Privacy Notice

1 Scope of this Notice

This Notice applies to the NADI platform — the University’s unified institutional environment (“Nexus for Architecture, Data & Intelligence”) — including its web applications, the GenBESTARI academic module, and the public-facing and internal services accessed through a single NADI sign-in. Where a connected third-party service operates under its own privacy policy, that policy also applies to your use of that service (see Section 7).

2 Who is responsible for your information

Universiti Brunei Darussalam is the data controller responsible for the personal information processed through NADI. UBD is located at Jalan Tungku Link, Gadong BE1410, Brunei Darussalam. Questions about this Notice or how your data is handled may be directed to the contact point in Section 13.

3 Information we collect

We collect and process the following categories of personal information:

• Identity & profile data — name, student or staff identification number, date of birth, gender, nationality, photograph, and programme or department.
• Contact details — University email address, personal email, telephone number, and correspondence or emergency-contact information.
• Authentication data — your UBD account identifier and credentials, and where you sign in via Microsoft UBD (Single Sign-On), the authentication tokens returned by that service.
• Academic & administrative records — enrolment, module registration, assessment marks, attendance, transcripts, applications and requests submitted through the platform.
• Usage & technical data — IP address, browser and device type, pages visited, actions taken, and timestamps, collected through logs and cookies for security and service operation.
• Communications — messages, notifications, feedback and support requests you send through NADI.

Where information is mandatory for a University process, we will indicate this; declining to provide it may prevent us from delivering the relevant service.

4 How we use your information

We use your personal information to:

• Authenticate you and provide secure access to NADI and its connected services;
• Administer admissions, enrolment, academic records, assessments, attendance and graduation;
• Operate student- and staff-facing services such as transcripts, requests, scheduling and notifications;
• Communicate with you about your account, your studies or work, and University services;
• Maintain the security, integrity and availability of our systems and prevent misuse;
• Produce aggregated, anonymised statistics for planning, quality assurance and reporting; and
• Comply with our legal, regulatory and accreditation obligations.

5 Lawful basis for processing

We process personal information where it is necessary to perform the University’s functions and our relationship with you (for example, delivering your education or employment), to comply with legal obligations, to protect vital interests, or in our legitimate interests as an educational institution — and, where required, on the basis of your consent. Where processing relies on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

6 Sharing & disclosure

We do not sell your personal information. We may share it only as needed with:

• University faculties and offices — academic, registry, examination, finance, library and administrative units that require the information to carry out their functions;
• Service providers — vendors who host or support our systems under contractual confidentiality and data-protection obligations, acting on our instructions;
• Connected platforms — integrated services you choose to use (see Section 7);
• Government, regulatory and accreditation bodies — where disclosure is required by law or for recognised educational reporting; and
• Other parties — where you have given consent, or where disclosure is necessary to protect the rights, safety or security of the University community.

7 Connected systems & third-party services

NADI provides links to and integrations with University and external platforms — such as Canvas Learning, CareerBN, the Alumni Portal, and Microsoft UBD for sign-in. When you open or authenticate to one of these services, relevant identity information may be passed to it to establish your session, and your use of that service is also governed by its own privacy policy and terms. We encourage you to review those policies. We are not responsible for the privacy practices of services we do not operate.

8 Cookies & session data

NADI uses strictly necessary cookies and similar technologies to keep you signed in, remember your preferences, maintain security (including protection against cross-site request forgery), and operate core features. These are essential to the service and cannot be disabled without affecting functionality. We do not use NADI cookies for third-party advertising.

9 Data retention

We retain personal information for as long as necessary to fulfil the purposes described in this Notice and to meet our legal, academic-record and audit obligations. Academic records that form part of the University’s official student record may be retained on a long-term or permanent basis in accordance with University policy. Operational logs and transient data are retained for shorter, defined periods. When information is no longer required, it is securely deleted or anonymised.

10 How we protect your data

We apply appropriate technical and organisational measures to safeguard personal information, including encrypted connections, access controls and role-based permissions, authentication through University Single Sign-On, activity logging, and regular review of our systems. While we take reasonable steps to protect your information, no method of transmission or storage is completely secure; you also play an important part by keeping your credentials confidential and signing out of shared devices.

11 Your rights & choices

Subject to applicable law and University policy, you may:

• Request access to the personal information we hold about you;
• Ask us to correct information that is inaccurate or incomplete;
• Request deletion of information where there is no continuing lawful or academic basis to retain it;
• Object to or request restriction of certain processing; and
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us using the details in Section 13. We may need to verify your identity before responding, and some requests may be limited where information forms part of official academic records or is required by law.

12 Changes to this Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, systems or legal requirements. The “Effective date” above indicates when it was last revised. Material changes will be communicated through the platform or by email where appropriate. Your continued use of NADI after an update constitutes acknowledgement of the revised Notice.