Privacy policy

European Cyber Conflict Research Initiative (ECCRI) – Privacy Policy

Our contact details

Address: 47 Boutport Street, Barnstaple, EX31 1SQ, UK

E-mail: contact@eccri.eu

Last updated: 30 October 2023

The type of personal data we collect

We currently collect and process the following personal data:

  • Personal identifiers, contacts, and characteristics (for example, name and contact details)
  • Online identifiers (for example, IP addresses and cookie data)
  • Financial information (for example, bank or card details)
  • Employment information (for example, current and previous employers)
  • Educational information (for example, qualifications and exam results)

How we get personal data, why we have it, and the lawful basis

The table below describes the various forms of personal data we collect, why we have it and the lawful basis for processing this data, under the UK General Data Protection Regulation (UK GDPR). We have processes in place to ensure that only those people in our organisation who need to access your data can do so. A number of data elements are collected for multiple purposes, as the table below shows.

When we process on the lawful basis of legitimate interest, we apply the following test to determine whether it is appropriate:

  • The purpose test – is there a legitimate interest behind the processing?
  • Necessity test – is the processing necessary for that purpose?
  • Balancing test – is the legitimate interest overridden, or not, by the individual’s interests, rights or freedoms.

We will also process and share personal data to comply with our legal obligations.

Table 1

Data processed

How we get this data

Why we use this data

Lawful basis for processing of personal data

a) Personal identifiers, contacts and characteristics, employment information and educational information

This data are provided by you as a participant in one of our projects – for example, as an applicant for the European Cybersecurity Fellowship

We use this data in order to deliver these projects – for example, using applicant information to select the highest quality applications for the European Cybersecurity Fellowship. We may also use this information for other purposes beyond the specific project within which it was collected, as long as those purposes are within the overall community interest purpose of ECCRI: to advance education for the public benefit in relation to cyber conflict and statecraft.
  • Your consent. You are able to remove your consent at any time. You can do this by contacting contact@eccri.eu
  • Contractual obligation, only in cases where a contract is in force or potentially applicable
  • We have a legitimate interest

b) Personal identifiers, contacts, and characteristics and online identifiers

This data may also be collected through other interactions with ECCRI (for example, by contacting us via our website or email address, or by registering to participate in an online event).

We use this data to respond to queries, to run events, and to gather participant statistics and feedback about events.
  • Your consent. You are able to remove your consent at any time. You can do this by contacting contact@eccri.eu
  • We have a legitimate interest

c) Personal identifiers, contacts, and characteristics and financial information

This data are provided by you in order to receive payment (for example, expenses claims, honoraria, or payment for goods or services).

We use this information to pay suppliers, contractors, and partners, and ultimately to deliver ECCRI projects.
  • Your consent. You are able to remove your consent at any time. You can do this by contacting contact@eccri.eu
  • Contractual obligation, only in cases where a contract is in force or potentially applicable
  • We have a legitimate interest

d) Personal identifiers, contacts, and characteristics and online identifiers

This data may also be collected by visiting our website or otherwise engaging with ECCRI online (for example, via social media).

We use this information to collect information about our reach and engagement, and to improve and design our projects.
  • We have a legitimate interest

Third Party Service Providers who we may share your data with or who could potentially have access

1. Government and law enforcement agencies:

We may be required by law to share your data with other organisations, such as government or law enforcement agencies:

  • to satisfy any applicable law, regulation, legal process, or governmental request;
  • to detect, prevent, or otherwise address fraud, security, or technical issues;
  • protect our rights, property or safety, our users and the public;
  • to prevent a crime; harm to another.

2. Professional advisors including lawyers, bankers, auditors and insurers:

This may include exchanging information with other companies and organisations for fraud protection and spam/malware prevention if required by law.

It may also include Third parties to whom we sell, transfer, or merge parts of our business or our assets. (Please note we do not sell personal data to third parties).

3. External assessors and experts

We may share this information with external experts or other organizations to help us deliver our projects.

How we store your personal data

Your personal data is securely stored.

We keep a) personal identifiers, contacts and characteristics, employment information and educational information collected as part of our projects for three years after the end of the project, to ensure we can comply with potential audits, reviews, or other monitoring and evaluation requirements. We will then dispose of your personal data by deleting it from our systems.

We keep b) personal identifiers, contacts, and characteristics and online identifiers shared voluntarily through other interactions with ECCRI for up to three years. We will then dispose of your personal data by deleting it from our systems.

We keep c) personal identifiers, contacts, and characteristics and financial information collected for payment purposes for three years after the contract ends or payment is made. We will then dispose of your personal data by deleting it from our systems.

We keep d) personal identifiers, contacts, and characteristics and online identifiers collected indirectly through online interactions with ECCRI for up to three years. We will then dispose of your personal data by deleting it from our systems.

Your data protection rights

Under data protection law, you have rights including:

Your right of access – You have the right to request a copy of your personal data.

Your right to rectification – You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete personal data you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal data in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal data in certain circumstances.

Your right to object to processing – You have the the right to object to the processing of your personal data in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.

For requests, we will require you to prove your identity – this is in accordance with ICO guidance to ensure that the request is from you and not someone impersonating you.

Acceptable forms of identification can be: passport, driving licence, birth certificate, utility bill (from last 3 months), current vehicle registration document or a bank statement (from last 3 months).

If you can advise of the specific information that you require, we can process your request more quickly.

We will respond to your request within 30 days of us confirming your identity. This is in line with the requirements of Data Protection Act 2018/UK GDPR.

Please contact us at contact@eccri.eu if you wish to make a request.

How to complain

If you have any concerns about our use of your personal data, please contact us at contact@eccri.eu

You can also complain to the ICO if you are unsatisfied with our use of your data.

The ICO’s address:            

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk