Legal
Privacy
What this platform records about you, why, and what you can ask us to do about it.
Last changed
1Who this is about
Enhance Training Institute, Dammam, Kingdom of Saudi Arabia, the strategic arm of Origin Group. We decide what this platform records and why, which under the Personal Data Protection Law makes us the controller of it.
Questions about anything on this page go to enhance@eti.sa.
This page is about learners, clients and visitors. The institute's own staff also have employment records on this platform; those are not covered here.
2What we record, and why
When you create an account: your name, your email address, and a phone number if you give us one. Your password is never stored, only a scrypt hash of it, which cannot be turned back into the password.
When you enrol: which course and which batch, what you paid and when, and the invoice raised against it. Card details are never recorded here; they are entered with the payment provider and this platform is told only whether the payment succeeded.
As you study: attendance, progress through lessons, submitted work and grades, and any certificate issued to you. A certificate's verification page shows your name, the course and the date to anyone holding its code, that is what makes it verifiable.
When you sign up for something, an event or webinar, a campaign's interest list, the newsletter, a waiting list, or the "is this course right for me" check: your name, your email, and whatever else that form asked for, such as a phone number, your organisation, your job title or how you heard of us. However many forms you fill in, you are kept as one person, so we neither write to you twice nor lose what you told us.
The "is this course right for me" check keeps your answers and the courses it showed you with the match each was given, and passes them to an advisor. That is what the check is for, and it says so before you send it.
Feedback forms keep your answers against your name, unless the form says it is anonymous; on an anonymous form we record only that you replied, never what you said.
Online sessions and webinars: to give you a joining link that is yours alone, your name and email go to the service that hosts the meeting. Afterwards its attendance report, who joined and for how many minutes, becomes the list of who came. A recording, where there is one, is reached only through your own link, and only for a limited time.
Online training sessions are recorded, and the meeting service shows that on screen while it is happening. After the session the recording is moved into the institute's own storage, where only its staff and the session's trainer can watch it. It is not published.
Meetings with the institute's staff: if a member of staff invites you from outside, your name, your email and the language you read are kept with that meeting and used to send you the invitation and any change to it. An online meeting may use the meeting service's AI summary, which the meeting shows on screen when it is on; the summary goes to the member of staff who called the meeting, as a draft of their notes. The meeting may also be recorded if its host chooses, which the meeting service shows too.
Consent to marketing is kept as a record: the words you were shown, in the language you were shown them, the page, the time and the address it came from. The newsletter asks you to confirm by email before it sends anything.
The short links we share on posts, ads and messages, and the QR codes on our campaigns, count visits by link, source and day. They record nothing about who you are.
Each page of this site counts how many times it is read, by day and by where the visit came from: a link we shared, or the site that sent you, such as a search engine. The count holds nothing about you: no cookie, and neither your internet (IP) address nor anything else that could tell one reader from another is kept with it.
While a browser tab stays open, the tab itself remembers how it arrived, the same link or site, in its own storage and not in a cookie. If you send us an enquiry or make a booking from that tab, how it arrived is noted with it, so we know which posts reach people. Closing the tab forgets it.
Because the platform has to defend itself: the IP address a sign-in, sign-up or password-reset request came from, used to rate-limit abuse. An immutable log of administrative changes, who changed what, and when, which is how a mistake can be traced rather than argued about.
We do not run advertising, we do not profile you, and nothing here is sold.
3Who else sees it
Email is delivered by Resend. They receive the address a message is going to and its contents, an enrolment confirmation carries your name, your course and what you paid.
Payments are handled by the payment provider, who receives what is needed to take the payment.
Online sessions are hosted by a meeting service, which receives your name and email to issue your joining link, and reports who joined and for how long.
The platform runs on hosting we rent, and files are held in object storage. Those providers can technically reach the data they store, and are contractually bound not to use it.
Some of these providers operate outside the Kingdom. Where they do, that transfer is subject to the Personal Data Protection Law, and confirming which providers may lawfully be used is open work rather than a settled question.
Nobody else receives your data except where the law requires it.
5How long we keep it
Financial records (invoices and payments) are kept for as long as tax and commercial law requires them to be.
Certificates and the records behind them are kept indefinitely on purpose: a certificate anyone can verify is only worth something if the record behind it outlives the course.
Retention for everything else has not been set. It is open work, and until it is decided we would rather say so than publish a period nobody is keeping to.
6What you can ask for
Under the Personal Data Protection Law you can ask to see what we hold about you, to have it corrected, to have it destroyed, and to object to how it is used. You can also ask for it in a portable form.
Ask at enhance@eti.sa. We will need to be satisfied you are who you say you are before we act, because handing someone else's record to the wrong person is the failure this whole page is about.
To stop marketing, use the link at the foot of any marketing message: one click stops all of it. Messages about something you signed up for, a confirmation, a reminder, a joining link, still come, because stopping them would cost you the thing itself.
Some of these have limits. We cannot destroy an invoice the law requires us to keep, and we will say so plainly rather than quietly not doing it.
7How it is protected
Passwords are stored as scrypt hashes with per-password salts. Password-reset links are stored only as hashes, expire in an hour, and can be used once.
Changing your password signs out every other session.
Access to the back office is decided by a single policy that every screen and every action asks, rather than by each page deciding for itself.
No system is beyond reach. If personal data here is ever exposed, we will say so, to the people affected and to the regulator, rather than hoping nobody notices.
8If this changes
The date at the top is when the wording last changed. Where a change affects what we do with data already collected, we will tell account holders directly rather than relying on this page being re-read.
Anything on this page that is not clear: enhance@eti.sa.