirements.

15.3 Website, hosting and CRM providers

We may disclose information to authorised providers of:

• web hosting;
• domains;
• content delivery;
• landing-page technology;
• website development;
• web forms;
• CRM systems;
• admissions systems;
• cloud storage;
• document management;
• data backup;
• email;
• messaging;
• telephone systems;
• call recording;
• appointment scheduling;
• technical support; and
• system maintenance.

15.4 Advertising and analytics providers

We may disclose limited technical, event, identifier or conversion information to advertising and analytics providers where permitted by law and applicable consent choices.

Such providers may independently process information in accordance with their terms and privacy policies.

15.5 Professional advisers

We may disclose Personal Data to:

• lawyers;
• auditors;
• insurers;
• accountants;
• cybersecurity advisers;
• consultants;
• investigators; and
• other professional advisers.

15.6 Authorities and regulators

We may disclose Personal Data to:

• courts;
• law-enforcement authorities;
• government departments;
• education authorities;
• the Ministry of Education;
• telecommunications authorities;
• data protection authorities;
• consumer protection authorities;
• free-zone or licensing authorities; and
• other competent authorities

where required or permitted by law.

15.7 Corporate and operational transactions

If the School or a relevant part of its operations is sold, transferred, restructured, financed or reorganised, Personal Data may be disclosed to:

• potential purchasers;
• successors;
• investors;
• lenders;
• professional advisers; and
• transaction service providers,

subject to applicable confidentiality and legal safeguards.

16. No Sale of Personal Data

We do not sell Personal Data submitted through the Site.

We do not authorise Enrolia to sell Aldenham School Riyadh admissions enquiry data.

We do not intentionally disclose admissions enquiry data to unrelated third parties for their independent marketing purposes without an appropriate legal ground.

The use of service providers, advertising platforms, analytics platforms and cloud systems for the purposes described in this Privacy Policy is not treated by us as a sale of Personal Data.

17. Data Sharing Between the School and Enrolia

Information may be shared between Aldenham School Riyadh and Enrolia throughout the prospective admissions process.

This may include:

• original enquiry information;
• communications records;
• call notes;
• tour status;
• follow-up status;
• application status;
• enrolment status;
• conversion information; and
• information necessary to resolve an attribution or service-quality issue.

The School remains responsible for determining the School’s admissions purposes.

Enrolia may process the information only within its authorised service scope, subject to applicable contractual, confidentiality, security and data protection requirements.

18. Cross-Border Processing

Some technology, communications, cloud, CRM, advertising or support providers may:

• be incorporated outside the Kingdom of Saudi Arabia;
• operate personnel outside the Kingdom of Saudi Arabia;
• store data outside the Kingdom of Saudi Arabia;
• route communications internationally; or
• provide remote access from another country.

Personal Data may therefore be transferred to or accessed from jurisdictions outside the Kingdom of Saudi Arabia.

Where cross-border Processing occurs, we will take measures required or reasonably appropriate under applicable law, which may include:

• assessing the recipient and destination;
• relying on an applicable legal transfer ground;
• using contractual data protection provisions;
• restricting processing purposes;
• limiting access;
• applying confidentiality obligations;
• applying technical and organisational safeguards;
• obtaining consent where required;
• using providers with appropriate security arrangements; and
• taking additional measures where appropriate.

Foreign privacy laws may differ from Saudi law.

However, we will require Personal Data to be handled consistently with this Privacy Policy and applicable legal obligations.

19. Security Measures

We use reasonable and proportionate technical and organisational measures designed to protect Personal Data from:

• unauthorised access;
• unlawful Processing;
• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure;
• misuse;
• cyberattack;
• malicious software; and
• other security threats.

Measures may include:

• role-based access controls;
• password controls;
• authentication requirements;
• encrypted data transmission;
• access logging;
• monitoring;
• backups;
• system updates;
• anti-spam measures;
• staff instructions;
• confidentiality obligations;
• service-provider due diligence;
• incident-response procedures;
• data minimisation;
• segregation of access;
• secure deletion; and
• periodic security review.

No method of internet transmission, electronic communication or digital storage is completely secure.

Accordingly, we cannot guarantee absolute security, although this does not reduce our obligation to apply appropriate safeguards.

You are responsible for maintaining the security of:

• your devices;
• your email accounts;
• your telephone number;
• your WhatsApp account;
• your passwords; and
• other communication channels under your control.

20. Personal Data Breaches

Where we become aware of a Personal Data breach, we may:

• investigate the incident;
• restrict or contain access;
• preserve evidence;
• assess the affected information;
• assess possible consequences;
• take remedial action;
• cooperate with relevant providers;
• notify the School’s management;
• notify relevant authorities where required;
• notify affected Data Subjects where required; and
• take steps intended to reduce potential harm.

Notifications will be made where and within the timeframe required by applicable law.

21. Data Accuracy

We take reasonable steps to maintain accurate Personal Data where necessary for the relevant Processing purpose.

You are responsible for ensuring that information submitted by you is accurate, complete and not misleading.

You should notify us if there is a change to:

• your contact details;
• your relationship to the Prospective Student;
• the requested grade;
• the intended admission date;
• the Prospective Student’s current school;
• your communication preferences; or
• any other material information.

We may contact you to confirm or update information.

22. Data Retention

We retain Personal Data only for as long as reasonably necessary for:

• the purpose for which it was collected;
• related admissions activity;
• legal compliance;
• regulatory compliance;
• safeguarding;
• security;
• record-keeping;
• audit;
• complaint handling;
• dispute resolution; and
• establishment, exercise or defence of legal claims.

Unless a longer period is required or justified:

22.1 General admissions enquiries

General enquiries that do not progress to formal enrolment will ordinarily be retained for up to 24 months after the last meaningful interaction.

This period allows us to:

• manage extended admissions cycles;
• respond where a family delays relocation;
• identify repeated or duplicate enquiries;
• maintain communication preferences;
• evaluate campaign performance;
• resolve complaints; and
• contact the family about the relevant or next admissions cycle where permitted.

22.2 Active enquiries

Active enquiries may be retained for as long as reasonably necessary to manage the relevant admissions cycle and follow-up.

22.3 Formal applications and enrolled students

Where an enquiry progresses to formal application or enrolment, relevant information may be transferred into the School’s official admissions or student-record systems.

Such information may then be retained under:

• formal admissions terms;
• student privacy notices;
• education regulations;
• safeguarding requirements;
• financial record requirements;
• School policies; and
• other applicable retention requirements.

22.4 Marketing consent and opt-out records

Consent records and suppression records may be retained for as long as reasonably necessary to:

• demonstrate consent;
• demonstrate compliance;
• respect an opt-out request; and
• prevent renewed unwanted contact.

22.5 Call recordings

Call recordings, where used, will be retained only for a reasonable period necessary for:

• quality assurance;
• training;
• complaint handling;
• evidence;
• security;
• safeguarding; or
• compliance.

22.6 Technical information

Technical logs, analytics records and security information may be retained for a reasonable period based on:

• security needs;
• configured technology settings;
• troubleshooting requirements;
• legal requirements; and
• provider retention practices.

22.7 Legal disputes

Information relevant to an actual or reasonably anticipated complaint, investigation or dispute may be retained until:

• the matter is resolved;
• applicable proceedings end;
• enforcement periods expire; and
• applicable legal limitation periods expire.

At the end of the relevant period, Personal Data may be:

• deleted;
• securely destroyed;
• anonymised;
• irreversibly aggregated; or
• otherwise handled as permitted by applicable law.

23. Automated Processing and Profiling

We may use limited automated tools to:

• identify an enquiry source;
• route an enquiry;
• detect duplicate enquiries;
• detect fraudulent or spam submissions;
• categorise enquiries by grade or academic year;
• generate follow-up reminders;
• measure campaign conversion;
• calculate advertising attribution;
• identify communication status;
• create advertising audiences where permitted; and
• prioritise administrative follow-up based on objective enquiry information.

We do not intend to make final admission decisions solely by automated Processing based on information submitted through the Site.

Final admissions decisions remain subject to the School’s formal process and human review.

Where applicable law provides rights concerning an automated decision that produces legal or similarly significant effects, you may contact us using the details in Section 27.

24. Anonymised and Aggregated Information

We may create anonymised or aggregated information that is not reasonably capable of identifying an individual.

Such information may be used for:

• statistical analysis;
• admissions planning;
• marketing analysis;
• management reporting;
• forecasting;
• service improvement;
• benchmarking; and
• other lawful business purposes.

Where information has been properly anonymised and is no longer Personal Data, it may not be subject to the same restrictions as identifiable information.

We will not intentionally attempt to re-identify properly anonymised information except where required for security testing or permitted by law.

25. Your Privacy Rights

Subject to applicable law, identity verification and lawful exceptions, you may have the right to:

• obtain information about the Processing of your Personal Data;
• request access to your Personal Data;
• request a copy of Personal Data;
• request correction of inaccurate information;
• request completion of incomplete information;
• request deletion of Personal Data;
• request restriction or suspension of Processing;
• object to direct marketing;
• object to profiling connected to direct marketing;
• withdraw consent;
• request transfer of Personal Data where applicable;
• object to certain automated decisions;
• request human review of an automated decision where applicable;
• submit a complaint;
• obtain information about recipients or categories of recipients;
• obtain information about the source of Personal Data where applicable; and
• exercise other rights available under applicable law.

These rights are not absolute.

We may refuse, limit or delay a request to the extent permitted by law, including where Processing or retention is necessary to:

• comply with a legal obligation;
• protect another person’s rights;
• maintain safeguarding records;
• establish, exercise or defend legal claims;
• investigate fraud;
• maintain security;
• preserve evidence;
• maintain an opt-out suppression record;
• comply with education requirements;
• protect public interests; or
• process information exempt from the relevant right.

26. How to Exercise Your Rights

To exercise a privacy right, contact us using the details in Section 27.

Your request should clearly identify:

• your name;
• your contact details;
• the Prospective Student, where relevant;
• the nature of your request;
• the relevant enquiry or communication;
• the approximate date of the relevant interaction; and
• any information that may help us locate the relevant records.

We may request information reasonably necessary to:

• verify your identity;
• verify your authority to act for a child;
• verify your authority to act for another adult;
• identify the relevant records;
• prevent unauthorised disclosure; and
• clarify the scope of the request.

A representative submitting a request on behalf of another person may be required to provide evidence of authority.

We will respond within the period required by applicable law.

Ordinarily, no fee will be charged for a valid statutory privacy request.

A reasonable fee may be charged only where permitted by applicable law, including where a request is manifestly excessive or repetitive.

27. Contact Details

Privacy questions, requests, complaints, corrections, withdrawals of consent and marketing opt-outs may be directed to:

Aldenham School Riyadh
Aldenham School Riyadh
4132 Al Noura, As Sahafah
Riyadh 13321, Kingdom of Saudi Arabia
Email: info@aldenhamprepriyadh.com
Admissions Email: registrar@aldenhamprepriyadh.com
Telephone: +966 11 826 5411

Please include “Privacy Request” in the email subject line where appropriate.

For your security, do not send passport copies, Iqama or national ID copies, medical records, payment card information or other highly sensitive documentation through an ordinary email unless specifically requested through an approved channel.

28. Complaints

We encourage you to contact the School first so that we can investigate and attempt to resolve your concern.

You may also have the right to submit a complaint to the Saudi Data & AI Authority (SDAIA) or another competent Saudi authority, depending on the nature of the matter.

This may include a competent:

• data protection authority;
• education authority;
• telecommunications authority;
• consumer protection authority;
• court; or
• other regulator.

Nothing in this Privacy Policy limits any right to contact a competent authority or seek a remedy available under applicable law.

29. External Websites

The Site may link to external websites and services, including:

• the main Aldenham School Riyadh website;
• maps;
• social media platforms;
• messaging platforms;
• education regulators;
• payment providers;
• application systems;
• video platforms;
• downloadable resources; and
• other third-party services.

We do not control external services and are not responsible for their:

• availability;
• security;
• content;
• cookies;
• data collection;
• privacy practices;
• terms; or
• accuracy.

You should review the terms and privacy policy of every external service you use.

30. WhatsApp and Social Media

If you communicate with us through WhatsApp, Facebook, Instagram or another third-party service:

• the platform may independently collect information about you;
• the platform may process account and device information;
• communications metadata may be processed by the platform;
• information may be stored outside the Kingdom of Saudi Arabia;
• the platform’s own privacy terms apply; and
• deleting a message from your device may not delete copies lawfully retained by the School, Enrolia or the platform.

Do not send highly sensitive student documents through social media or messaging platforms unless an authorised representative specifically directs you to an approved method.

31. Email and Electronic Communications

Email and other electronic communications may be:

• delayed;
• filtered;
• intercepted;
• corrupted;
• delivered to spam;
• sent to an incorrect address where inaccurate information was provided; or
• accessed by another person with access to your account or device.

You should not use ordinary email to send information that is unnecessary or highly sensitive.

You are responsible for maintaining control of the email address, mobile number and accounts you provide.

32. Links Between Aldenham School Riyadh and Aldenham School UK

Aldenham School Riyadh may refer to its heritage, relationship or educational connection with Aldenham School in the United Kingdom or other Aldenham-branded schools.

Unless expressly stated otherwise:

• Personal Data submitted through the Site is collected for Aldenham School Riyadh;
• Personal Data is not automatically shared with every Aldenham-branded school;
• another Aldenham school or organisation may be a separate Controller;
• separate privacy terms may apply where you independently contact another Aldenham organisation; and
• information will be shared with another organisation only where authorised and lawful.

33. Changes to This Privacy Policy

We may amend this Privacy Policy to reflect:

• changes to the Site;
• changes to admissions practices;
• changes to School operations;
• changes to service providers;
• changes to technology;
• changes to advertising platforms;
• changes to legal requirements;
• regulatory guidance;
• security developments; or
• other relevant circumstances.

The updated Privacy Policy will be published on the Site with a revised “Last Updated” date.

Where a material change requires further notice or consent under applicable law, we will take reasonable steps to provide that notice or obtain that consent.

You should review this Privacy Policy periodically.

34. Language

This Privacy Policy is provided in English.

It may be translated into Arabic or another language.

Where Arabic is required to prevail under applicable Saudi law, the Arabic legal text will prevail.

Otherwise, the English version published by Aldenham School Riyadh will govern to the extent permitted by law in the event of a material inconsistency.

35. General Provisions

If any provision of this Privacy Policy is found to be invalid, unlawful or unenforceable, the remaining provisions will continue to apply.

Headings are provided for convenience and do not affect interpretation.

A delay in exercising a right does not constitute a waiver of that right.

This Privacy Policy must be interpreted consistently with mandatory applicable law.

Where there is a conflict between this Privacy Policy and a mandatory legal requirement, the mandatory requirement will prevail.