Privacy Notice for RUA Applicants

1. Your Privacy Matters to Us

At Riyadh University of Arts (RUA), we are committed to safeguarding your personal data and ensuring that privacy is fundamental to everything we do. This Privacy Notice explains how we collect, use, protect and share the personal data you provide when completing RUA’s admission application form.

This notice is issued in compliance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and RUA’s Personal Data Protection Policy. Please read it carefully before submitting your application.

By submitting your application, you confirm that you have read and understood this notice. Fields marked with an asterisk (*) on the form are mandatory — without this information, we may be unable to process your application.

1. What Personal data do we collect? 

Riyadh University of Arts (RUA) is the Data Controller responsible for your personal data collected through the admissions process. To evaluate your application and manage the admissions process, we collect the following categories of personal data:

• Identity & Contact Information
  • Full name, Date of birth and gender
  • National ID number or Iqama number (for non-Saudi residents)
  • Passport number (where applicable)
  • Nationality
  • Mobile phone number
  • Personal email address
• Academic & Qualification Data
  • High school certificate and grades / GPA
  • Name and type of previous educational institution(s)
  • Standardized test scores (e.g., Qiyas, IELTS/TOEFL etc. where applicable)
  • Academic transcripts and certificates
  • Portfolio or creative submissions (where required for specific programmes)
• Supporting & Preference Data
  • Programme of interest and preferred specialization
  • Application supporting documents (personal statement, letters of recommendation, personal ID attachment)
  • Emergency contact details
  • Information on disability or special learning needs to arrange appropriate support and accommodations
• Technical & Usage Data
  • IP address and device/browser information collected automatically when you use the application portal
  • Session and usage logs from the admissions system

1. Why Do We Collect Your Personal Data?

• • Admissions Processing: To receive, assess, and make decisions on your application for admission to RUA.
  • Eligibility Verification: To verify your academic qualifications and eligibility to study at RUA.
  • Communication: To contact you regarding the status of your application, interview invitations, admission decisions, and enrolment instructions.
  • Enrolment & Student Record Creation: If admitted, to create your student record and manage your enrolment and registration.
  • Legal & Regulatory Compliance: To comply with Saudi Ministry of Education requirements and other applicable regulations.
  • Institutional Planning: To produce statistical analyses for programme planning and development.
  • Accessibility & Support: To arrange appropriate accommodations for applicants with disabilities or special needs (where disclosed).
  • Safety & Security: To protect the integrity of the admissions process and prevent fraud.

Your personal data will not be used for purposes incompatible with those listed above without providing you with an updated privacy notice.

 

1. Legal Basis for Processing

RUA relies on the following lawful bases under the PDPL when processing your personal data:

• • Contractual Obligation: Processing is necessary to take steps at your request prior to entering into a contract (the enrolment agreement), including evaluating and deciding on your application.
  • Legal Obligation: Processing is required to fulfil RUA’s obligations under applicable Saudi laws and Ministry of Education regulations.
  • Consent: For optional data such as disability/health information for accommodations, or marketing communications, we rely on your explicit and freely given consent.
  • Legitimate Interest: For fraud prevention, application integrity, and institutional planning purposes, where these do not override your rights and interests.
  • Public Interest: Where required by an official authority or for purposes serving the public interest.

 

1. How Do We Collect Your Data?

We collect your personal data through the following means:

• • Directly from you, via the online admission application form.
  • From third parties, such as your previous educational institutions or standardized testing bodies, government bodies such as NAFATH where you have authorized us to obtain your records. 
  • Automatically, through the admissions portal when you interact with it 

 

1. Who Do We Share Your Data With?

We may share your personal data with trusted partners or service providers for specific purposes, including:

• • Legal compliance: We may share your personal data to comply with laws, regulations, or official requests from governmental or security authorities.
  • Research and analysis: We may share aggregated and anonymized data with third parties for research or statistical purposes.
  • Service provision and improvement: We may share your personal data with authorised third-party service providers assisting in operating or enhancing our services. Such parties are bound by contractual obligations to protect your data and use it only for the stated purposes.

1. Cross-Border Data Transfers

RUA processes and stores your personal data within the Kingdom of Saudi Arabia. In the limited event that a transfer outside KSA is necessary (for example, verification with an international academic institution), RUA will ensure such transfer is lawful and protected through appropriate safeguards, including Standard Contractual Clauses issued by SDAIA or equivalent mechanisms, in compliance with the PDPL.

1. How Long Do We Keep Your Data?

We retain your personal data only for as long as necessary to fulfil the purposes described in this notice, and in accordance with RUA’s data retention schedule and applicable regulations:

• • Unsuccessful applicants: Application data is retained for a defined period after the admission cycle to handle appeals or reapplication, after which it is securely deleted or anonymized.
  • Successful applicants / enrolled students: Your data is retained throughout your period of study and for the legally required period thereafter, in line with RUA’s institutional obligations.
  • Withdrawn applications: Data is retained for a reasonable period following withdrawal, then securely disposed of.

At the end of the applicable retention period, your personal data will be securely deleted or anonymized in accordance with RUA’s approved data destruction procedures.

1. How We Protect Your Data

All information you provide to us is stored on our secure servers. To protect your data at rest and in transit we have put in place state-of-the-art security measures, including appropriate administrative, technical, physical, and organizational controls to safeguard and keep your personal date confidential. This includes:

• • Access controls ensuring only authorised personnel can view your data. Encryption of data during storage and transmission.
  • Regular security assessments and audits.
  • Staff training on data-protection best practices.
  • We continually monitor and enhance our security measures to reduce risks and prevent unauthorised access, disclosure, alteration, or destruction of data.

However, you are solely responsible for ensuring that the data you submit through the website is complete, correct, and accurate.

1. Minors

If you are a minor, or if a legal guardian is acting on your behalf, your parent or legally recognized guardian must provide consent for the collection and processing of your personal data before you submit this application. RUA will take appropriate steps to confirm the validity of this consent during the admissions process.

1. Your Rights

Under the PDPL, you have the following rights in relation to your personal data:

• • Right to be Informed: You have the right to know how your personal data is collected and used. This Privacy Notice fulfils that obligation.
  • Right to Access: You may request access to the personal data RUA holds about you
  • Right to a Copy: You may request a legible copy of your personal data in a clear, readable format
  • Right to Rectification: You may request correction of inaccurate or incomplete personal data
  • Right to Erasure: You may request deletion of your personal data under certain circumstances
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing. Withdrawal will not affect the lawfulness of processing based on other legal bases
  • Right to Object / Restrict: You may object to or request restriction of certain processing activities
  • Right to Object to Marketing: You have the right to request that RUA stops sending promotional, advertising or awareness material through personal means of communication at any time
  • Right to Lodge a Complaint: You have the right to file a complaint with SDAIA if you believe your rights have not been upheld

Please note that some or all of the above rights may be subject to certain exceptions and exemptions specified by the relevant laws and regulations and will be evaluated on a case-by-case basis to ensure compliance with those exceptions.
In the event that you submit a request to exercise one of these rights, you will receive an initial response from the date of receipt of the request by contacting us via the following information:
Email: info@rua.edu.sa
Toll-free number: +966 800 118 9999

 

1. Updates to This Notice

RUA reserves the right to update this Privacy Notice from time to time to reflect changes in our practices, systems, or applicable regulations. Any material changes will be communicated to you and published on the RUA website. You are encouraged to review this notice periodically.

 

1. Applicant Acknowledgement

By proceeding with and submitting this application, I confirm that:

• • I have read and understood this Privacy Notice and am aware of how my personal data will be collected, used, and protected by RUA.
  • I consent to RUA collecting and processing my personal data for the purposes described in this notice.
  •  Where I have provided sensitive information (such as disability or health details), I give my explicit consent for this data to be used to arrange appropriate support and accommodations.
  • I understand that I may withdraw my consent for optional processing activities at any time by contacting info@rua.edu.sa, without affecting the lawfulness of processing carried out before withdrawal.
  • If you are a minor, or lack legal capacity, this acknowledgement must be completed by your parent or legally recognized guardian on your behalf.