Privacy policy
Standard wording, approved by the owner on: 2026-11-05. Version 1. If the two languages differ, the Arabic text prevails.
1. Who we are and what this policy covers
Madar is a service of Kifaya Telecommunications and IT Solutions (commercial registration 7054438085, address: Ibn Muqlah, Qurtubah District, Riyadh). This policy explains how personal data is processed in Madar: in the academy app, the public registration form, the parent page, this website and support messages.
2. Who is responsible for your data
2.1 The academy is the controller of the data about its players, their guardians, registration requests and its staff. It decides what it collects and why, and Kifaya processes it on the academy's behalf under the data processing agreement. If you have a question or a request about your data at an academy, contact the academy first; we help it answer.
2.2 Kifaya is the controller of: the contact details of the academies we contract with, the support messages we receive, our team's accounts, and the security and operating records we need to protect Madar.
3. The data processed in Madar for academies
| Whose | Data |
|---|---|
| Players | Name, birth date, gender if the academy records it, code, groups, subscriptions, attendance, invoices and payments, a photo only with the guardian's consent |
| Guardians | Name, mobile number, e-mail if given, relation, consents, invoices and payments |
| People who submit registration requests | What is written in the form: the child's and the guardian's details, the consent and its version |
| The academy's staff | Name, username, e-mail, role, sign-in records (including the IP address), what they do in the audit log |
Madar asks for no health data, no ID numbers and no home addresses.
4. Why it is processed, and on what basis
4.1 The data is processed to provide the academy's services: registration, groups and sessions, attendance, subscriptions and invoices, contact with guardians, and reports.
4.2 The academy decides the basis for processing; usually it is performing the contract with the guardian, legal obligations (such as keeping invoices), and consent where required (such as photos).
4.3 The data is not used for advertising, not sold, not used to build profiles and not used to train artificial intelligence models.
5. Children's data
Most players are children. So the academy obtains the guardian's consent where required, keeps only what it needs about the child, and keeps a photo only with the guardian's consent; withdrawing consent deletes the photo. The parent page shows one child to their own guardian only, with no photo and no phone number. When the child reaches legal capacity, they hold their rights in full.
6. Data Kifaya controls
- Academy contacts: name, e-mail and mobile number, for the contract, billing and notices.
- Support messages: what you send us, to answer you and improve the service.
- Security and operating records: the server's access logs keep no IP addresses, no secret links and no device information. A hashed fingerprint of the network address is kept briefly to limit repeated attempts, then deleted. The audit log records the IP address of each sign-in and security action by academy staff and by our team (and, for our team, the browser description), to detect unauthorised access; it is kept as long as the audit log.
- This website: collects no data, sets no cookies and uses no analytics.
7. Cookies
The Madar app uses only necessary cookies: the sign-in session, a token that protects against forged requests, the display language, and remembering that the setup list was closed. There are no tracking or advertising cookies.
8. Who receives the data
8.1 The sub-processors we use to run Madar, listed in Annex 3 of the data processing agreement: the server, the backup provider (which receives the backups encrypted), the e-mail provider, the error-reporting service (no users' personal data) and the uptime checker.
8.2 WhatsApp messages are sent by the academy's staff from their own phones; when an academy contacts you on WhatsApp, WhatsApp's terms apply to that message.
8.3 Public authorities, only when a law requires us.
9. Transfers outside the Kingdom
Madar runs on servers operated by Kifaya. Personal data may be processed outside the Kingdom as far as needed to provide the service, under the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, and the Standard Contractual Clauses issued by the Saudi Data and AI Authority. Backups are encrypted before they leave the server.
10. How long data is kept
| Data | Period |
|---|---|
| Players' and guardians' data | While the academy uses Madar; returned and deleted when the service ends |
| Registration requests that did not become players | 12 months from submission |
| Waiting list entries | personal details removed 30 days after the entry is closed; deleted after 12 months |
| Parent page links | deleted 12 months after they are turned off or the player is archived |
| Exported files | 24 hours |
| Attendance | the subscription and two years after it |
| Audit log | at least two years |
| Invoices and credit notes | the period tax law requires |
| Backups | 30 daily and 12 monthly copies; deleted data leaves them as they expire |
11. Security
We keep each academy apart in the database, check permissions on the server for every request, mask phone numbers for roles that do not need them, require two-step verification for administrators and our own team always and for accountants by default, encrypt connections and backups, and record every change in an audit log that cannot be edited. The details are on the "Security and privacy" page and in Annex 2 of the data processing agreement.
12. Your rights
12.1 Under the Personal Data Protection Law you may: be told how your data is processed, see it and receive a copy, ask for it to be corrected or completed, ask for it to be destroyed when it is no longer needed, and withdraw your consent where processing relies on it.
12.2 For data an academy holds, send your request to the academy; for what Kifaya controls, write to support@kifaya-it.com. We confirm who you are, answer within thirty (30) days, and tell you the reason if we need longer.
12.3 You may also complain to the Saudi Data and AI Authority.
13. Changes to this policy
We publish any change on this page with its version number and approval date, and tell the academies before a material change takes effect.
14. Contact us
E-mail: support@kifaya-it.com. Address: Ibn Muqlah, Qurtubah District, Riyadh.