سياسة الخصوصية وحماية البيانات Privacy Policy & Data Protection

This policy describes how the Okta Educational Management Platform collects, uses, and protects your personal data when you use our services.

By accessing or using the platform, you agree to the terms set out in this policy. If you do not agree with any provision, please discontinue use of the platform.

We collect the following types of data:

• Identity data: Full name, national ID number or student number.
• Contact data: Email address, mobile number, educational institution address.
• Usage data: Login logs, in-platform activity, IP addresses, browser and device type.
• Educational data: Grades, attendance records, timetables, and academic reports.
• Payment data: Subscription information (credit card details are never stored directly).

We use the collected data for the following purposes:

• Delivering and operating platform services efficiently and securely.
• Creating user accounts and managing access permissions.
• Generating academic and administrative reports for educational institutions.
• Sending platform-related notifications and alerts.
• Improving services and developing new features based on usage patterns.
• Complying with legal and regulatory requirements in Saudi Arabia.

We do not sell your personal data to any third party. We may share data only in the following cases:

• Technical service providers: Cloud hosting and email service partners bound by strict privacy policies.
• Legal requirements: When a court order or official request from a competent government authority is issued.
• Rights protection: To protect the rights of the platform or users in cases of fraud or serious violations.

We apply strict technical and organisational measures to protect your data, including:

• In-transit data encryption using TLS/SSL protocol.
• Encryption of sensitive data at rest in databases.
• Multi-level permission system controlling data access.
• Regular security audits and penetration testing.
• Scheduled backups and disaster-recovery plans.
• Two-factor authentication (2FA) for administrator accounts.

Under the Saudi Personal Data Protection Law, you have the following rights:

• Right of access: Request a copy of your personal data stored with us.
• Right of rectification: Correct any inaccurate or incomplete data.
• Right of erasure: Request deletion of your data where permitted by law.
• Right to object: Object to the processing of your data for direct marketing purposes.
• Right to data portability: Receive your data in a machine-readable format.

To exercise any of these rights, contact us at: privacy@tahdir.sa

We retain your personal data throughout your active subscription period, and for up to 5 years thereafter, or as required by applicable law.

You may request deletion of your data before this period expires, provided there are no legal obligations requiring its retention.

The Okta Tools Chrome extension runs tools from the Okta catalog inside the systems your organisation already uses (Noor and others). This section covers the extension specifically and complements the sections above.

What the extension sends

• A pairing code and a device label: when you pair your browser, the extension sends the code you generated from your account together with a short browser label such as “Chrome · macOS”, shown back to you in your list of paired browsers so you can tell one device from another. The full user-agent string is never sent.
• The pairing token: stored on your device and sent in the authorization header when fetching your organisation’s tool catalog, and to no other destination. You can revoke it at any time from the tools page, and it stops working immediately.

What the extension does not collect

• No browsing history and no page URLs. The extension reads the active tab’s URL to tell you whether a tool is running on it, and performs that comparison on your device; the URL is never sent to any server and is never stored.
• No page content, keystrokes or clicks, and no analytics tracking of any kind.
• No third party. The only destination is the Okta platform you configure yourself in the extension settings. Your data is never sold or transferred to anyone.

Tool code

The extension downloads the body of each tool you switch on, from the Okta platform or from the domain of the partner who develops it, and runs it in an isolated world inside the permitted sites only. No tool is enabled automatically; Chrome asks for your permission for each tool’s sites when you switch it on, and access is dropped automatically once no enabled tool still needs it. The developer of every tool is named on its card before you switch it on.

Everything the extension stores stays on your device in the browser’s local storage: the platform URL, which tools you enabled, a copy of the last successful catalog, and the pairing token. Removing the extension erases all of it.

For enquiries or complaints regarding our privacy policy, please contact us via:

• Email: privacy@tahdir.sa
• Phone: +966 560249160
• Address: Al-Ahsa, Kingdom of Saudi Arabia

We will respond to your enquiry within 5 business days.