Privacy Policy

• Email address
• Other contact information (if provided by you)

To sign up to our newsletter, we only ask for your email address. We use a double opt-in procedure, whereby we send you a link that you must click on in order to activate the newsletter subscription. We do this in order to ensure that you are the owner of the email address used to subscribe to the newsletter.

We use a service provided by HubSpot to store your email address and to manage the sending of newsletters. This service allows us to enter additional data about you, if you provide such information during subsequent interactions with us. Additional data includes: first name, last name, company, work title, phone number, work address, meeting minutes.

We entered into a Data Processing Agreement with HubSpot in order to ensure that they only process personal data in accordance with our instructions, and within the limits imposed by their mandate. For more specific information about how HubSpot processes your personal data, you may access their privacy policy here.

We store your email address and other contact information that you give us until you unsubscribe from our newsletters, or you otherwise inform us that you no longer wish that we contact you.

• IP Addresses (including Location Data)
• Type Of Browser
• Operation System
• Visiting Time (Local And Server)
• Session
• Actions per visit
• Pageviews per visit 
• Returning Visitors
• Referring Site Information

When you browse the website, we use digital tools to deliver the website user experience, including cookies and other identifiers. Whenever possible, we use anonymous data to count website visitors, for example by anonymising the IP collected by Google Analytics cookies.

• First name, last name, address, contact details, nationality (to determine which type of work permit may be required)
• CV and information about previous work experience and educational background, portfolio (if applicable)
• Answers to screening questions
• Information collected during interview(s)
• References (if applicable, depending on the position)
• Results of assessment test or technical test (if applicable, depending on the position)

When you apply for a job at the CyberPeace Institute, we collect some initial information about you in order to conduct an initial screening: your first name, last name, address, contact details, CV and information about previous work experience and educational background, as well as answers to screening questions. If you pass the initial stage, we will collect further information about your skills through assessment tests, which have different content depending on the position you applied for.

We conduct assessment and skills on the basis of our legitimate interest of making sure that we evaluate job candidates using objective criteria. We use a platform provided by a company called iMocha, and we have entered into a Data Processing Agreement with iMocha, which contains the Standard Contractual Clauses for transferring personal data to India, where iMocha processes personal data. For more specific information about how iMocha processes your personal data, you may access their privacy policy here.

Please note that iMocha has an “anti-cheating feature”, which – if enabled – can track whether candidates open another page of the browser while completing an assessment or leave the computer for an extended period of time. We have decided not to use this feature, in order to preserve your privacy and because we trust all candidates to complete the assessments in a fair way, without cheating.

For some of the assessments, depending on the requirements of the specific role, we may ask candidates to record a video of themselves answering a question. The videos are recorded using the iMocha platform and are stored only for the necessary time to allow us to evaluate the candidate’s performance against that of other candidates. Once a position has been filled, the videos of all candidates are permanently deleted.

We do not use automated decision making tools as part of our recruitment process. A real person reads and evaluates each application fairly and in accordance with our non-discrimination policy.

In the unlikely circumstance that special categories of personal data are processed during the recruitment process (for example, if you disclose a specific medical condition that may impact your work), we will ensure that the processing of such data is based on your express and freely given consent.

By default, we keep job candidate data for a period of maximum 12 months, unless you request that we delete your data earlier. After 12 months, we will contact you to ask if you want us to store your data for longer, and we will only continue storing your data if you have given your consent.

• First name, last name, email address
• Organisation 

We organise online events to raise awareness about cybersecurity issues that impact the achievement and enforcement of cyber peace in the world. To sign you up to these events and send you the link to attend them, we need your first name, last name and email address. You also have the option of providing the name of your organisation, however, not providing it will not affect your ability to participate in the event.

We use this data on the basis of our legitimate interests of running the online events and, more specifically, to ensure that only registered participants are able to participate in our sessions. We may also use the data to conduct internal statistics, such as to evaluate the ratio between people who sign up to a session and those who actually attend.

• First name, last name, email address

On our Contact page, you can send us a question, suggestion, request or another message, in order for us to contact you back. We need your first name, last name and email address to process your request, on the basis of our legitimate interest to contact you and respond to your query.

We strongly encourage you to refrain from sending any personal or sensitive information in the “Your Message” box, whether it is your own information or someone else’s. Should we need to receive any particular information from you, we will get in touch to let you know a secure way to share it.

We currently accept online donations via Apple Pay, Google Pay, PayPal and via credit card through Stripe. You can choose the preferred donation method here. The CyberPeace Institute does not store your credit card details.

If you choose to donate using Apple Pay, Google Pay, PayPal and Stripe, they will act as an autonomous data controller to process your donation, and they are therefore responsible for the processing of your personal data for donation purposes.

A copy of respective privacy policies is available as follows:

• Apple Pay
• Google Pay 
• PayPal
• Stripe

Our donation platform manager is GiveForms. You can access here the relevant Privacy Policy.

If you would like to make a donation using another method (e.g., bank transfer), please contact us by email at: [email protected].

• First name, last name
• Location
• Skillset
• Availability
• Further information, on a case by case basis

The CyberPeace Institute offers exceptional volunteering opportunities, to further develop your skills by helping build a successful international organisation. 

Volunteers are invited to submit their applications and letters of interest to the email address  [email protected]. The specific personal data collected depends on each volunteering opportunity, for that reason we will provide a separate information notice to volunteers who are selected to join the CyberPeace Institute’s volunteer network.

• First name, last name
• Company, Job title
• Personal data of third parties, for example victims of cyberattacks

Whenever we enter into a partnership with an individual or a company, we provide a separate information notice to describe the data processing activities that we carry out in the context of that specific partnership. If necessary, we enter into a Data Processing Agreement or another type of data sharing agreement, on a case by case basis.

The CyberPeace Institute carries out investigative activities using data from publicly available sources. Whenever the collected data refers to individuals, within the meaning of applicable data protection legislation, we comply with the principles of lawfulness, fairness, transparency, data minimisation, data accuracy, purpose and storage limitation, accuracy, as well as integrity and confidentiality. We inform data subjects of the data processing and of their rights, whenever the provision of such information is possible and does not involve a disproportionate effort, or in so far as it is not likely to render impossible or seriously impair the achievement of the objectives of the data processing.