The Decision Support Center (the ‘Center’) is committed to protect users’ personal data and privacy through measures that are in accordance with the applicable laws and regulations of Saudi Arabia. Accordingly, the Use of the Center's website (the Website) constitutes implicit consent by personal data owners to the user's privacy policy.

Article 1: Personal Data and Methods of Collection
Data collection includes, but is not limited to, the following types of information:
• Personally Identifiable Information: Full name, national ID number, residency, passport, or family card number, date and place of birth.
• Contact Information: Phone number, email address, and social media platform accounts.
• Electronic Data: IP address and geographic location information.
• Professional Data: Employment history, educational qualifications, and training certificates.
• Social Data: Marital status, number of dependents, and emergency contact details.
Data is collected, both directly and indirectly, through users’ interactions, including filling out forms, providing information to the Center, sending information via the website, or communicating through phone, email, the Center’s social media channels, or other means.

Article 2: Reasons for Collecting and Processing Personal Data
Personal Data is collected and processed for regulatory, organizational, improvement, and development purposes, including, but not limited to:
• Fulfillment of data requirements for contractual purposes.
• Fulfillment of the required data for applying to programs and training courses.
• Issuance of invitations for workshops, training courses, conferences, and other communications.
• Compliance with regulatory, statutory, or judicial requirements.
• Addressing inquiries and complaints related to personal data.

Article 3: Regulatory Basis for Collecting and Processing Personal Data
Personal Data is collected and processed in accordance with the applicable laws, regulations and directives of Saudi Arabia, as well as with the consent of the personal data owner. The data owner may withdraw consent for the collection and processing of personal data at any time unless there is another regulatory basis for its processing.

Article 4: Rights of the Personal Data Owner
Pursuant to the laws and directives of Saudi Arabia, the personal data owner has the following rights, which may vary depending on the purpose for which personal data was collected, used, and processed:
1. Right to Be Informed: The data owner has the right to be informed about how their personal data is collected, the regulatory basis for its collection and processing, how it will be used, stored, and destroyed, and who it may be shared with. Detailed information is available in this policy or can be requested through the contact details in Article 8, "Inquiries and Communications."
2. Right to Access Personal Data: The data owner may request a copy of their personal data through the contact information provided in Article 8, "Inquiries and Communications." The requested data will be provided free of charge within thirty (30) business days via email.
3. Right to Receive Data in a Legible Format: The data owner has the right to obtain their data in a legible and clear format, in accordance with relevant regulations, through the contact information specified in Article 8 (Inquiries and Communication). This data will be provided free of charge within thirty (30) business days via email.
4. Right to Request Data Destruction: The data owner has the right to request the destruction of their personal data unless a regulatory basis retention for a specific period.
5. Right to Correct or Update Personal Data: The data owner may request corrections or updates to their personal data if they believe it is inaccurate, incomplete, or outdated. Such requests should be made through the contact information provided in Article 8 (Inquiries and Communication), and the data will be reviewed and updated within thirty (30) business days, with the data owner being notified via email.

Article 5: Duration of Retention and Destruction of Personal Data
• Personal data will be retained for as long as necessary to fulfill its intended purpose, comply with regulatory requirements, and meet legal, accounting, or reporting obligations. The data will be securely destroyed after its purpose has been achieved, ensuring it is irretrievable. The Center may retain the data after its intended purpose has been completed, ensuring that any identifiable information is removed.
• All servers storing personal data are secured in accordance with the control issued by the National Cybersecurity Authority.

Article 6: Disclosure of Personal Data
• Personal data will only be accessible to authorized Center employees who need it to perform duties related to the purposes outlined in Article 2, "Reasons for Collecting and Processing Personal Data."
• Except as permitted by the Personal Data Protection Law, no personal data will be shared, sold, published, or transferred to third parties without the explicit consent of the data owner. Access to personal data will be restricted to authorized personnel only.

Article 7: Changes to Privacy Notice
The Center reserves the right to update or make changes to this Privacy Policy at its discretion, whether minor or substantial, without prior notice. Continued use of the website by the personal data owner after such changes will be considered as acceptance of the updated Privacy Policy.

Article Eight: Inquiries and Communication
For any inquiries or complaints related to personal data, contact the Center via the following email: DMO@dsc.gov.sa.

Relevant Legislation:
• The Personal Data Protection Law and its Implementing Regulations.
• National Data Governance Policies.
• Any other laws, regulations, or policies related to personal data protection in force in the Kingdom of Saudi Arabia.

Issue No. (1.1): 13 Ramadan 1446 corresponding to March 13, 2025.