Privacy Policy

1. About This Policy

EHP Academy (“we”, “us”, “our”) is a professional training and consultancy institution headquartered in Riyadh, Kingdom of Saudi Arabia. This Privacy Policy explains how we collect, use, store, and protect personal data you provide when visiting ehpacademy.com or contacting us for our services.

We comply with the Saudi Personal Data Protection Law (PDPL), issued by Royal Decree M/19 dated 9/2/1443H, and its implementing regulations.

2. Data We Collect

We collect personal data only when you voluntarily submit it through our contact or enquiry forms. This includes:

• Full name
• Email address
• Phone number (if provided)
• Organisation or institution name (if provided)
• Message content and enquiry details

We do not collect sensitive personal data (as defined under PDPL Article 2) and we do not collect data from individuals under 18 years of age.

3. How We Use Your Data

We use the data you provide solely for the following purposes:

• Responding to your enquiry or consultation request
• Providing information about EHP Academy programmes, services, and events you have expressed interest in
• Internal record-keeping and administration
• Sending follow-up communications directly related to your enquiry

We do not use your data for automated decision-making or profiling. We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Legal Basis for Processing

Under the PDPL, we process your personal data on the following bases:

• Consent — when you voluntarily submit a contact form or request information
• Legitimate interest — to respond to and administer professional enquiries
• Contractual necessity — where a training or consultancy engagement is in progress

5. Data Retention

We retain enquiry data for a maximum of three (3) years from the date of last contact, after which it is securely deleted unless a contractual or regulatory obligation requires longer retention. Active client engagement records are retained for the duration of the engagement plus five (5) years in accordance with Saudi commercial law.

6. Third-Party Service Providers

We engage the following third-party processors who may handle your data on our behalf, each under appropriate data processing agreements:

• Vercel Inc. — website hosting and infrastructure (United States)
• Resend Inc. — transactional email delivery (United States)
• Neon Inc. — cloud database hosting (United States)
• Google LLC — lead data logging via Google Sheets (United States)

Data transferred to processors outside the Kingdom of Saudi Arabia is subject to appropriate safeguards as required under PDPL Chapter 6.

7. Your Rights

Under the PDPL, you have the right to:

• Be informed of what personal data we hold about you
• Access a copy of your personal data
• Request correction of inaccurate data
• Request deletion of your data where no legitimate basis for retention exists
• Object to processing where processing is based on legitimate interest
• Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at info@ehpacademy.com. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS/TLS), access controls, and regular security reviews.

9. Cookies

This website uses essential cookies only. Please refer to our Cookie Policy for full details.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the date of the most recent revision. Continued use of our website after any changes constitutes acceptance of the updated policy.

11. Contact

EHP Academy
Riyadh, Kingdom of Saudi Arabia
Email: info@ehpacademy.com