Privacy policy for events, marketing, website, and communications

This policy covers how we handle your personal data when you engage with CyberMatch through our website, marketing communications, or events (such as workshops or webinars). If you sign up to use the CyberMatch platform, a separate privacy notice covering that use will apply to you.

1. Who we are

CyberMatch is operated by a multi-partner consortium, made up of the following partners:

• CAPSLOCK Education Ltd ("CAPSLOCK", "we", "us", "our")
  • Company number: 12202338
  • Registered address: Percy Westhead & Company, Hanover House, 30-32 Charlotte Street, Manchester, England, M1 4FD
  • CAPSLOCK is the data controller for personal data collected through CyberMatch. This means we decide why and how your personal data is processed.
• Cyber Tzar Limited ("Cyber Tzar")
  • Company number: 13189024
  • Registered address: 39 Marlborough Road, Castle Bromwich, Birmingham, B36 0EH
  • Cyber Tzar is a data processor. See section 6 for more details.

CyberMatch is also supported by other organisations who contribute to the wider programme but are not signatories to this arrangement and do not control or process personal data on CyberMatch's behalf.

2. How to contact us about your data

If you have any questions about this policy or how we handle your personal data, please email CAPSLOCK's data privacy team at privacy@capslock.ac.

3. What personal data we collect

Depending on how you engage with CyberMatch, we may collect the following information:

• Names and contact details (eg name, address, telephone number or personal email address)
• Marketing preferences
• Correspondence
• Website and app user information (including user journeys, cookie tracking, IP addresses, and account registration details)
• Highest level of education
• Employment details (eg employer or job title)
• Photographs or video recordings

We may also collect the following special category information. This information is subject to additional protection due to its sensitive nature.

• Sex/gender
• Racial or ethnic origin
• Religious or philosophical beliefs
• Sexual orientation information
• Health information (including dietary requirements, allergies and health conditions)

Where we ask for information relating to your sex/gender, ethnicity, religion or belief, or sexual orientation, this is for demographic and diversity monitoring purposes only. Where we ask for information relating to your health, this is for both demographic and diversity monitoring, and for ensuring reasonable adjustments and dietary requirements are met.

Providing this information is entirely voluntary. Where we collect it, we do so only with your explicit consent, given at the point of collection. You can choose not to answer, and you may withdraw your consent at any time by contacting privacy@capslock.ac.

All personal data described in this policy is collected directly from you. Providing this information is entirely voluntary, however, if you choose not to provide certain details, we may not be able to respond to your inquiry, register you for an event, or send you the communications you've requested.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

4. How we use your data and our legal basis

We collect and use your personal data for the following purposes, each with its own legal basis.

Use	Legal basis	Rights
To respond to general enquiries submitted via our contact form	Legitimate interests	All of your data protection rights apply.
To provide our service	Consent	All of your data protection rights may apply, except the right to object. You can instead withdraw your consent at any time.
For sales and marketing communications	Consent	All of your data protection rights may apply, except the right to object. You can instead withdraw your consent at any time.
To monitor and evaluate the CyberMatch programme	Consent	All of your data protection rights may apply, except the right to object. You can instead withdraw your consent at any time.

You can exercise your data protection rights at any time by contacting privacy@capslock.ac. See section 8 for further details.

5. Who we share your data with

Cyber Tzar (data processor)

Cyber Tzar acts as our data processor and has view/edit access to certain personal data within our platforms, as part of day-to-day operational support for CyberMatch. Cyber Tzar processes this data only on our instructions, under a Data Processing Agreement ("DPA") we have in place with them.

Cyber Tzar may also engage the following sub-processors in delivering these services to us:

• Cybec Consulting Limited ("Cybec") - Company number 16427178

Other service providers

We also use the following third-party platforms to support our operations, each of which may process personal data on our behalf:

• Microsoft 365
  • Files and documents
• HubSpot
  • Customer relationship management ("CRM"), marketing communications, and website
• Eventbrite
  • Event registration and management
• LinkedIn
  • Advertising and outreach

Government reporting

We report to our funders, Innovate UK and relevant departments within the UK Government, on the progress and outcomes of the CyberMatch programme. All data shared for this purpose is anonymised before it is sent, meaning it cannot be used to identify you and does not constitute personal data.

6. International data transfers

We take steps to ensure that any transfer of your personal data outside the UK is subject to appropriate legal safeguards.

Some of the third-party platforms we use to run activities are based outside the UK, or may process data using infrastructure located outside the UK. Where this happens, we ensure appropriate safeguards are in place - for example, the UK International Data Transfer Addendum, or, where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, that certification.

On occasion, individuals working with us on a contractor or self-employed basis may also access personal data while temporarily outside the UK; where this happens, we ensure this is covered by an appropriate contractual safeguard.

You can request further detail on these safeguards by contacting privacy@capslock.ac.

7. How long we keep your data

This project is expected to run until April 2027. We will retain your data for up to 6 months after the project ends, to complete outcomes verification and finalise anonymised reporting, after which it will be anonymised or deleted.

8. Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you - read more about the right of access
• Rectify inaccurate or incomplete data - read more about the right to rectification
• Erase your data in certain circumstances - read more about the right to erasure
• Restrict how we use your data in certain circumstances - read more about the right torestriction of processing
• Object to processing based on legitimate interests - read more about the right to object
• Data portability, where processing is based on consent or contract and carried out by automated means - read more about the right to data portability
• Withdraw consent at any time, where processing is based on consent - read more about the right to withdraw consent

To exercise any of these rights, please contact us at privacy@capslock.ac. If you make a request, we must respond to you without undue delay and in any event within one month.

9. How to complain

If you have concerns about how we've handled your personal data, please contact us first at privacy@capslock.ac so we can try to resolve this directly.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the Information Commissioner's Office (ICO).

• The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

• Helpline number: 0303 123 1113

• Website: Make a complaint

10. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "last updated" date.