Terms

Terms of Use

The rules for using this website, the Cybersecurity Radar and the Fortnightly Intelligence Brief — including what our information is, and what it is not.

Version 1.2 · Last updated 25 October 2026

Please read these sections in particular: The Radar and AI-generated content, Our information is not advice, Introductions to providers and Limits on our liability. They describe what you can and cannot rely on.

1. About these terms

These terms apply to your use of cybersecurity-association.org, the Cybersecurity Radar and the Fortnightly Intelligence Brief (together, "the service"). The service is operated by bodhi.style s.r.o., a company registered in the Czech Republic ("CSA", "we", "us"). "Cybersecurity Association South Africa" is our brand; it is not a legal entity. Our full details are at the end of these terms.

By using the service you accept these terms. If you do not accept them, please do not use the service. Where the law does not treat these terms as a contract with you, they still set out the conditions on which we make the service available and the notices we give you.

We may change these terms. The version and date at the top show when they last changed. If a change materially affects subscribers to the brief, we tell them by e-mail before it takes effect. If you continue to use the service after a change, the new terms apply.

2. What we are, and what we are not

CSA is a privately operated, independent industry platform. We are not part of, endorsed by or affiliated with the South African Government, a regulator, a law-enforcement agency or any public authority, unless a specific collaboration is expressly stated. We are not an association, professional body or certification body. Provider membership is a contractual programme; see our Provider Membership Standard.

We are not an emergency service and we do not provide incident response. If your organisation is under attack right now, contact an incident-response provider directly. In South Africa, a compromise of personal information must be reported to the Information Regulator under section 22 of POPIA, and a crime should be reported to the South African Police Service. In the EU, a personal data breach is reported to the data protection authority. Your bank, insurer and regulator may have their own reporting deadlines.

3. The Radar and AI-generated content

Radar items are produced by an AI system — a large language model — from public reports. Each item keeps apart the reported fact, our assessment (marked as model inference) and the legal context, and links to the original report.

Every Radar item is labelled "Automated": the text was generated by the AI system from the linked report. We do not read the Radar item by item before publication, and the label is the same on every item. Where a briefing or article contains AI-generated text, the same applies, and the person who takes editorial responsibility for it is named on the piece itself.

If you are named in an item and think it is wrong or unfair, or you object to being named, tell us: we assess such requests within five business days (see section 14).

Priority describes reading order for South African leadership, not the severity of what happened. Confidence describes how well the reported fact is sourced, not how serious it is. The Radar counts reports, not unique events: one event covered by several outlets can appear several times.

Automated summaries can be wrong, incomplete or out of date — the model can misread a report, attach a statement to the wrong organisation, or choose the wrong sector or priority — and so can the reports they rely on. Check the linked original report before you rely on an item. Our Radar Methodology explains how the Radar works and where its limits are; our Complaints & Corrections Policy explains how to report an error.

4. Our information is not advice

Everything on the service is general information for educational purposes. It is not legal advice, professional or technical advice, or regulatory approval, and it is not an assessment of your organisation's circumstances. The legal and compliance context shown on Radar items is general, often conditional, and generated automatically. Before you act, take advice from a qualified professional who knows your situation.

5. Introductions to providers

If you ask us to find expertise, we pass your enquiry to one or more member firms that do this kind of work and tell you which, or tell you if none fits. The firm contacts you directly. You decide whether to work with it, and any agreement is between you and the firm. CSA is not a party to it, does not supervise the work, and does not guarantee its quality, outcome or price.

Membership is a trust signal, not a guarantee of performance and not a regulatory approval. Member firms are admitted and reviewed under our Provider Membership Standard, and we check what the Standard says we check — no more. When we say a firm has been reviewed, a recorded review has actually taken place.

The member firm pays us a percentage if work goes ahead. You pay us nothing, the firm may not raise its price to you because of our fee, and we tell you about this relationship whenever we pass on an enquiry. We may ask you later whether work went ahead.

Where the service shows incident-response contacts of member firms, they are provided by the firms with the availability they state; we test that availability when a firm is listed but do not monitor it in real time.

6. The Fortnightly Intelligence Brief

The brief is free. We send it about once every two weeks to people who have asked for it and confirmed by e-mail. You can unsubscribe at any time with the link in every issue. We may change the brief's content, format or frequency, or stop it. Our Privacy Policy explains how we handle subscribers' data.

7. Our content and intellectual property

The text, design, summaries, data compilations, databases and logo on the service belong to CSA or to those who have licensed them to us. You may read our content, share links to it, quote short passages with attribution and a link, and use it within your own organisation.

Without our written permission, you may not republish the Radar or substantial parts of our content, or systematically copy, extract or re-use them — for example to build a competing product or dataset. We expressly reserve our rights against text and data mining and against the use of our content to train or evaluate AI models (Article 4(3) of Directive (EU) 2019/790; § 39c of the Czech Copyright Act); this reservation is also expressed in machine-readable form on our servers.

Names and trademarks of other organisations belong to their owners. Mentioning an organisation does not mean that it is affiliated with us or endorses us, or that we endorse it. The original reports behind Radar items belong to their publishers; we summarise them in our own words and link to them.

8. Acceptable use

You must not:

• try to gain unauthorised access to our systems, or probe, scan or test their vulnerability except as section 9 allows — such conduct can be a criminal offence, including under Czech criminal law and South Africa's Cybercrimes Act 19 of 2020;
• interfere with the service, overload it, or get round the limits we set on how often it can be used;
• collect content with automated tools beyond ordinary browsing, or use it to train AI models;
• send us false enquiries, impersonate anyone, or sign up an e-mail address that is not yours;
• upload malicious code, or use the service for anything unlawful.

9. Security research

If you find a security weakness in our website, please tell us at info@cybersecurity-association.org with the subject line "Security report" (details at /.well-known/security.txt). If you act in good faith — you do not access, change, copy or delete data that is not yours beyond what is needed to demonstrate the issue, do not degrade the service, do not use social engineering, report promptly, and give us at least 90 days before any public disclosure — we will not bring legal action against you for that research and will not ask a law-enforcement agency to do so. This does not authorise research against third-party systems, and it does not apply to conduct outside these limits.

10. Limits on our liability

This section limits our liability. Please read it carefully.

The service is provided free of charge, without any warranty as to accuracy, completeness, timeliness or availability. To the extent the law allows, CSA is not liable for any loss or damage arising from:

• your reliance on information on the website, on the Radar or in the brief;
• errors or omissions in AI-generated or automated content, or in the reports it is based on;
• the service being unavailable, delayed or interrupted;
• the work, advice, availability or conduct of any provider we introduce you to or list;
• other websites we link to.

Nothing in these terms excludes or limits liability for harm caused intentionally or through gross negligence, for harm to life, health or other natural rights of a person, or any liability that cannot be excluded or limited by law — including the consumer protection law that applies to you where you use the service as a consumer.

11. Your responsibility to us

If you use the service in the course of a business and breach section 7 or 8, and someone makes a claim against us as a result, you compensate us for that claim and for our reasonable costs of dealing with it.

12. Links to other websites

We link to original reports and to other websites. We are not responsible for their content, availability or privacy practices.

13. Availability and changes to the service

We may change, suspend or withdraw any part of the service. The Radar depends on outside sources and services and may be delayed or incomplete. When it cannot load live data, it says so; it never fills the gap with invented items.

14. Privacy and complaints

How we handle personal data is explained in our Privacy Policy. To report an error, dispute an item or make a complaint, see our Complaints & Corrections Policy.

15. Governing law and disputes

These terms are governed by the law of the Czech Republic. Disputes are decided by the courts of the Czech Republic. If you use the service as a consumer, you keep the protection of the mandatory law of the country where you live, including any right it gives you to bring a claim in your own country.

If you are a consumer and a dispute arising from a contract with us cannot be resolved directly, you may seek out-of-court resolution through the Czech Trade Inspection Authority (Česká obchodní inspekce), Central Inspectorate – ADR Department, Štěpánská 796/44, 110 00 Praha 1, Czech Republic, https://adr.coi.cz, adr@coi.cz.

16. General

If a court finds any part of these terms unenforceable, the rest remains in force. If we do not enforce a right straight away, we have not given it up. These terms, together with the policies they refer to, are the whole agreement between you and us about the service. "Business day" means a day other than a Saturday, Sunday or public holiday in the Czech Republic or South Africa.

17. Information about us

Provided in line with section 435 of the Czech Civil Code and section 6 of Czech Act No. 480/2004 Coll. (Article 5 of Directive 2000/31/EC).

We do not operate a public telephone line. Write to us by e-mail at the address above — that is the fastest way to reach us — or by post to the registered office. Neither section 435 of the Civil Code nor Article 5 of Directive 2000/31/EC requires a telephone number: what they require is that you can contact us rapidly and communicate with us in a direct and effective manner, which the e-mail address and the postal address provide (Court of Justice of the EU, judgment of 16 October 2008 in C-298/07, deutsche internet versicherung).