Privacy Policy

Cyber Guardian Society is an independent student-led cybersecurity community. We collect the minimum amount of personal data needed to run the Society: membership applications, messages you send us, and the records that let us communicate with members and operate community programmes.

This policy explains what that data is, why we hold it, how long we keep it, and what you can ask us to do with it.

For the purposes of this policy, Cyber Guardian Society ("CGS", "we", "us") is the independent student-led organisation that operates this website and its community. Questions about this policy can be sent to the address listed on our contact page.

• Membership applications: name, preferred name, email address, phone or WhatsApp number, country, city, current status, institution, degree or programme, year or semester, and any professional links you choose to share.
• Division preferences, skills and experience, including an optional curriculum vitae file you upload.
• Correspondence: the contents of messages you send through the contact form or by email.
• Technical data: basic, aggregated request information such as IP address, browser type and pages visited, retained only in short-lived server logs for security and troubleshooting.

• To evaluate membership applications and decide who we can work with.
• To contact you about onboarding, events, training and Society business.
• To deliver the services and community programmes you ask us for.
• To keep our website secure, available and free of abuse.
• To meet legal, tax or safety obligations that apply to a registered organisation.

We do not sell personal data, and we do not share it for advertising. We do not use application data for automated decision-making.

Where the GDPR or an equivalent regime applies, we rely on your consent (for optional information you choose to provide), the steps taken at your request prior to joining (for an application), our legitimate interest in operating a secure, active community, and compliance with legal obligations.

Membership records, including uploaded CVs, are held in access-controlled storage that only authorised members of the independent student-led team can open. Files are never published or made publicly downloadable.

We keep application records for up to 24 months after an application is decided, then delete them. Declined applications are deleted after 12 months. Correspondence is retained for as long as needed to resolve the matter and to keep a record of Society decisions.

No system is perfectly secure, but we treat every team account as a security responsibility and never ask members to share credentials or handle data they are not authorised to handle.

We share personal data only where it is necessary: with service providers who host our infrastructure and email delivery under written data-processing terms, and where the law requires it. A list of current providers is available on request.

We do not sell data, rent mailing lists, or share member details with sponsors, recruiters or third parties for their own purposes.

• Ask what personal data we hold about you and get a copy.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete your data where we have no overriding obligation to keep it.
• Object to, or ask us to restrict, processing based on legitimate interest.
• Withdraw consent at any time for anything that relies on it.
• Complain to your local data protection authority.

Send any request to us and a member of the team will respond within 30 days. We may ask you to confirm your identity before we act on the request.

This site uses a small amount of local storage to remember your theme preference. It is never used to track you across other websites, and we do not run advertising or analytics cookies. If analytics are introduced later, this policy will be updated before they are enabled.

The Society is not directed at children under 16. If we learn that data was submitted by someone under 16, we delete it. Where a minor applies with a parent or guardian's involvement, we handle the record with that consent.

When this policy changes we update the date at the top of this page and, for material changes, notify members through the community channels before the change takes effect.