1. Who processes your data
The controller of the personal data collected through this website is the entity set out below. It operates qimah-academy Academy and decides why and how your data is processed.
| Detail | Value |
|---|---|
| Operated by | Qimah-academy Academy |
| Parent company | Qimah-academy Financial Consultancy |
| Founder | Saad Al Rifai |
| Activity | Professional training in finance, valuation and reporting |
| Address | Al Qairawan District Riyadh 12321, Kingdom of Saudi Arabia |
| P.O. Box | 13532 |
| Phone | +966 53 144 3733 |
| Unified number | 920028882 |
| academy@qimah.sa | |
| Main website | qimah.sa |
Questions about this policy, or a request to exercise any of the rights in section 8, can be sent to the academy address above.
This policy covers this website only. It does not cover the separate systems the academy uses for enrolment, attendance and certificate issue, which are described to you when you register for a track.
2. The law that applies
Processing described here is governed by the Personal Data Protection Law of the Kingdom of Saudi Arabia, issued by Royal Decree M/19 dated 9/2/1443H and amended by Royal Decree M/148 dated 5/9/1444H, together with its Implementing Regulations. The supervisory authority is the Saudi Data and Artificial Intelligence Authority, SDAIA.
The lawful bases relied on are your consent, the performance of a contract to which you are a party or steps taken at your request before entering one, and the legitimate interests of the controller where those do not prejudice your rights. Each purpose in section 4 names the basis it stands on.
3. What is collected and what is not
3.1 Data you type into the form
The enrolment form collects your first name, your family name, your e-mail address and your mobile number, all of which are required in order to answer you, plus an optional comment. There are no other fields.
3.2 Data you type into a review
If you write a review, the form collects the name you choose to publish under, a rating, the track or workshop you attended if you name one, and the review text. The month and year are recorded automatically. Do not put a phone number, an address or anything else you would not want published into a review, because the purpose of a review is publication.
3.3 Data collected automatically
Web server logs record your IP address, the time of the request, the page requested, the referring page and your browser identification string. These are technical records kept to run the site and to investigate faults and abuse.
3.4 Data we do not collect
- No payment data. This site takes no payments. There is no checkout, no card field and no payment provider on any page. Fees are settled with the academy directly after a written quotation.
- No financial information about you. The form does not ask about your income, your holdings or your obligations, and you should not put that in the comment field. It is not needed to answer an enquiry about a training track and we do not want it.
- No national identity or Iqama numbers. Identification is checked once, in person at registration, from the original document. It is never requested through this website.
- No profiling or automated decisions. Nothing on this site makes an automated decision about you.
4. Purposes of processing
| Purpose | Data | Basis | Kept for |
|---|---|---|---|
| Calling you and holding the placement call | First name, family name, e-mail, mobile number, comment | Steps at your request prior to a contract | 12 months from the last contact, then deleted |
| Publishing a review you wrote | Published name, rating, track, review text, month and year | Your consent, given by ticking the box on the review form | Until you ask for it to be removed |
| Operating the site, diagnosing faults, security | Server log data | Legitimate interest in a working and secure site | Up to 12 months |
| Anonymous visit statistics | Analytics identifiers and page events | Your consent, through the cookie banner | Up to 14 months |
| Measuring advertising campaigns | Advertising identifiers and conversion events | Your consent, through the cookie banner | Up to 13 months in each platform |
Your data is not used for any purpose beyond those listed here. It is not sold, rented or exchanged, and it is never passed to a financial firm, a broker or any third party wishing to contact you about their own products.
5. Reviews written on this site
A review is published under the name you choose, next to the rating, the track you name and the month you wrote it. Nothing else about you is attached to it.
Where sending is switched on, a review reaches the academy and is read before it appears to other visitors. Your own review is also kept in your browser so that it is still shown to you when you come back, which is why it appears in the list immediately even before anyone else can see it. If sending is not switched on, the review stays in your browser only, and the form says so above the button before you submit.
The rating shown above the review list is the average of the reviews present, and nothing else. No rating is imported from any other listing, any other brand or any review platform.
To have a published review removed, write to the academy at the address in section 1. You can remove the copy held in your own browser at any time by clearing site data.
6. What we will not send you
Sending the form gives us a reason to call you about the track you asked about. It does not sign you up to anything else.
You will not be added to a marketing list on the strength of an enquiry, and you will not receive material about financial products, because the academy sells none and takes no commission from anyone who does. If we ever want to send you new intake dates we will ask separately, and you can refuse without losing anything.
If we call and you say you are not interested, that closes the matter and you are not called again about the same enquiry.
7. Cookies
The banner you saw offers three equally weighted choices: reject everything beyond what is necessary, customise the categories, or accept everything. Refusing costs you nothing, no part of the site is withheld, and the banner does not reappear on every page.
Until you choose, and if you reject, Google Consent Mode runs with ad_storage, ad_user_data, ad_personalization, analytics_storage and personalization_storage all denied, and advertising data redaction switched on. The advertising pixels are not loaded into the page at all in that state.
| Name | Set by | What it does | Category | Lifetime |
|---|---|---|---|---|
| qa_consent | First party, this site | Stores which cookie categories you allowed, with a version number and a timestamp. | Necessary | 12 months |
| qa_lang | First party, this site | Remembers whether you chose the Arabic or the English version. | Necessary | 12 months |
| qa_pending | First party, this site | Holds your request for one browser session so the thank you page can show it back if automatic sending is not configured. | Necessary | Until the tab closes |
| qa_my_reviews | First party, this site | Holds a review you wrote so it is still shown to you when you come back. | Necessary | Until you clear site data |
| _ga, _ga_* | Google Analytics | Distinguishes visitors so visits can be counted anonymously. | Measurement | Up to 14 months |
| _gcl_* | Google Ads | Attributes a visit to an advertising click for conversion measurement. | Advertising | Up to 90 days |
| _fbp | Meta | Attributes a visit to a Facebook or Instagram campaign. | Advertising | Up to 90 days |
| _ttp, ttclid | TikTok | Attributes a visit to a TikTok advertising click. | Advertising | Up to 13 months |
| _scid | Snapchat | Attributes a visit to a Snapchat campaign. | Advertising | Up to 13 months |
| X, Taboola and Outbrain identifiers | X, Taboola, Outbrain | Attribute a visit to an advertising placement. | Advertising | Up to 13 months |
6.1 The platforms named
Where campaigns are running, conversion measurement may be provided by Google Ads, Meta, TikTok, Snapchat, X, Taboola and Outbrain. Each is loaded only after you consent to the advertising category, each is a separate controller for what it then collects, and each publishes its own privacy policy.
6.2 Changing your choice
Select Cookie settings in the footer of any page. Your choice is recorded with a version number and a timestamp so it can be shown when and to what you consented. You can also delete site data in your browser settings.
8. Your rights
Under the Personal Data Protection Law you have the right to be informed of the legal basis and purpose of collection, to access your data and request a copy, to request correction of anything incomplete or inaccurate, to request destruction where the data is no longer needed for the purpose it was collected for, and to withdraw consent at any time where consent is the basis, without affecting what was lawful before the withdrawal.
Requests are answered within the period set by the Implementing Regulations, and identity is verified before data is disclosed or destroyed so that nobody else can obtain or delete your data by asking. If you are not satisfied with the response you may complain to SDAIA.
Where you have completed a track, the academy is required to keep the training and attendance record that supports the certificate it issued. A request to destroy data does not extend to a record we are obliged to retain, and we will tell you plainly which part that is.
9. Security, retention and transfers outside the Kingdom
The site is served over HTTPS and form submissions travel over an encrypted connection. The site holds no database of learners, because it has no learner area and no login.
Retention periods are in the table in section 4. When a period ends the data is deleted, or reduced to figures that no longer identify anyone.
Some analytics and advertising providers process data outside the Kingdom. Transfers are made in line with the Personal Data Protection Law and the SDAIA regulations on data transfer. If you would rather no data left the Kingdom through this site, reject the analytics and advertising categories and nothing is sent to them.
No system is beyond failure. If a breach occurs that is likely to harm you, the controller will notify SDAIA and the affected individuals as the Implementing Regulations require.
10. Children
Enrolment is for adults aged eighteen and over, this site is not directed at children, and our advertising campaigns do not target anyone below that age. We do not knowingly collect data about anyone under eighteen. If you believe a child has sent us data, tell us and it will be deleted.
11. Changes to this policy
If this policy changes, the date below is updated and the new text is published here. A change that materially affects how your data is used will also reset the cookie banner, so you are asked again rather than moved silently onto new terms.
Last updated: 30 September 2026. The companion document is here: Cookie policy