1.0 STATEMENT OF INTENT

Music House KSA (hereinafter "the Company") is committed to the highest standards of data sovereignty and privacy. This policy outlines our protocols for the collection, processing, and protection of personal data in accordance with the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL).

2.0 DATA COLLECTION ARCHITECTURE

We collect information across our three service pillars (Operations, Consultancy, and Academy) via our digital interfaces.

• 2.1 Personal Identification: Name, national ID/Iqama number, contact details, and date of birth.

• 2.2 Financial Data: Payment history and billing information processed via secure, encrypted third-party gateways.

• 2.3 Academic & Performance Data: Student progress reports, attendance records, and multimedia (photo/video) of performances for institutional archives.

• 2.4 Digital Metadata: IP addresses, cookies, and usage patterns gathered to optimize the digital user experience.

3.0 PURPOSE OF PROCESSING

The Company processes data solely for the following "Institutional Mandates":

1. Service Delivery: To manage academic residencies, track student progress, and fulfill B2B consultancy contracts.

2. Institutional Reporting: To provide anonymized data to our parent company and government partners regarding cultural impact.

3. Communication: To provide updates via the "Admissions Funnel" regarding schedule changes, masterclasses, and performance opportunities.

4. Security: To ensure the safety of our physical facilities and digital infrastructure.

4.0 DATA SHARING & DISCLOSURE

Music House KSA does not sell or trade personal data. Data disclosure is strictly limited to:

• Astra Group: Internal compliance and strategic oversight.

• Government Partners: Shared only as required by national cultural mandates.

• Service Providers: Third-party tech partners who are contractually bound to maintain KSA-standard data protections.

5.0 DATA SOVEREIGNTY & STORAGE

In alignment with NDMO guidelines, Music House KSA prioritizes Local Data Residency.

• Primary Storage: We utilize secure servers located within the Kingdom of Saudi Arabia.

• Retention: Data is retained only for the duration necessary to fulfill the Academic Residency or the specific term of a B2B contract, after which it is securely archived or purged.

6.0 RIGHTS OF THE DATA SUBJECT

Under the PDPL, our Resident Artists and Partners hold the following rights:

• The Right to Access: You may request a summary of the personal data we hold.

• The Right to Correction: You may request the updating of inaccurate or incomplete data.

• The Right to Destruction: You may request the deletion of data once the purpose for collection has ended (subject to statutory retention requirements).

• The Right to Withdraw Consent: You may opt-out of marketing communications at any time via our digital portal.

7.0 MULTIMEDIA & SOCIAL CAPITAL

As a cultural institute, Music House KSA documents performances. While we hold a general media release (see Terms of Service), we respect the privacy of our Residents. Specific requests to exclude a student from public-facing social media may be submitted in writing to the Admissions Office.

8.0 CONTACT & GOVERNANCE

For matters related to data protection, or to exercise your rights under the PDPL, please contact our Data Protection Office (DPO):

Email: management@musichouse.sa