A white-label academy runs under your own name, logo, colours and domain, and keeps your students' records in a system you control. It matters because students trust the name they see in the address bar, and every link and Google ranking you earn builds up on that domain for whoever owns it. Legally, data protection laws in Egypt and Saudi Arabia put the duty to protect student data on the academy that collects it, whoever hosts the platform. Below we cover the risks, who owns student data, what Egypt's Law No. 151 of 2020 and Saudi Arabia's PDPL require, consent for pixels and the questions to ask any provider.
Why do your academy's own brand and domain matter?
Much of the trust behind an online purchase is about data. PwC's Voice of the Consumer 2024 survey found that 85% of consumers in the Middle East rank protecting customer data as the top factor in earning their trust. In PwC's Saudi findings, based on more than 755 Saudi consumers, data protection was the top driver of trust, cited by 86%. Globally, Cisco's 2024 Consumer Privacy Survey of more than 2600 consumers in 12 countries found that 75% will not buy from organisations they do not trust with their data. And in Baymard Institute's research on US online shoppers, leaving aside people who were only browsing, 19% abandoned a checkout because they did not trust the site with their card details.
A consistent name and domain is how a student knows the page asking for their card number belongs to the trainer they follow. When the address bar, course page and receipt show three different companies, some students leave.
The domain also carries your search value: partner links and course pages that rank on Google all point at it. Our guide to logo and brand identity design costs in Egypt covers what a consistent identity takes.
What is the risk of building on someone else's name and subdomain?
Many rented course platforms give you an address such as yourname.provider.com, show their own brand on checkout pages or emails, and keep the student list in their dashboard. In academies we spoke to, we kept seeing links carrying the provider's name and student lists kept in a vendor account or a spreadsheet with no backup, a problem we cover in the hidden costs of running an academy on WhatsApp and Google Drive.
The subdomain is the hardest part to undo. When a site moves, Google advises keeping redirects from the old addresses "for as long as possible, generally at least 1 year" so ranking signals pass to the new ones. You can only set those redirects on a domain you control. Leave a provider's subdomain and every link pointing at it stays behind. We compare both options in rent or own your online course platform.
| Area | Rented name and subdomain | Your own white-label academy |
|---|---|---|
| Address students see | yourname.provider.com | Your own domain, such as youracademy.com |
| Brand on pages | The provider's brand may appear beside or instead of yours | Your logo and colours lead on every page |
| Google rankings and links | Build up on the provider's domain | Build up on your domain and stay if you change systems |
| Student records | Inside the provider's account, on its terms | In a platform you own |
| Leaving | Links break and the old address cannot be redirected | You change what runs behind the domain and keep the address |
Who owns your students' data, and can you take it with you?
Legally, the academy carries the duty. Saudi Arabia's Personal Data Protection Law defines the controller as the party that "specifies the purpose and manner of Processing Personal Data", and Egypt's law uses a similar definition. That is you. Your hosting company is usually a processor acting for you, so protecting data, answering requests and reporting breaches stay your duty.
Both laws give students rights you must be able to honour. The Saudi law gives a student the right to obtain their data "in a readable and clear format", and its Implementing Regulation says it is provided "in a commonly used electronic format". Egypt's law gives students the right to access and obtain their data, to correct or delete it and to withdraw consent.
So owning the data means three things you can check: you can export every student, enrolment, payment and progress record in a common format at any time; the contract says the data is yours; and when you leave, you receive a full copy and the provider deletes its own. We apply the same thinking to AI tools in how to avoid AI vendor lock-in.
What does Egypt's data protection law require from an online academy?
Egypt's Personal Data Protection Law, Law No. 151 of 2020, was passed in July 2020. According to the Ministry of Communications and Information Technology, it requires licences and permits from the Personal Data Protection Center and criminalises processing data for purposes the data owner did not authorise. Its executive regulations were issued by Ministerial Decision No. 816 of 2025 on 1 November 2025, according to law firm CMS, and the law gives businesses one year from that date to comply. That window closes in November 2026.
Key points for an academy, from the text of the law and the CMS summary:
- Explicit consent. Collecting, processing or disclosing personal data without explicit consent is prohibited unless the law allows it (Article 2). Personal data includes an "online identifier".
- Breach notification. Controllers and processors must notify the Center within 72 hours of becoming aware of a breach (Article 7).
- Data stored abroad. Sending or storing personal data in another country is prohibited unless it offers at least the same protection and the Center licenses it, with limited exceptions such as explicit consent (Articles 14 and 15).
- A data protection officer. The executive regulations require legal entities to appoint one.
The penalties are set in the law itself. Processing personal data without consent or legal authorisation carries a fine of EGP 100,000 to EGP 1 million (Article 36). Breaking the electronic marketing rules carries EGP 200,000 to EGP 2 million (Article 43). Breaking the rules on sending data abroad carries at least three months in prison and a fine of EGP 500,000 to EGP 5 million, or one of the two (Article 42).
What does Saudi Arabia's PDPL require?
Saudi Arabia's Personal Data Protection Law came into force on 14 September 2023, with a one-year grace period that ran until 14 September 2024, according to a guide published by SDAIA, the Saudi Data and AI Authority that enforces it. It also covers processing residents' data "from any party outside the Kingdom" (Article 2), so an Egyptian academy selling to Saudi students is covered.
- Consent. Data may not be processed, nor its purpose changed, without consent except where the law allows, and consent can be withdrawn at any time (Article 5).
- Breach notification. The controller must notify the authority within 72 hours of becoming aware of a breach that could cause harm (Implementing Regulation, Article 24).
- Marketing. Direct marketing needs consent, the sender must be clearly identified and opting out must be "at least as easy as" opting in (Implementing Regulation, Article 29).
Disclosing sensitive data unlawfully, to cause harm or for personal benefit, carries up to two years in prison, a fine of up to SAR 3 million, or both (Article 35). Other violations carry a warning or a fine of up to SAR 5 million, which may be doubled for a repeat violation (Article 36). In January 2026 the Saudi Press Agency reported that SDAIA's committees had issued 48 decisions the previous year confirming violations and applying penalties, including for sending advertising and marketing messages without consent.
This article is general information, not legal advice.
Do you need consent for marketing pixels and WhatsApp messages?
Tracking pixels and server-side conversion tools send visitor data, such as device identifiers and sometimes a hashed email or phone number, to advertising platforms so you can see which ads bring sales. Egypt's law counts an online identifier as personal data and both laws rest on consent, so tell students plainly what you track and why.
Marketing messages are clearer still. Egypt's Article 17 bans direct electronic marketing unless you have prior consent, identify yourself as the sender, state that the message is marketing and offer an easy opt-out. Saudi rules require an opt-out at least as easy as opting in. People use those choices: PwC's 2024 survey found that 59% of Middle East consumers opt out of receiving marketing communications while browsing websites.
- Show a short consent notice before non-essential tracking tags run, and record each choice.
- Ask for marketing consent with a separate, unticked checkbox, and act on opt-outs quickly.
- Publish a privacy policy in Arabic and English that lists what you collect, why, where it is stored and who receives it.
What should you ask any platform provider before you sign?
- Will the address bar and every course page show my brand, or the provider's?
- Can I use my own domain, and does it stay mine if I leave?
- Does the contract say the student data is mine, and can I export all of it in a common format at any time?
- In which country are the data and the videos stored, and which other companies process them?
- How fast will I be told about a breach? Both laws give 72 hours to notify the regulator.
- Can I decide which tracking tags run, so I can respect consent?
- Do the Arabic pages display correctly from right to left?
- What happens to my data, domain and pages if I stop paying or the provider closes?
How does HBS LMS handle brand, domain and student data?
We built HBS LMS so that the academy is the brand, not the platform. HBS Tech builds it for your academy and hands it over.
- Your brand. Your own logo, colours and domain across the store and course pages, in Arabic and English with correct right-to-left layout.
- Search value on your domain. Course, package and one-to-one session pages built to be found on Google, with titles and offers you edit from the dashboard.
- Your data. The academy owns the platform and its data: student, enrolment, payment and progress records sit in a system that is yours, not in an account you rent.
- No share of your sales. A one-time project fee, paid at once or in 12 monthly instalments. Hosting, video streaming and payment fees are paid directly to those providers.
- Roles and tracking you control. Admin, sales and instructor roles, plus built-in Meta Pixel and Conversions API, Google Tag Manager and Google Analytics, where you decide which tags run.
Your privacy policy, consent wording and any licences under Egyptian or Saudi law stay your responsibility, and your lawyer should review them.
This article is part of our HBS LMS series. Start with the opening article, why we built HBS LMS and the problems we saw in online course businesses.
Want an academy on your own name and domain, with your students' data in your hands? See how HBS LMS works and tell us about your academy. Our team will help you plan it.
