Survey-specific Privacy Policy

1. Controller and research partner

Cybility Consulting Ltd is the data controller for this survey. The survey is conducted in partnership with Charity IT Leaders (CITL).

CITL is a research partner. Unless we specifically tell you otherwise in relation to a separate activity, Cybility will provide CITL with aggregated and anonymised findings only, not identifiable individual survey responses.

2. Purpose of the survey

The survey explores how charities, community organisations and other third-sector bodies experience, prioritise and manage cybersecurity, information governance, data protection and resilience. We use the information collected to:

• understand sector-wide experiences, priorities, strengths, constraints and support needs;
• analyse patterns by broad organisational characteristics, such as size, legal form, operating context and sub-sector, where it is safe and meaningful to do so;
• produce an aggregated research report, benchmarking insights and practical learning resources;
• inform future research, events and support connected with third-sector cyber resilience; and
• administer optional prize-draw entry and optional recruitment for interviews, quotations or case studies, where you choose to take part.

We will not use your survey responses to make decisions about you or your organisation solely by automated means.

3. Information collected

The survey is designed primarily to collect organisational information. Depending on the questions you answer, this may include:

• responses about cyber incidents, attempted attacks, near-misses, data breaches, ICO-reporting arrangements, preparedness, governance, resourcing, suppliers and emerging threats;
• broad organisational characteristics, including approximate income band, location or operational footprint, legal form, sub-sector, service model and respondent role;
• optional responses about inclusion, accessibility, “led by and for” status, and neurodivergent representation in organisational roles;
• optional free-text comments; and
• if you opt in separately, contact details for a prize draw, follow-up interview, quotation or case-study discussion.

SmartSurvey provides the survey platform and processes survey data on Cybility’s behalf. SmartSurvey may also process limited technical information needed to provide, secure and administer the platform. SmartSurvey’s own privacy information applies to its processing as a service provider.

4. Please avoid identifying or sensitive information

Please do not include names, personal contact details, credentials, beneficiary or client information, live vulnerabilities, detailed security configurations, or other confidential information in free-text answers unless it is genuinely necessary.

Do not provide information that identifies, or could reasonably identify, a person’s health, disability, neurodivergence, ethnicity, sexual orientation, religious belief, trade-union membership, criminal-offence history or another sensitive personal circumstance. You do not have to answer the optional inclusion and neurodiversity questions.

If a response includes information that we cannot safely use, we may remove, generalise or exclude that detail from analysis and reporting.

5. Lawful basis

For the main survey, Cybility relies on its legitimate interests in conducting independent research that supports cyber resilience, information governance and practical learning across the third sector. We have considered the potential impact on respondents and use measures including data minimisation, restricted access, separation of optional contact information and disclosure controls to protect confidentiality.

Taking part is voluntary. You may stop completing the survey at any point before submitting it. You may object to processing based on legitimate interests; see section 10 for how to contact Cybility’s DPO.

Prize-draw entry, follow-up contact, interviews, quotations and case studies are separate optional activities. We will explain the applicable purpose and terms when you are invited to take part. Before arranging an interview or publishing identifiable material, we will provide further information and obtain the appropriate specific agreement or consent.

6. Confidentiality and reporting

We will treat survey responses as confidential. We intend to publish findings in aggregated form and will use disclosure controls, including grouping, suppression, redaction and generalisation, to reduce the risk that a person or organisation could be identified.

A combination of organisation characteristics, respondent role, distinctive circumstances or free-text answers could make an organisation or individual identifiable to Cybility or to someone with relevant contextual knowledge. Please do not include unnecessary identifying detail.

We will not publish identifiable quotations, case studies, organisation-level findings or other identifying material without specific prior agreement. If an organisation is selected for a quote or case study, we will agree the proposed attribution, wording and contextual detail before publication.

Where participant numbers are small, or a breakdown could create an identification risk or unreliable comparison, we may combine categories, suppress results or decide not to report them.

7. Prize draw, interviews and case studies

If you choose to enter the prize draw or register interest in a follow-up interview, quote or case study, we will collect the contact information needed for that purpose, such as name, role, organisation, email address and contact preference.

We will keep optional contact details separate from main survey responses wherever practicable. Access will be limited to members of the project team who need the information to administer the draw or make follow-up contact. These details will not be used to identify your survey answers in published reporting.

Prize-draw entry is optional and is subject to separate prize-draw terms. Registering interest in an interview or case study does not guarantee selection. Any thank-you voucher offered for an interview is not dependent on the views expressed or survey answers provided.

8. Access and sharing

Access to identifiable survey information is limited to authorised Cybility research-team members who need it for the purposes described in this notice and SmartSurvey as survey-platform provider processing data on Cybility’s behalf.

Cybility may share aggregated and anonymised findings with Charity IT Leaders (CITL) and other audiences, including survey participants, third-sector organisations, funders, collaborators and the public. We will not share identifiable individual survey responses with CITL unless we tell you beforehand and have a clear lawful basis to do so.

9. Retention

We will retain identifiable survey information for 18 months after the survey closes, then securely delete it or anonymise it, unless a longer period is necessary to handle a complaint, legal claim or legal obligation.

We may retain anonymised and aggregated research findings for longer because they no longer reasonably identify individuals or organisations.

Prize-draw contact details will be deleted once the draw has been completed and prizes administered, normally within three months of the draw closing. Contact details and materials collected for interviews, quotes or case studies will be retained for the period explained in the separate information provided for that activity.

10. Your rights and contact

For information about your rights, including access, correction, erasure, restriction, objection, portability and complaints, please see Cybility’s Company Privacy Policy at www.cybility.co.uk/privacy.

If you ask us to access, amend or remove a survey response, we may need sufficient information to locate it, such as its approximate completion date and time and any survey reference provided. Depending on how the survey was completed, we may not be able to identify a particular response.

For survey-specific questions, contact thirdsectorreport@cybility.co.uk. To exercise your data protection rights or contact Cybility’s DPO, email dpo@cybilityconsulting.co.uk.

11. Changes to this notice

If the survey arrangements change materially, we will update this notice and make the current version available through the survey and/or Cybility website.