Commitment

CyberInsightEU treats privacy as an important part of responsible publishing and technology operations. We aim to collect and use personal information only where there is a legitimate reason to do so, to explain relevant processing clearly, and to apply safeguards appropriate to the information involved.

This policy describes how CyberInsightEU may handle personal information when people read or interact with the website, communicate with the newsroom, submit material, participate in editorial processes, use communication services, engage with commercial features or interact with technical systems supporting the publication.

CyberInsightEU has an international audience, and privacy requirements can differ depending on where an individual is located, where information is processed, why it is being processed and which legal framework applies. Journalistic activity, technical operations, contractual relationships and commercial services may therefore be subject to different rules. Nothing in this policy is intended to remove a privacy right that applicable law does not permit CyberInsightEU to exclude.

Who Is Responsible

CyberInsightEU, through its independent Publisher, determines how personal information is handled for the operation and publication of the CyberInsightEU website unless another responsible legal entity is expressly identified in the Publisher and Legal Information section.

References in this policy to “CyberInsightEU,” “we,” “us” or “our” refer to the responsible Publisher operating the publication unless a particular service or processing activity identifies another entity.

Privacy questions and requests concerning personal information can be directed to privacy@cyberinsighteu.com. CyberInsightEU does not describe an individual as its data-protection officer unless such a role has actually been established.

Scope

This policy covers personal information encountered across the publication’s editorial, technical, administrative and commercial activities. This can include information generated when someone visits the website, communicates with the newsroom, subscribes to a newsletter, submits a correction, makes a complaint, requests a right of reply, proposes a story, contributes an article, reports a security issue, participates in an interview or interacts with advertising and partnership services.

It also applies to information associated with authors, sources, researchers, commercial contacts, event participants, accessibility requests, licensing matters, legal correspondence, website security, analytics, cookies and related operational records.

Certain services or activities may provide their own privacy notice or additional terms. Those notices operate alongside this policy where applicable.

Personal Information

Personal information is information that identifies a person or could reasonably be used to identify them, whether by itself or when combined with other information.

Depending on the circumstances, CyberInsightEU may handle names, email addresses, telephone numbers, professional positions, employer or organization details, biographies, correspondence, contributor information, subscription details, contractual records, invoices, payment information, photographs, recordings, quotations, source communications, technical information and information associated with articles or investigations.

Website systems may also generate information such as IP addresses, browser and device characteristics, approximate geographic information, timestamps, referring pages, cookie preferences, security events, access logs and information about how a page or service was requested.

CyberInsightEU seeks to avoid collecting sensitive or unnecessary information merely because a technical system makes it possible.

Sources of Information

Information may come directly from the person concerned or from someone authorized to communicate on their behalf. It may also originate from contributors, interviewees, sources, companies, researchers, public authorities, courts, regulators, professional databases, public websites, social platforms, service providers, security systems, analytics technologies, cookies and other lawful editorial or operational sources.

For journalism, information may also be obtained through reporting, interviews, document review, public-record research and other legitimate newsgathering methods.

Information being publicly accessible does not automatically make every subsequent use appropriate. CyberInsightEU considers context, relevance, reliability, proportionality, public interest and potential harm when using information obtained from public sources.

Purposes

Personal information may be used to deliver and protect the CyberInsightEU website, communicate with readers and sources, produce journalism, conduct research, investigate matters of public interest, verify information, administer contributors and authors, evaluate pitches, edit and commission material, manage publication rights and licensing, respond to corrections and complaints, administer rights of reply and deliver requested newsletters.

Operational uses may include maintaining consent choices, preventing spam, detecting abuse, investigating cyber incidents, responding to vulnerability disclosures, improving accessibility, maintaining advertising and sponsorship arrangements, processing invoices, maintaining accounting records, complying with legal duties, handling disputes, protecting confidential sources, maintaining backups, improving site performance and understanding aggregate audience activity.

Personal information may also be retained where necessary to preserve the integrity of the published record or ensure continuity of essential operations.

Where information is proposed for a substantially different purpose, CyberInsightEU considers whether that use is compatible with the original purpose and whether additional notice or another legal basis is required.

Lawful Basis

The legal basis for processing depends on what CyberInsightEU is doing and which law applies. Depending on the circumstances, processing may be based on consent, contractual necessity, steps requested before entering into a contract, legal obligations, legitimate interests, protection of vital interests, public-interest functions, freedom of expression and information, journalistic exemptions, legal claims or another basis recognized by applicable law.

There is not necessarily one legal basis for all processing associated with a person. For example, the basis for sending an optional newsletter may differ from the basis for maintaining website security or conducting public-interest journalism.

Where consent is the applicable basis, a person may withdraw it for future processing through the available mechanism. Withdrawal does not retrospectively make lawful processing unlawful.

Editorial and Journalistic Processing

CyberInsightEU may process personal information as part of reporting, investigation, analysis, commentary, criticism, interviews, publication, archiving and other activities connected with freedom of expression and information.

This can involve information about companies, technology professionals, researchers, public officials, organizations, institutions and private individuals. It may include professional activities, statements, photographs, legal proceedings, allegations, public records and information supplied by sources.

Privacy rights may operate differently when applying them would materially interfere with legitimate journalism, source confidentiality, freedom of expression, legal claims or preservation of the public record. These considerations do not create an unrestricted right to publish private information. CyberInsightEU considers accuracy, relevance, proportionality, fairness, public interest, potential harm and applicable legal protections when making editorial decisions.

Sensitive Information

Certain categories of information require particular care because misuse can create significant harm. These may include health and disability information, racial or ethnic information, religious beliefs, political opinions, trade-union information, sexual orientation or sex-life information, biometric or genetic information, criminal allegations, information concerning children, precise location, financial credentials, identity documents and confidential communications.

CyberInsightEU does not request such information through ordinary forms unless there is a genuine reason to do so. Where sensitive information becomes relevant to journalism or another legitimate activity, its collection and use are assessed against the applicable legal basis, editorial purpose, necessity and potential impact.

Children

CyberInsightEU is a general publication and does not operate on the assumption that children need to establish public accounts or profiles to use the website.

The publication may nevertheless report on children or publish material that younger audiences can access. When a child is identifiable, additional consideration may be given to age, maturity, safety, consent, family circumstances, long-term consequences and the public interest involved.

A parent, guardian or institution does not automatically have authority to authorize the publication of every piece of private information about a child. Where a child’s identity or circumstances are editorially relevant, CyberInsightEU considers whether identification is necessary and proportionate.

Website Technical Data

Operating a modern website requires certain technical information to pass between a visitor’s device and CyberInsightEU’s systems. This information may be processed to deliver requested pages, maintain availability, detect malicious activity, investigate errors, manage traffic, protect infrastructure, maintain security records and understand technical performance.

Depending on the system involved, information may include IP address, browser type, operating system, device characteristics, requested resources, referring page, timestamps, general geographic region, error information, security events, consent settings and identifiers associated with cookies or similar technologies.

Optional technologies and their current purposes are described through the applicable cookie controls and related information.

Cookies and Similar Technologies

CyberInsightEU may use cookies, pixels, local storage and comparable technologies to provide essential functionality and, where permitted, support analytics, advertising, personalization or other optional functions.

Where applicable law requires consent, optional technologies are not activated before the required choice has been obtained. Visitors may decline optional technologies and may subsequently change their preferences through the available controls.

Cookie preferences do not necessarily prevent all technical processing. Security, authentication, fraud prevention, core functionality and certain editorial or legal processes may continue where they have an independent lawful basis.

Correspondence

Messages sent to CyberInsightEU may be retained so that the newsroom or relevant operational team can understand the request, respond appropriately and maintain a record of significant communications.

Depending on the matter, the record may include contact information, correspondence, attachments, relevant article details, dates, routing information, response history and actions taken.

Ordinary contact channels should not be used to transmit passwords, private cryptographic keys, payment-card information, complete medical files, unnecessary identity documents or other highly sensitive information. Where secure communication is necessary, the appropriate reporting channel should be used.

Corrections, Complaints and Rights of Reply

When a person challenges published material, CyberInsightEU may need personal information to establish who is making the request, identify the relevant article, evaluate evidence, consult the author or editor, investigate the matter and determine an appropriate response.

Records may also be retained to document the decision and, where appropriate, publish a correction or right of reply. Public notices and editorial outcomes are drafted to avoid exposing unnecessary personal information.

Confidential sources are not identified merely because someone involved in a complaint, correction request or dispute asks for their identity.

Authors and Contributors

Information relating to contributors may include legal and publishing names, contact details, professional biographies, qualifications, affiliations, conflicts of interest, pitches, drafts, editorial correspondence, contracts, payment records, invoices, tax information, publication history and correction records.

Where relevant to transparency, CyberInsightEU may also record contributor declarations concerning conflicts, source relationships or the use of artificial intelligence and other production tools.

Only information considered appropriate for public presentation is included in author profiles. Verification documents and other private administrative information are restricted to personnel who have a legitimate reason to access them.

Newsletters

If a reader chooses to receive a CyberInsightEU newsletter, the publication may retain the email address, selected newsletter, subscription status, confirmation record, delivery information, bounce status and unsubscribe history.

Where legally permitted and appropriately disclosed, limited engagement information may be used to understand newsletter performance. A person can unsubscribe using the mechanism provided in the message or by contacting CyberInsightEU.

An address that has unsubscribed may remain on a restricted suppression record so that the publication does not inadvertently send further marketing messages to that address.

Newsletter registration is not used as a disguised method of obtaining unrelated optional consent.

Commercial Enquiries

Commercial communications may generate records containing an organization name, representative, business contact details, advertising or sponsorship proposal, campaign information, client details, contracts, invoices, payment records, disclosure requirements and related correspondence.

Where necessary to administer these relationships, relevant information may be provided to accounting, payment, legal, hosting or other professional service providers operating under appropriate arrangements.

Security and Accessibility Reports

Security researchers may provide identifying information, contact details, affected domains or systems, vulnerability descriptions, logs, technical evidence, proof-of-concept material, preferred attribution and disclosure timelines.

Such reports can contain information that is highly sensitive from a security perspective. Access is therefore restricted according to operational need, and records may be retained for remediation, accountability, legal protection and responsible disclosure purposes.

Accessibility reports may contain information about a page or feature, browser, device, assistive technology and the barrier encountered. A person does not need to provide a medical diagnosis to report an accessibility problem. If someone voluntarily provides disability-related information, CyberInsightEU uses it only where relevant to addressing the request or improving accessibility.

Public Sources and Social Media

CyberInsightEU may use information published openly by governments, courts, regulators, companies, researchers, professional organizations and social-media users as part of editorial research.

Public availability is only one factor in deciding whether information should be used. The publication may consider authenticity, context, relevance, the individual’s public role, reasonable expectations of privacy, vulnerability, public interest, potential harm and whether identifying the person is actually necessary.

Online material can also be altered, impersonated, incorrectly attributed or removed from its original context. Public-source information is therefore not assumed to be accurate merely because it was publicly posted.

Sharing

CyberInsightEU may disclose personal information to organizations that provide essential services for the publication, including hosting, content delivery, email, cybersecurity, backups, analytics, consent management, payment processing, accounting, legal support, technical maintenance and accessibility services.

Information supplied to such providers is limited to what is reasonably required for the service, subject to applicable contractual, security and legal safeguards.

Information may also be disclosed where required by law or valid legal process, to protect a person or the publication from serious harm, investigate abuse or security incidents, establish or defend legal claims, support an organizational transaction, work with an authorized editorial collaborator or where the person has given appropriate consent.

CyberInsightEU does not treat personal information as a commodity for unrestricted sale. Commercial advertising, affiliate and sponsorship activities may involve other forms of data processing as described in the relevant notices, but such activities do not authorize deceptive or unlawful sale of personal information.

International Processing

Because CyberInsightEU and its technology providers may operate across jurisdictions, information can sometimes be processed in a country different from the one in which the individual lives.

Where applicable law imposes requirements on international transfers, CyberInsightEU seeks to use a recognized transfer mechanism, contractual safeguards, adequacy arrangement or another lawful method.

International processing can involve differences in legal systems and enforcement. CyberInsightEU considers the nature of the information, the service involved, the destination, applicable safeguards and the necessity of the transfer.

Retention

Personal information is not retained indefinitely simply because it has entered a system. CyberInsightEU considers the original purpose, ongoing operational requirements, legal obligations, accounting requirements, security needs, source protection, dispute periods and the importance of preserving the publication record when determining retention.

Different information therefore has different retention periods. Newsletter suppression records may need to remain after unsubscribe, financial records may be retained for statutory periods, complaint and correction records may be preserved for accountability, security information may be retained while an incident or related risk remains relevant, and confidential source material may require extended protection.

Published journalism and its correction history may remain available as part of the historical record even where other associated personal information is later deleted, restricted or modified.

Information that no longer has a defensible operational, legal, editorial or security purpose is periodically reviewed for deletion or anonymization.

Security and Incidents

CyberInsightEU applies technical and organizational controls intended to reduce the risk of unauthorized access, loss, alteration or disclosure. Depending on the system, these may include access restrictions, account security, multi-factor authentication, encryption in transit, backups, software updates, malware protection, logging, least-privilege access, secure disposal and incident-response procedures.

Particular controls may apply to confidential source material, security disclosures, administrative systems and other higher-risk information.

No internet-connected system can be guaranteed completely secure. If an incident occurs, CyberInsightEU assesses what happened, limits ongoing exposure, preserves relevant evidence, investigates the cause, evaluates affected information and takes remedial measures. Where legally required or appropriate, affected individuals, providers or authorities may be notified.

Rights

Depending on the applicable jurisdiction and circumstances, individuals may have rights concerning access to their personal information, correction of inaccurate information, deletion, restriction, objection, portability, withdrawal of consent and information about processing.

A person may also have the right to challenge certain automated processing or complain to a relevant data-protection authority.

These rights are subject to legal exceptions. In particular, processing may need to continue where necessary for journalism, freedom of expression, source confidentiality, legal obligations, security, fraud prevention, legal claims, public-interest reporting, protection of another person’s rights or preservation of the integrity of the public record.

Exercising Rights

Privacy and rights requests should be sent to privacy@cyberinsighteu.com with enough information for CyberInsightEU to understand what is being requested. Where possible, the request should identify the relevant account, communication, article, publication or processing activity and provide dates or other useful context.

CyberInsightEU may use proportionate identity verification to prevent another person from obtaining or altering personal information. A full identity document is not requested where a less intrusive verification method is sufficient.

Requests are handled within the period required by applicable law, including any lawful extension where additional time is permitted.

Deletion and Published Journalism

Deleting information from an operational system is not necessarily equivalent to removing journalism from the public record.

When a request concerns published material, CyberInsightEU may consider the accuracy of the information, its continuing public relevance, the person’s role, the passage of time, privacy interests, potential harm, legal developments, rehabilitation, source protection and freedom of expression.

Depending on the circumstances, an appropriate response may involve correcting information, updating an article, removing unnecessary personal details, anonymizing material, restricting access, applying technical measures affecting discoverability, deleting associated operational data, or—where justified—removing or retracting published material.

Direct Marketing and Automated Decisions

Recipients may opt out of direct marketing communications at any time. Once an objection or unsubscribe request is processed, CyberInsightEU stops the relevant marketing communication and may retain limited suppression information solely to prevent future unwanted messages.

Editorial correspondence, responses to requests and essential service communications are not automatically classified as marketing merely because they are delivered electronically.

CyberInsightEU may use automated tools for functions such as spam detection, security monitoring, routing, transcription, analytics and administrative assistance. Significant editorial, privacy, complaint or rights decisions are not intended to be made solely by automated processing without appropriate human oversight.

External Links and Policy Changes

CyberInsightEU links to external websites, platforms and services for editorial, technical or commercial purposes. Those services may collect information under their own privacy notices, and CyberInsightEU cannot control processing carried out independently by third parties.

Where an embedded or external service introduces optional tracking, CyberInsightEU takes appropriate measures based on the applicable consent requirements and configuration.

This policy may change when CyberInsightEU introduces new services, changes technology providers, modifies processing practices, responds to legal developments or identifies new privacy and security risks.

The effective version will reflect the current practices rather than describing proposed systems as though they were already operational. Where a change is materially significant, CyberInsightEU may provide additional notice through the website or another appropriate communication channel.

Contact and Complaints

Privacy questions, access requests, deletion requests and other data-protection matters may be sent to privacy@cyberinsighteu.com.

Security vulnerabilities and suspected privacy-related security incidents may be reported to security@cyberinsighteu.com.

Formal legal correspondence concerning privacy matters may be sent to legal@cyberinsighteu.com.

Where applicable law provides a right to complain to a supervisory or data-protection authority, individuals may exercise that right independently of contacting CyberInsightEU.