HAMAH Education

Privacy Policy

Last updated: July 2026

This policy explains what personal data HAMAH Education collects, why we collect it, who else processes it, and what you can ask us to do with it. It is written to meet the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) and its implementing regulations.

Data controller: Husam Abdulaziz Ibrahim Almahmoud — حسام عبدالعزيز ابراهيم المحمود
Trading as: HAMAH Education
Freelance certificate (وثيقة عمل حر): FL-696770351
Country: Kingdom of Saudi Arabia
Privacy contact: hello@hamaheducation.sa

1. What we collect

Data	Why we collect it
Email address	To create and identify your account, verify it, send receipts, and contact you about your account.
Name (if you provide one)	To address you in the platform and on your receipt.
Password	To secure your account. It is stored only as a salted cryptographic hash — we cannot read it.
Enrollments and learning activity	To give you access to the courses you bought and to remember your progress.
Order records	To operate the sale, issue receipts, and meet our accounting and tax obligations.
Technical data (IP address, browser type, timestamps, error logs)	To keep the service running, secure it, and prevent abuse.

We never see or store your card details. Payment card data is entered directly on the hosted payment page of Moyasar, our SAMA-licensed payment provider, and is processed on their systems. We receive only a payment reference, the amount, the payment method type (for example “mada”), and whether the payment succeeded.

We do not collect national ID numbers, and we do not knowingly collect data revealing health, religious belief, or other sensitive categories.

2. Why we may process your data

To perform our contract with you — creating your account, granting course access, taking payment, sending receipts and service notices.
To meet legal obligations — keeping transaction and tax records for the period Saudi law requires.
For our legitimate interests — securing the platform, preventing fraud and account sharing, and improving our courses.
With your consent — marketing emails, which you may withdraw at any time.

3. Who else processes your data

We keep the list of processors deliberately short. Each acts on our instructions, for the purpose shown, and for no other purpose:

Processor	Purpose
Moyasar	Payment processing (Saudi Arabia)
Vercel	Website and application hosting
Neon	Database hosting
Cloudflare	Course video delivery and file storage
Resend	Sending transactional email

We do not sell your personal data, and we do not share it with advertisers or data brokers. We disclose data to a public authority only where a valid legal request obliges us to.

4. Transfers outside Saudi Arabia

Some of the providers above operate infrastructure outside the Kingdom, so your data may be processed abroad. Where that happens we rely on providers that offer contractual data protection commitments and appropriate security measures, consistent with the PDPL’s requirements for transfers outside the Kingdom.

5. Cookies

We use only what the service needs to work:

a session cookie that keeps you signed in after you log in;
short-lived security cookies that protect forms and sign-in against abuse.

We do not use advertising cookies, cross-site tracking, or third-party analytics profiling. Blocking essential cookies will prevent you from signing in.

6. How long we keep it

Account and learning data — for as long as your account exists, and then deleted on request or within a reasonable period after closure.
Order and payment records — retained for the period required by Saudi accounting and tax law, even after an account is closed.
Technical logs — kept for a short operational period, then discarded.

7. Security

Data is transmitted over encrypted connections (HTTPS/TLS), passwords are stored only as hashes, access to production systems is restricted, and card data never reaches our infrastructure. No system is perfectly secure, but if a breach affects your personal data we will notify you and the competent authority as the PDPL requires.

8. Your rights

Under the PDPL you may ask us to:

tell you what personal data we hold about you, and why;
give you a copy of it;
correct anything inaccurate or incomplete;
delete your data, where we are not required to keep it;
withdraw consent to marketing, at any time.

Email hello@hamaheducation.sa from the address on your account. We aim to respond within two business days and to resolve requests within 30 days. If you are not satisfied, you may complain to the competent supervisory authority in the Kingdom of Saudi Arabia.

9. Children

The platform is intended for university-level students. We do not knowingly create accounts for children under the age at which consent may be given independently under Saudi law. If you believe a child has an account, contact us and we will remove it.

10. Changes

If we change this policy, the “last updated” date above will change and material changes will be notified by email or on the platform.

11. Contact

Any privacy question or request: hello@hamaheducation.sa.

HAMAH Education · حسام عبدالعزيز ابراهيم المحمود · وثيقة عمل حر FL-696770351 · Kingdom of Saudi Arabia