Policy

Privacy Policy

What personal data this website, the Fortnightly Intelligence Brief and our membership programme collect, why, who else handles it, how long we keep it, and how to use your rights under the EU General Data Protection Regulation (GDPR).

Version 1.3 · Last updated 25 October 2026

In short

• We collect little: your e-mail address if you sign up for the brief; what you tell us if you ask us to find expertise; the technical records every web server keeps; if your firm applies to become a member, what we need to check and administer its membership; and, if you give us an interview, what we need to publish it.
• No cookies, no analytics, no advertising. We do not record whether you open our e-mails or which links you click.
• Radar items are produced by an AI system from public reports. If you are named in one, we hold only what the linked report says.
• We do not sell personal data, and we do not share it for anyone else's marketing.
• Every issue of the brief has a one-click unsubscribe link. You can ask us what we hold about you, have it corrected, or have it deleted.

Who is responsible for your data

The website at cybersecurity-association.org, the Fortnightly Intelligence Brief and the CSA membership programme are operated by bodhi.style s.r.o., a company registered in the Czech Republic, identification number (IČO) 05526469, with its registered office at Americká 90/11, Jižní Předměstí, 301 00 Plzeň, entered in the Commercial Register kept by the Regional Court in Plzeň (Krajský soud v Plzni), Section C, Insert 33425 ("CSA", "we", "us"). "Cybersecurity Association South Africa" is our brand; we are not an association, government body or regulator. We are the controller of your personal data under the GDPR.

You can reach us about anything in this policy at info@cybersecurity-association.org with the subject line "Privacy". We have not appointed a data protection officer, because the law does not require one for our processing; our privacy contact is our Privacy Owner, a member of our management.

Which laws apply

This policy covers this website, the Fortnightly Intelligence Brief, our membership programme, our editorial contributors and your correspondence with us. We are established in the Czech Republic, so the GDPR and Czech data protection law (Act No. 110/2019 Coll.) apply to all of it, wherever you are.

Most of our readers are in South Africa, and some of the people who work for CSA — including the person who reads enquiries — do so from South Africa. South Africa's Protection of Personal Information Act (POPIA) therefore also applies to the processing we carry out there, and we comply with it as well. Our Information Officer under POPIA is our chief executive; you can reach the Information Officer at info@cybersecurity-association.org (subject "Information Officer"). Our manual under the Promotion of Access to Information Act (PAIA) is available on request at the same address. Whichever law applies, everyone has the rights described under Your rights.

What we collect and why

When you visit the website

What

Your IP address, the date and time, the page or file requested, the result, the address of the page that sent you here (if your browser passes it on) and your browser's identification string. Every web server records this.

Why

To keep the site secure and working: to limit how often one address can send our forms, to block addresses that attack the site, and to diagnose faults. We do not use these records to profile anyone, and we do not combine them with other data.

Legal basis

Our legitimate interest in running a secure website (GDPR Article 6(1)(f)).

How long

Server logs are rotated weekly and deleted after 14 weeks. Automatic blocks of abusive addresses expire within 24 hours.

Everything on this website, including its typefaces, is served from our own server; the pages load nothing from other companies' servers. Searching and filtering the Radar happens in your browser, and your search terms are not sent to us.

When you sign up for the Fortnightly Intelligence Brief

What

Your e-mail address and the page you signed up on. When you ask to subscribe and when you confirm, we record the IP address and browser identification string you used. We keep a dated record of each step — request, confirmation, unsubscribe, a permanently failed delivery, a spam complaint — together with the version of the wording you agreed to.

Why

To send you the brief you asked for, to be able to show that you asked for it, and to stop sending when you tell us to or when your address stops working.

Legal basis

Your consent (GDPR Article 6(1)(a); section 7 of Czech Act No. 480/2004 Coll. on commercial communications). We ask for it once: nothing is sent until you click the link in our confirmation e-mail. If you do not click it, you are not subscribed and we will not write to you again. We keep the record of your consent because we must be able to show that we had it (Article 7(1)).

Do you have to?

No. Giving us your e-mail address is voluntary, but without it we cannot send you the brief.

How long

While you are subscribed. An unconfirmed request is deleted after 30 days. For what happens after you unsubscribe, see How long we keep it.

Our e-mails contain no tracking pixel, and neither our mailing system nor our delivery provider records whether you open a message or which links you click. Every issue names us as the sender and carries an unsubscribe link, as the law requires.

You can unsubscribe with the link at the bottom of every issue, or with your e-mail program's unsubscribe button. Sending stops at once. We then keep your address on a do-not-send list, so that the brief is never sent to you again by mistake, and we keep the dated record of your consent and its withdrawal as evidence that we wrote to you lawfully.

When you ask us to find expertise

What

The size of your organisation, whether it operates on more than one site or in more than one country, its sector, what prompted the enquiry, the area and timeframe, anything you write in your own words, your name, role, organisation and work e-mail, the page you came from, and the date.

Why

To read your enquiry and, if needed, ask you clarifying questions; to pass it to one or more member firms that do this kind of work, so that they can contact you directly; to tell you which firms have it; to check later whether work went ahead (which is how the member firm's referral fee is calculated and how we review members); and, if no member fits now, to contact you if a suitable firm joins later.

Who sees it

CSA's Membership Lead, and then the member firm or firms we pass it to. A person reads every enquiry; nothing goes to a firm automatically.

Sharing

We pass your enquiry, with the contact details you gave us, to the member firm or firms we choose for it, in South Africa or the EU, and tell you which firms have it. From then on the firm deals with you directly and is responsible for your data as its own controller (under POPIA: responsible party); its own privacy notice applies to what it does. Our membership agreement allows member firms to use your enquiry only to respond to it and for any work that follows, forbids them from adding you to marketing lists, and requires them to delete it within twenty-four months if no work follows. Firms outside the European Economic Area sign the EU standard contractual clauses with us — see Data sent outside the EU.

Legal basis

Our legitimate interest, and yours, in running an introduction service that you have asked to use (GDPR Article 6(1)(f)); where you are yourself the contracting party — for example a sole trader — also the steps you asked us to take (Article 6(1)(b)). You can object at any time; see Your rights. The member firm pays us a percentage if work goes ahead; you pay us nothing.

Do you have to?

Only your work e-mail and the four questions marked "Required" are mandatory; without them we cannot act on the enquiry. Everything else is optional.

How long

Up to 24 months from the enquiry, then deleted; sooner if you ask.

Please keep your description general. Do not send us confidential details, system inventories, passwords or the specifics of an attack you are dealing with. If an enquiry contains special categories of personal data (for example health data), we remove them before passing it on.

When you write to us

What

Your message, your e-mail address and anything else you choose to include.

Why

To answer you and deal with what you raise, including complaints and corrections under our Complaints & Corrections Policy.

Legal basis

Our legitimate interest in responding (GDPR Article 6(1)(f)), or taking steps you asked us to take (Article 6(1)(b)); for complaints and rights requests, our legal obligations (Article 6(1)(c)).

How long

As long as we need to deal with the matter, and no longer than 24 months after the last exchange, unless the law requires us to keep it longer. Records of complaints and their outcome: 24 months after closure.

If your firm applies for membership, or you represent a member firm

What

The names, roles and business contact details of the people who deal with us for the firm; the firm's registration details and its directors, as shown in public company registers; the names and contact details of the clients the firm gives us as references, and what they tell us; what the firm tells us under our Provider Membership Standard and membership agreement, including its reports on enquiries; and, if the firm asks to be listed as a direct incident-response contact, the name, telephone number and stated availability of the contact person, which we publish.

Source

The firm itself, public company registers, and the references the firm names. When we contact a reference, we tell them who we are, which firm named them and why we are asking; the firm may give us a reference's details only with that person's agreement.

Why

To decide on an application, to check and review member firms under the Standard, to administer membership and its fees, to pass enquiries to member firms, and to publish the list of member firms and incident-response contacts.

Legal basis

Our legitimate interest in admitting only firms that meet the Standard and in running membership (GDPR Article 6(1)(f)); where you are yourself party to the membership agreement, its performance (Article 6(1)(b)); and, for accounting records, our legal obligation (Article 6(1)(c)).

How long

For the duration of the membership and three years after it ends; for an application we do not accept, one year after our decision; accounting records for as long as accounting and tax law requires.

If you give us an interview or contribute content

What

Your name, role, organisation, biography, contact details, your portrait if you provide one or we take one, the recording or draft, and the published piece; any relationship you disclose to us.

Why

To produce, publish and promote the piece, to disclose relationships to readers, and to keep a record of your agreement to our Interview & Contributor Terms.

Legal basis

Your consent for your likeness (Article 6(1)(a)), which you can withdraw for future uses; otherwise our legitimate interest in publishing editorial content and our agreement with you (Article 6(1)(f) and (b)).

How long

Published pieces remain published (they are part of the record and may be corrected under our Complaints & Corrections Policy); unpublished recordings and drafts are deleted 12 months after publication or after we decide not to publish; the record of your agreement for three years after the last use.

If you are mentioned in a Radar item

Radar items summarise reports published by the news outlets and agencies listed in our Radar Methodology. The text of an item is generated by an AI system (a large language model) from the published report and is labelled as such. Items are published without being checked by a person before publication, and every item says so (Editorial & Independence Policy, section 8). A summary can mention a person named in the original report. Every item names its source and links to the original report.

What

A name and role as they appear in the published report, and the context in which the report mentions you.

Source

The linked report, not you. We do not obtain data about you from anywhere else for the item.

Why

To inform business leaders about publicly reported cybersecurity developments — journalistic and public-interest reporting.

Legal basis

Our legitimate interest in reporting on public cybersecurity news, balanced against your interests (GDPR Article 6(1)(f)); this processing is for journalistic purposes within the meaning of Article 85 GDPR and sections 17 to 23 of Czech Act No. 110/2019 Coll. Because informing every person named in public reporting individually would involve disproportionate effort, we provide this information publicly here (Article 14(5)(b)).

Who else handles it

To produce items we send the text of public reports to an AI service provider (Google, Gemini API) and use a content-fetching provider (Apify); see Who else handles your data. They work on our instructions and do not use the text for their own purposes.

How long

Until newer items replace it in the Radar on this website; archived items remain in our internal archive as described below.

Internal research records. For our editorial work we also keep an internal record of organisations and people named in public cybersecurity reporting — which reports mention them, in what role, and where they work — and of possible interview topics. These records are for our own editorial use only. They are not published, not sold, and not made available to subscribers, members or anyone else, and we make no decisions about anyone based on them. You can ask us what we hold (see Your rights).

We publish nothing about you beyond what the item says, and we do not publish or sell profiles, scores or ratings of the people mentioned. If you think an item is inaccurate or unfair, or you object to being mentioned, write to us — see Your rights and our Complaints & Corrections Policy. We assess every objection individually within five business days; where an item is inaccurate or your interests outweigh the public interest in the item, we correct, anonymise or withdraw it.

Cookies and browser storage

This website sets no cookies, stores nothing in your browser and uses no analytics or advertising tools.

Who else handles your data

We use the following providers. Each sees only what it needs for its task and works on our instructions under a data processing agreement (GDPR Article 28), except member firms, which are independent controllers.

We may also disclose data when the law requires it, to our professional advisers (who owe us a duty of confidentiality), and to a successor to our business. We do not sell personal data.

Data sent outside the EU

Our servers and mailboxes are in the Czech Republic. Data leaves the European Economic Area in these cases:

• United States — Postmark, Google. Our agreements with Postmark and Google include the European Commission's standard contractual clauses (Commission Implementing Decision (EU) 2021/914), and we have assessed United States law and practice before relying on them. Apify's own sub-processors in the United States are covered by standard contractual clauses in our agreement with Apify.
• South Africa — member firms we pass your enquiry to. South Africa has no EU adequacy decision, so every member firm we pass your enquiry to has signed the European Commission's standard contractual clauses (Module One) with us before we pass it — we send no enquiry to a firm that has not — and we have assessed South African law and practice before relying on them. We tell you when your enquiry goes to a firm in South Africa.

You can ask us for a copy of the safeguards we rely on.

Some of the people who work for CSA, including the membership lead who reads enquiries, are based in South Africa. They act for CSA — as its directors or under its authority — not as a separate organisation: the data stays on our servers in the Czech Republic, and they reach it remotely over encrypted connections, under our security rules (see How we protect it). This is not a transfer to another organisation.

How long we keep it

If you ask us to erase your data, we delete your e-mail address from our subscriber records and from our mailing system. We keep the dated consent history, without your e-mail address, for the period above, as evidence that we had your consent.

We keep backups of our database on the same hosted infrastructure in the Czech Republic and retain the seven most recent. Data we delete from the live database remains in those backups until they are replaced, within 30 days.

How we protect it

• Every connection to the website, our forms and our subscription pages is encrypted (HTTPS).
• Our internal tools and the administration of our mailing system sit behind a login that requires a second factor; our automation tool has its own login. Our mailing system exposes only the pages needed to confirm a subscription or to unsubscribe.
• The website loads nothing from other companies' servers, and a strict browser security policy blocks anything we have not approved.
• We ask only for what we need, and our forms tell you not to send sensitive details.
• Database backups are tested by restoring them before they are accepted.
• Access to personal data is limited to our Membership Lead, Editorial Owner and Privacy Owner, and to the technical administrator of our server; each has their own account, and remote access uses encrypted connections.
• Alerts our systems send to our team about a new enquiry contain no personal data.

If a personal data breach is likely to put your rights at risk, we notify the Czech Office for Personal Data Protection within 72 hours of becoming aware of it, and we tell you without undue delay if the risk to you is high (GDPR Articles 33 and 34). Where the breach concerns processing subject to POPIA, we also notify the Information Regulator and the people affected (section 22 of POPIA). No system is completely secure, and if something goes wrong we will say so plainly.

Your rights

• Access. Ask whether we process personal data about you, and get a copy of it free of charge (GDPR Article 15).
• Correction. Have inaccurate data corrected and incomplete data completed (Article 16).
• Erasure. Have your data deleted, for example when we no longer need it or you withdraw your consent (Article 17). For published editorial content, the right to freedom of expression and information may apply instead; we explain our decision.
• Restriction. Ask us to stop using your data, apart from storing it, while a question about it is being resolved (Article 18).
• Portability. Receive the data you gave us, in a common machine-readable format, where we process it on the basis of your consent or of an agreement with you (Article 20).
• Objection. Object, on grounds relating to your situation, to processing based on our legitimate interests — including being named in a Radar item or held in our internal research records — and object at any time to direct marketing (Article 21).
• Withdrawing consent. Unsubscribe from the brief, or withdraw consent to the use of your likeness, at any time. This does not affect what we lawfully did before (Article 7(3)).
• No decisions by machine alone. We do not make decisions about you based solely on automated processing (Article 22). Radar items are generated automatically, but they are information, not decisions about you.
• Complaint. Complain to the Czech Office for Personal Data Protection, or to the data protection authority in the EU country where you live or work (Article 77).

To use these rights, write to us at info@cybersecurity-association.org with the subject line "Privacy". It costs nothing. We may ask you to confirm your identity before we act. We reply within one month; if a request is complex we may extend this by up to two further months, and we will tell you why (Article 12(3)).

If you are in South Africa, you can also rely on your rights under POPIA: to object to processing (section 11(3)), to access your personal information (section 23), to have it corrected or deleted (section 24), and to refuse direct marketing (section 69). Address requests to our Information Officer at the e-mail above.

Children

The website and the brief are meant for business audiences. They are not intended for anyone under 18, and we do not knowingly collect data about children. If we learn that we have, we will delete it.

Changes to this policy

When we change this policy, we publish the new version here with a new date. If a change affects how we use subscribers' data in a material way, we e-mail subscribers before it takes effect. The version of the wording you agreed to is stored with your consent record, and earlier versions of this policy are available on request.

Contact and complaints

Controller: bodhi.style s.r.o., Americká 90/11, Jižní Předměstí, 301 00 Plzeň, Czech Republic, info@cybersecurity-association.org (subject "Privacy").

Our supervisory authority is the Czech Office for Personal Data Protection: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz.

If you are in South Africa, you can also complain to the Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, POPIAComplaints@inforegulator.org.za, inforegulator.org.za.

"Business day" in this policy means a day other than a Saturday, Sunday or public holiday in the Czech Republic or South Africa.