Research Infrastructure Centralized Lab Management System Users

This privacy notice ("Notice") applies to all Research Infrastructure Centralized Lab Management System users at King Abdullah University of Science and Technology ("KAUST", "we", "us", "our"). The purpose of this Notice is to inform you of how we process your Personal Data. This Notice does not form part of any contract or agreement.

For the purpose of applicable data protection legislation, the entity which is responsible for your Personal Data is King Abdullah University of Science and Technology, Thuwal 23955-6900, Kingdom of Saudi Arabia.

This Notice replaces and supersedes any previous notices addressing the same or similar issues, whether formal or informal. KAUST reserves the right to alter, amend, or replace this Notice in whole or in part. The latest version of this Notice can be found here. You should always check that you are referring to the latest version of this Notice if you have previously downloaded hard copies of this Notice. For a copy of a previous version of this Notice, please contact DPO@KAUST.edu.sa.

1. What Personal Data are we processing?
   
   For equipment reservation, usage, and to request services hosted in the Centralized Lab Management System (LMS), we may process the following Personal Data, when applicable: your full name; email address; the name of your principal investigator (PI); the facilities and labs you can access; pocket IDs associated with your account; history of tools used, facilities accessed, and services provided or received and associated costs; usage duration and costs incurred relative to others;; your status as a KAUST, research park tenant, or external user;your company or affiliation; your KAUST ID; safety certificates you include in your profile; and personal details you voluntarily share in the internal email function in our booking system.
   
   
   
2. What sensitive Personal Data is being collected?
   

   No sensitive Personal Data is collected or otherwise processed.
   

   
   
3. Where do we get your Personal Data?
   

   When you create a profile in the LMS, the Personal Data you enter is saved in your profile. Reservations you book, usage of tools and facilities reported by you, and services provided or received are also recorded. The pocket ID associated with your account is assigned by your PI. Organizational information required for billing is derived from our business data system. For questions related to updating or correcting personal data in your profile, please contact CLHelpdesk@Kaust.edu.sa.
   

   
   
4. Why do we collect your Personal Data?
   

   Your Personal Data is processed to facilitate equipment reservation and usage, the provision or receipt of services, and associated billing. Your Personal Data will not be processed later in a manner inconsistent with this purpose, except as provided or required by law.
   

   
   
5. Do I need to provide all of the information requested?
   

   To create a profile in the LMS, only your full name and email address are mandatory fields. Your KAUST ID, relationship to the University, and photo are optional. Safety certificates are required in certain cases. If you decide not to create a basic profile with your name and email, you won't be able to reserve and use the associated equipment and supplies; or receive associated services.

   
   
6. Why are we able to process your Personal Data?
   

   For employees, students, and external users, we may process your Personal Data to implement an agreement we have with you - for example, to provide access to tools and facilities to conduct your work duties or your research, or to provide you with paid services. In cases where KAUST does not have an agreement with you, we may process your Personal Data for this purpose with your consent.
   

   
   
7. Does the processing involve profiling and/or any automated decision-making?
   

   Unauthorized users and users who have not completed the required safety certifications and tool trainings will not receive access to the associated tools.
   

   
   
8. Who do we share your Personal Data with, and how do they process the Personal Data?
   

   Profile Information

   The personal information on your profile page is visible only to the administrator for your lab; others cannot see your profile information. Lab administrators can only see profile information for individuals in their lab.

   Billing Information

   Relevant billing information is shared with customers, some of whom may be out-of-Kingdom. If you have a PI, relevant billing information is shared with your PI.

   The booking and billing processes are facilitated by the use of software providers that host our data in Europe. Personal Data is never sold by KAUST.
   

   
   
9. How do we protect your Personal Data?
   

   Your Personal Data is encrypted at rest and protected by KAUST's firewall. Your Personal Data will be held strictly confidential by KAUST personnel. All KAUST employees are required to sign and comply with KAUST's Confidentiality Agreement, which requires handling confidential information with the highest diligence and carefulness, in compliance with data privacy laws, and prohibits disclosure beyond a strict need to know.

   For more information about the technical measures KAUST applies to protect your Personal Data, please see KAUST's Minimum Security Standard, Information Security Policy, and Data Classification Procedure.
   

   
   
10. How long do we keep your Personal Data?
    

    Profile Information: If you have added information to your profile, you may delete that additional content at any time. Other profile information may be permanently retained in our LMS.

    Transactional History: Your Personal Data related to bookings, tool and facility usage, and services provided or received may be permanently retained in our systems of record. Financial records are retained according to the approved Finance records retention schedule. Monthly billing reports sent out by KAUST are deleted from email after one year.