This Privacy Policy explains how Cyber Threat Intelligence Board Ltd. ("CTIB", "we", "us") collects, uses, and protects your personal data. We are committed to compliance with the UK GDPR and the Data Protection Act 2018.
Who We Are
Cyber Threat Intelligence Board Ltd. is a company registered in England and Wales.
We are the Data Controller for personal data collected through our website, examination portal, and related services. If you have any questions about this policy or your personal data, you can contact us at info@ctiboard.org.uk.
Data We Collect
We collect personal data in the following categories:
- Account & Registration Data: Name, email address, CTIB ID, and password (hashed) when you register for an account or examination.
- Professional Information: Job title, years of experience, and employer name, where voluntarily provided during exam registration.
- Examination Data: Exam responses, scores, proctoring session recordings, credential status, and certificate issuance records.
- Payment Data: Billing name, billing information, and payment confirmation. We do not store full card details. Payments are processed by our third party payment provider.
- Technical Data: IP address, browser type, device identifiers, pages visited, and session data collected automatically when you use our website.
- Communications: Any messages you send to us via email, support forms, or other communication channels.
How We Use Your Data
We use your personal data for the following purposes:
- To create and manage your candidate account
- To register you for, administer, and deliver examinations
- To issue and maintain your digital certification credentials
- To verify your credentials through our public credential registry
- To process payments and issue receipts
- To send you transactional communications such as exam confirmations, results, and certificate renewals
- To send you marketing emails about new certifications or resources, only with your explicit consent. You may withdraw your consent at any time.
- To maintain the security and integrity of our examination platform
- To comply with legal obligations and resolve disputes
Legal Basis for Processing
We rely on the following legal bases under UK GDPR:
- Contract (Article 6(1)(b)): Processing necessary to deliver the services you have registered for, including exam administration and certification issuance.
- Legitimate Interests (Article 6(1)(f)): Security monitoring, fraud prevention, and platform improvement, where these activities do not override your rights.
- Legal Obligation (Article 6(1)(c)): Processing required to comply with applicable law.
- Consent (Article 6(1)(a)): Marketing communications and non-essential cookies, where we rely on your opt-in consent.
Data Retention
We retain personal data only for as long as necessary for the purposes described in this policy:
- Candidate accounts: Retained for the duration of your active credential(s) plus 3 years after expiry
- Exam session recordings: Retained for 90 days after the examination, then securely deleted
- Payment records: Retained for 7 years where required by applicable financial regulations
- Marketing consent records: Retained until consent is withdrawn
Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right of Access
You can request a copy of the personal data we hold about you.
Right to Rectification
You can ask us to correct inaccurate or incomplete data.
Right to Erasure
You can request deletion of your data where there is no legal basis for us to retain it.
Right to Restrict
You can ask us to limit how we process your data in certain circumstances.
Right to Portability
You can receive your data in a structured, machine readable format.
Right to Object
You can object to processing based on legitimate interests or for direct marketing.
To exercise any of these rights, please email info@ctiboard.org.uk with the subject line "Data Subject Request." We will respond within 30 days.
Children's Data
Our services are intended for professional cybersecurity practitioners and are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.
If you believe that a minor has registered or provided personal data without appropriate consent, please contact us at info@ctiboard.org.uk.
International Data Transfers
CTIB is headquartered in the United Kingdom. If we transfer your data outside of the UK, we ensure that appropriate safeguards are in place, such as the UK's International Data Transfer Agreements (IDTAs) or applicable adequacy decisions, in accordance with UK GDPR Chapter V requirements.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The effective date at the top of this page will always reflect the most recent version. For significant changes, we may notify registered users through appropriate communication channels.
Contact & Complaints
If you have any questions, concerns, or wish to exercise your data protection rights, please contact us at:
CTIB Data Protection Contact
Email: info@ctiboard.org.uk
We will review and respond to privacy related enquiries within the applicable timeframe.
If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in accordance with applicable data protection law.