Virtual Cyber School

Privacy Notice

Last Updated: 28 April 2020

Who is holding my data?

Your information is being collected by 'Cyber Discovery' Virtual Cyber School to help run and deliver the UK Government’s Virtual Cyber School programme. The UK Government tell us how they want your information to be used. They are what’s called the 'data controller'.

Cyber Discovery Virtual Cyber School is delivered by the Escal Institute of Advanced Technologies (SANS Institute) as part of the CyberFirst initiative - we 'process' your data.

This means doing things to your data such as storing and analysing it or even deleting it.

We will ask your permission before we pass your information to any other organisation but on occasion we may send your information to other related Cyber First initiatives or to Ecorys who are appointed by HM Government to evaluate the success of Cyber Discovery and its associated programmes.


We get your information from your registration form, from your use of our website, and from details of your progress within CyberStart.

For us to process your data we need to get your consent or permission to use your information on behalf of all those involved.

We can’t enrol you in the programme and keep you up to date without your registration information, and we also need to monitor your progress.

Whether you choose to join or leave Cyber Discovery’s Virtual Cyber School is entirely up to you. The only effect of asking us to delete your information would be that you are no longer able to be a member of the program.

You must be at least 13 to consent to us holding your data as you need to understand what is happening to your data and any risks there are with us holding it. You must be at least 13 years of age to join the program. We ask you to give us your date of birth to verify this.

We've tried to make this notice easy to read, but you can always contact the Data Protection Officer via who will help explain things further and will answer your questions.

So what data do you have about me?

We hold information which you provided on registration and information gathered as you progress through the the CyberStart platform including:

Your name, email address, access credentials, subscription preferences, your IP address and cookie data, gender, school, date of birth, your ethnic group, the date of enrolment onto the programme, details of how you have progressed on the programme, the scores that you have achieved via the challenges, and how you are using the web sites that make up the Cyber Discovery Virtual Cyber School programme and the CyberStart product.

We use your information to monitor progress and to report on the success of the programme. Sometimes we may send you marketing messages relating to Cyber Discovery, CyberFirst or other related DCMS programmes. We will not send you any other marketing messages. We will also send you essential information on the running of the program through our partner SendGrid, or our partner Campaign Monitor. In order to do this we have to pass your details to SendGrid and Campaign Monitor.

We also have to report to the UK Government on the success of the programme. This is on a wide scale and we try not to provide your individual identifying details.

The UK Government typically receives general figures such as how many females or males have made progress within CyberStart Game.

We also collect data to monitor our site and make sure it stays safe for everyone to use. For example, we may check for misuse of the platform or try to detect if abusive language is being used. This is against Cyber Discovery rules and the CyberStart product Terms and Policies.

Leaving the programme and removing your information

If you change your mind about allowing us to use your information you simply need to tell us by emailing We will then take you through a couple of quick steps to confirm you want to delete your information and leave the Virtual Cyber School programme.

We'll update you when this has been done or in exceptional circumstances if we can’t do this.

Why do you need my information anyway?

We need it to run the Virtual Cyber School for the UK Government, and to report on the progress of young people who have joined up.

The information is used to see how successful the programme is and to make sure we are meeting targets for diversity and inclusivity.

If you don't want us to hold your information you will no longer be able to participate in the programme, and we will delete your records from the system.

So who is going to see my information or be given it?

The UK Government and SANS will have access to your information if they need it. In most cases the UK Government will only see general figures such as percentages. The Virtual Cyber School programme uses two companies called SendGrid and Campaign Monitor to send you essential email communication. On occasion we may pass your details to Cyber First so that they can update you on other initiatives within their programme or to Ecorys who evaluate Cyber Discovery for the UK Government. We make sure that all the companies we work with comply with the law and protect your data. We do not make automated decisions based on your data however we may use the information to assess your progress on the programme.

You aren't going to send my information out of the UK or to other companies are you?

Your information will be stored and processed within the European area on 'cloud' services. The only time your information may go further than this is where we use your details to conduct a survey as detailed above. We make sure only reputable companies are used for this and we do not use your information for external marketing unless we get your consent. We always ensure that there are protections in place to safeguard your data. Information that is obtained from Cookies is managed under our Cookie policy. You can find a list of all the companies that we work with below.

What security measures are you taking?

As cyber security experts we are very aware of the risks around data security. We carry out regular security assessments to make sure your information is secure. We follow all the standard industry practises to make sure we hold your information as securely as possible.

How long with my information be held?

We keep your information for five years or until you ask us to delete it if this is sooner and you wish to leave the programme. If the circumstances arise where we need to keep the data longer we will tell you and explain why. If you have asked us to delete your data we will do this as quickly as possible however there may be some minimal details that we have to keep for audit or safeguarding purposes.

What if the data you hold is wrong or I want to remove it?

If the information we have about you is incorrect, tell us and we will correct it. We’ll do this as quickly as possible, or at the latest within 30 days.

If you want your information deleted or 'erased' that's not a problem: however, it would mean that you have to leave the programme as we need the data to provide you access to the programme websites, assess your progress, and report to Government.

What about my other rights?

You have a right to have a copy of the information which we hold on you or to transfer your information. You can make a request for a copy of your data through the support channel and any data that is available to transfer will be made clear to you as you use the platform. You can action this through the CyberStart platform.

What if I want more information or I want to complain?

If at any time you want further information, or you need help understanding what you can and cannot request, or if you want to make a complaint, the Data Protection Officer can help you with this.

Our Data Protection Officer can be contacted via the support channel. Please email and ask to be put in contact with the Data Protection Officer.

If you still aren't happy with our response you can complain to the Information Commissioners Office.

Back to top

Safeguarding Statement

Last Updated: 28 April 2020

Cyber Discovery’s Virtual Cyber School programme engages with children between the ages of 13-18 through an online platform. We also engage with younger children for the purposes of promotion of the Cyber Discovery Programme for future registrations.

The welfare of our students is paramount to us and we acknowledge that all children regardless of their age, culture, disability, gender, language, racial origin, religious beliefs and/or sexual identity have the right to be protected from harm and abuse.

The Cyber Discovery Schools programme acknowledges it has a duty of care to safeguard and promote the welfare of children we engage with and we work closely with the NSPCC to ensure safeguarding practices reflect statutory responsibilities, guidance and best practice. Our events and activities are created and led by staff with extensive background checks and safeguarding training.

We want to ensure that all the children we engage with have a positive and enjoyable experience of our programmes and that they are protected from harm and abuse whilst participating. We are also fully committed to ensuring that the personal data of the children that we engage with never falls into the wrong hands.

All suspicions and allegations of abuse and poor practice will be taken seriously and responded to swiftly and appropriately.

Back to top