Online Privacy Statement and Website Terms of Use
This page sets out how the University of New Haven – Riyadh (“the University,” “we,” “us”) collects, uses and protects personal data, and the terms under which you may use this website.
Part A — Privacy policy
1. About this policy
1.1 This privacy policy explains what personal data we collect when you use this website (sa.newhaven.edu and any associated application portals, inquiry forms and email communications), submit an inquiry or application, or otherwise interact with the University. It also explains how we use, store, share and protect that data.
1.2 The University processes personal data in accordance with the Saudi Personal Data Protection Law (Royal Decree M/19, dated 9/2/1443 H) and its implementing regulations, as amended from time to time (“PDPL”).
1.3 The English-language version of this policy is the authoritative version. Where an Arabic translation is published, it is provided for convenience only. In the event of any inconsistency, the English text shall prevail.
2. Data controller
2.1 The data controller for personal data collected through this website is the University of New Haven – Riyadh (NHU-Riyadh), a branch campus of the University of New Haven (West Haven, Connecticut 06516, USA), operated through New Haven Company (CR 7050512552), a foreign branch company registered in the Kingdom of Saudi Arabia. The registered office is at Building 8898, Al Olaya Street, Al Olaya District, Riyadh 12214, Kingdom of Saudi Arabia.
2.2 For questions about this policy or to exercise your data protection rights, contact the Branch Manager at branchmanager@sa.newhaven.edu.
3. Personal data we collect
3.1 We collect personal data that you provide directly to us when you submit an inquiry form, apply for admission, register as a student, pay fees, or contact us by email or telephone. This may include your name, national ID or passport number, date of birth, nationality, email address, telephone number, postal address, academic records, English proficiency test scores, employment history, payment information, photographs (including for student identification and campus access), personal statements, supporting documents and correspondence submitted as part of your application or enrollment.
3.2 We collect certain data automatically when you visit this website, including your IP address, browser type and version, operating system, referring URL, pages visited, time and date of your visit, and approximate geographic location derived from your IP address.
4. How we use your data
4.1 We use personal data for the following purposes:
(a) to process and evaluate applications for admission;
(b) to administer student enrollment, registration, and academic records;
(c) to process tuition payments, issue invoices, and manage student accounts;
(d) to communicate with you about your application, enrollment, inquiry, or request for information;
(e) to provide academic and student support services;
(f) to comply with legal and regulatory obligations, including reporting to the Saudi Ministry of Education, ZATCA, and other government authorities;
(g) to improve and administer this website;
(h) to send you information about University programs, events, and services that may be of interest to you, where you have given your prior consent to receive such communications.
4.2 We process your personal data on the following legal bases under the PDPL:
(a) where processing is necessary to perform a contract to which you are a party (e.g., your enrollment agreement);
(b) where processing is necessary to comply with a legal obligation (reporting to the Ministry of Education, ZATCA, and other regulators);
(c) where you have given your consent (for marketing communications and non-essential cookies);
(d) where processing is necessary to protect the security and proper functioning of the University’s website and systems (for example, server logs and cybersecurity monitoring).
4.3 Where applicants are under the age of 18 at the time of application, the University will obtain the consent of a parent or legal guardian before processing their personal data, as required by the PDPL.
4.4 The University may collect sensitive personal data (for example, health information provided in support of a disability accommodation request or a medical deferral, photographs used for campus access systems, or data that may incidentally reveal racial or ethnic origin, such as nationality). Sensitive personal data is processed only where you have given explicit consent or where processing is required by law, and is subject to additional safeguards including restricted access and enhanced security measures.
5. Sharing your data
5.1 We may share your personal data with the following categories of recipient:
(a) the University of New Haven (West Haven, Connecticut 06516, USA), as the parent institution, for the purposes of academic administration, degree conferral, and institutional accreditation;
(b) Saudi government and regulatory bodies, including the Ministry of Education, ZATCA, and the Education and Training Evaluation Commission, where required by law;
(c) accreditation bodies, including NECHE and AACSB, where necessary for institutional or program accreditation;
(d) scholarship sponsors, employers, or other third-party funders who are paying your tuition, to the extent necessary to administer the funding arrangement;
(e) service providers acting on our behalf, such as I.T. hosting providers, payment processors, and analytics services (including Google, which processes website analytics data on servers that may be located outside the Kingdom of Saudi Arabia), under written data processing agreements that require them to process data only on our instructions and to implement appropriate technical and organizational safeguards;
(f) external collection agencies, where a student account has been referred for collection of unpaid fees;
(g) law enforcement or judicial authorities, where required by law or court order.
5.2 Personal data is transferred to the University of New Haven in the United States for the purposes described in clause 5.1(a). This transfer is necessary for the performance of your enrollment agreement (or, for prospective applicants, for the purpose of evaluating your application with a view to entering into such an agreement), and for the University to confer degrees and maintain accreditation. Before making any cross-border transfer, the University conducts an assessment of the level of protection provided in the receiving country and implements appropriate safeguards, which include contractual data protection clauses between the transferring and receiving entities. Cross-border transfers are made in accordance with Articles 29 and 30 of the PDPL implementing regulations, and SDAIA is notified where required.
5.3 Where personal data is transferred to any other recipient outside the Kingdom of Saudi Arabia (for example, cloud hosting providers or analytics services), the same safeguards apply. The University conducts data protection impact assessments where required by the PDPL, including before undertaking any processing that is likely to result in a high risk to data subjects.
6. Data retention
6.1 We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. In general:
(a) inquiry and expression-of-interest data is retained for two years from the date of submission;
(b) unsuccessful application data is retained for two years from the date of the admissions decision;
(c) student academic records are retained for the period required for degree verification, accreditation and regulatory compliance, which may extend beyond the student’s period of enrollment;
(d) financial records are retained for the period required by ZATCA and applicable Saudi tax and commercial regulations (currently at least seven years);
(e) website analytics data is retained in anonymized or aggregated form and is not linked to identifiable individuals after 26 months.
When personal data is no longer required for these purposes, it is securely deleted or irreversibly anonymized.
7. Cookies and Analytics
7.1 Definitions:
(a) "User" means a unique instance of a browser, application, or similar technology.
(b) "User Cookie" means the User identifier (of which a cookie is one example) associated with a User for remarketing or similar audiences.
(c) "Remarketing Lists" means a list of User Cookies created or otherwise obtained by you and used in connection with remarketing or similar audiences.
(d) "Similar Audiences Lists" means a list of Users created by Google based on a Remarketing List for use in connection with similar audiences.
(e) "Properties" means properties or content on which advertisements are shown.
7.2 This website uses cookies. Cookies are pieces of information stored by your web browser on behalf of a Web site and returned to the Web site on request. This site may use cookies for two purposes: to carry data about your current session at the site from one web page to the next and/or to identify you to the site between visits. You can change the cookie behavior of your browser in the browser preferences, choosing to accept all cookies, to accept cookies with prompting, to accept all cookies from specific websites only, or to reject all cookies. Some websites or web pages may not function properly if cookies are turned off. Unless otherwise notified on this site, we will not store data, other than for these two purposes, in cookies. Cookies remain on your computer, and accordingly we neither store cookies on our computers nor forward them to any external parties. Unless otherwise notified on this site, we do not use cookies to track your movement among different Web sites and do not exchange cookies with other entities.
7.3 This website uses the following categories of cookie:
| Category | Purpose | Duration |
|---|---|---|
| Strictly necessary | Required for the website to function (session management, security, language preference). | Session or up to 12 months |
| Analytics | Help us understand how visitors use the site (pages visited, time on site, traffic sources). We use Google Analytics, which does not store full IP addresses. | Up to 26 months |
| Functional | Remember your preferences (language, font size) to improve your experience. | Up to 12 months |
7.4 When you first visit this website, a cookie consent banner will ask you to accept or decline non-essential cookies (analytics and functional). Strictly necessary cookies are set without consent because the website cannot function without them. Analytics and functional cookies are not set unless you consent. You may change your preferences at any time by clicking the cookie settings link in the website footer.
7.5 University of New Haven Google Adwords and Remarketing Privacy Policy
(a) University of New Haven uses all features of Google Analytics for Display Advertisers. That includes obtaining specific visitor cookie data, such as the source, medium and keyword used to visit our website. Google Analytics does not store any visitor specific data and we will not use visitor specific data in any way related to Google Analytics, Google Adwords, and Remarketing.
(b) University of New Haven uses remarketing with Google Adwords and analytics to display content specific advertisements to visitors that have previously visited our site when those visitors go to other websites that have the Google Display Network implemented.
(c) University of New Haven and other third-party vendors, including Google, use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick cookie) together to inform, optimize, and serve ads based on visitor’s past visits to our website.
(d) We take our users’ privacy very seriously. We feel that certain personal information should always be kept private, so we’ve developed restrictions around the types of ads where we don’t allow remarketing. When creating remarketing lists, we can’t use any sensitive information about users. This includes information such as their financial status, sexual orientation, and other sensitive categories.
(e) As Adwords advertisers, we are restricted from and will not perform the following actions:
(ii) Creating a remarketing list or creating ad text that specifically targets users in ways that are outlined as "prohibited" in the categories below
(iii) Visitors can opt out of Google Analytics for Display Advertisers and opt out of customized Google Display Network ads by visiting the Ads Preferences Manager in Google, or by visiting the Network Advertising Initiative opt-out page.
8. Your rights
8.1 Under the PDPL, you have the following rights in relation to your personal data:
(a) the right to be informed about how your data is collected and used;
(b) the right to access your personal data held by the University;
(c) the right to request correction of inaccurate or incomplete data;
(d) the right to request deletion of your data, subject to legal retention requirements;
(e) the right to withdraw consent, where processing is based on your consent;
(f) the right to object to processing of your personal data in certain circumstances;
(g) the right to request restriction of processing;
(h) the right to receive your personal data in a structured, commonly used format (data portability);
(i) the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects concerning you;
(j) the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your data protection rights have been violated.
8.2 To exercise any of these rights, contact branchmanager@sa.newhaven.edu. We will acknowledge your request promptly and respond in full within 30 calendar days, or within such shorter period as the PDPL implementing regulations may require. We may ask you to verify your identity before processing your request.
9. Data security
9.1 The University implements appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure or destruction. These measures include encryption of data in transit and at rest, access controls, regular security assessments and staff training on data protection. No method of electronic transmission or storage is completely secure, and the University cannot guarantee absolute security.
9.2 In the event of a personal data breach that poses a significant risk to data subjects, the University will notify SDAIA without undue delay and within the timeframe prescribed by the PDPL implementing regulations. Where the breach is likely to result in a high risk to the rights of affected individuals, the University will also notify those individuals directly.
Part B — Website Terms of Use
10. Acceptance of terms
10.1 By accessing and using this website (sa.newhaven.edu and any associated pages), you agree to be bound by these terms. If you do not agree, you should not use the website.
10.2 The University reserves the right to amend these terms at any time. Amendments take effect from the date of publication on this page. Your continued use of the website after any amendment constitutes acceptance of the revised terms. Where the University makes a material change to how personal data is processed under Part A, it will notify registered users by email and display a prominent notice on this website. Material changes to data processing will not apply retroactively to data already collected without your consent.
10.3 The English-language version of this website is the authoritative version. Where an Arabic translation is published, it is provided for convenience only. In the event of any inconsistency, the English text shall prevail.
11. Use of the website
11.1 This website is provided for informational purposes to prospective and current students, their families, staff, partners and members of the public. You may browse, download and print content from this website for your own personal, non-commercial use.
11.2 You must not use this website in any way that is unlawful, fraudulent or harmful, or in connection with any unlawful, fraudulent or harmful purpose or activity. In particular, you must not:
(a) attempt to gain unauthorized access to any part of the website, the server on which it is hosted, or any connected database or system;
(b) use the website to transmit or distribute malicious software, spam or any unsolicited communications;
(c) reproduce, mirror, frame or scrape any part of the website without the University’s prior written consent;
(d) use automated tools (bots, crawlers or scrapers) to access the website except as permitted by the robots.txt file;
(e) impersonate any person or entity, or misrepresent your identity or affiliation with any person or entity.
12. Intellectual property
12.1 All content on this website, including text, images, graphics, logos, icons, video and audio material, is the property of the University of New Haven or its licensors and is protected by applicable copyright, trademark and intellectual property laws.
12.2 The University of New Haven name, logo, and associated trademarks may not be used without the prior written permission of the University. Nothing on this website grants any license or right to use any trademark without the express written consent of the University or the relevant third party.
13. Accuracy and disclaimers
13.1 The University makes reasonable efforts to ensure that the information on this website is accurate and up to date. However, the University does not warrant that the content is complete, current or free from error, nor that the website will be available without interruption or free from viruses or other harmful components. To the extent permitted by the laws of the Kingdom of Saudi Arabia, the University accepts no liability for any inaccuracy, omission or delay in updating the content of this website. Nothing on this website constitutes an offer to contract; an offer of admission is made only through a formal offer letter issued by the University’s admissions office.
13.2 Information about programs, tuition, fees, schedules, admissions requirements and other matters is subject to change without notice. The authoritative source for tuition and fee information is the tuition and financing page and the payment terms and conditions. In the event of any conflict between general website content and those pages, the tuition page and payment terms prevail.
14. Third-Party Websites
14.1 This website may contain links to third-party web sites or web-based resources. These links are provided for convenience and information only. We do not control these sites and resources, we do not endorse them, and we are not responsible for their availability, content, or delivery of services. In particular, external sites are not bound by the University's online privacy policy; they may have their own policies or none at all. Often you can tell you are leaving a University of New Haven Web site by noting the URL of the destination site. You access third-party websites at your own risk and subject to those sites’ own terms and privacy policies.
15. Limitation of liability
15.1 To the fullest extent permitted by the laws of the Kingdom of Saudi Arabia, the University shall not be liable for any indirect, incidental, consequential or special loss or damage arising from your use of or inability to use this website, including loss of data, loss of revenue or loss of opportunity.
15.2 Nothing in these terms excludes or limits the University’s liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be excluded or limited under the laws of the Kingdom of Saudi Arabia.
16. Governing law and severability
16.1 These terms and this privacy policy are governed by the laws of the Kingdom of Saudi Arabia. Any dispute arising under or in connection with these terms shall be subject to the exclusive jurisdiction of the competent courts in Riyadh, Kingdom of Saudi Arabia.
16.2 If any provision of these terms or this privacy policy is found by a competent court or regulatory authority to be invalid, unlawful or unenforceable, that provision shall be deemed modified to the minimum extent necessary to make it valid, lawful and enforceable. If it cannot be so modified, it shall be deemed deleted. The validity and enforceability of the remaining provisions shall not be affected.
17. Contact
For questions about this privacy policy, these website terms of use or to exercise your data protection rights, please contact the Branch Manager at branchmanager@sa.newhaven.edu.
Postal address: New Haven Company, Building 8898, Al Olaya Street, Al Olaya District, Riyadh 12214, Kingdom of Saudi Arabia.