State of Cybersecurity in the Third Sector 2026

Prize Draw and Interview Incentive Terms and Conditions

STATE OF CYBERSECURITY IN THE THIRD SECTOR 2026

PRIZE DRAW AND INTERVIEW INCENTIVE TERMS AND CONDITIONS

Promoter: Cybility Consulting Ltd, trading as Cybility, registered in England and Wales with company number 13351214, registered office at 27 Old Gloucester Street, London, England, WC1N 3AX (“Cybility”, “we”, “us” or “our”).

These terms apply to the prize draw and follow-up interview thank-you arrangements connected with the State of Cybersecurity in the Third Sector 2026 research survey (the “Survey”). 

Table of Contents

1. PARTICIPATION AND ELIGIBILITY

1.1 Participation in the Survey, the prize draw and any follow-up interview is voluntary.

1.2 No purchase, payment or donation is necessary to enter the prize draw.

1.3 The prize draw is open to individuals who:

  1. are aged 18 or over;
  2. are resident in the United Kingdom
  3. complete the Survey during the survey fieldwork period; and
  4. work for, volunteer with, or serve as a trustee of a UK-based third-sector organisation, including a charity, housing association, social enterprise, community interest company or other not-for-profit organisation.

1.4 Entrants must provide accurate contact details and must be authorised to represent, or communicate on behalf of, the organisation identified in their entry.

1.5 One prize-draw entry is permitted per individual. Different eligible individuals from the same organisation may enter separately.

1.6 Employees, contractors and immediate family members of Cybility Consulting, Charity IT Leaders (CITL), and any organisation directly involved in administering the prize draw are not eligible to enter.

1.7 Cybility may disqualify an entry that is incomplete, misleading, fraudulent, submitted using automated means, or otherwise does not comply with these terms.

 

2. HOW TO ENTER

2.1 To enter the prize draw, an eligible participant must:

a) complete the Survey; and

b) select the optional prize-draw entry option and provide the requested contact details by the closing date.

2.2 Entry to the prize draw is optional. A participant may complete the Survey without entering the prize draw.

2.3 The prize draw opens on Tuesday 18th August at 16:00 BST and closes on Friday 18th September at 23:59 BST. Entries received after the closing date will not be included.

2.4 Cybility accepts no responsibility for entries that are lost, delayed, corrupted, incomplete, misdirected or not received for any reason.

 

3. PRIZE DRAW PRIZES

3.1 There are nine prizes in total:

a) Five prizes for eligible entrants from Micro or Small organisations: a one-hour Cybersecurity Clarity Call with Michala Liavaag, Cybility CEO and cybersecurity adviser.

b) Three prizes for eligible entrants from Medium organisations: one Cybility-delivered session selected by the winner from the options in clause 3.3.

c) One prize for an eligible entrant from a Large, Major or Super-major organisation: one year of organisational membership of Charity IT Leaders (CITL), subject to CITL’s applicable membership eligibility criteria and terms.  This prize is only available to those organisations that are not current members of CITL.

3.2 The five Micro and Small prizes will be awarded to five eligible entrants from organisations in either of those size bands. The three Medium prizes will be awarded to three eligible entrants from Medium organisations. The Large, Major and Super-major prize will be awarded to one eligible entrant from an organisation in any of those three size bands.

3.3 Each Medium-organisation winner may select one of the following Cybility-delivered prizes, subject to availability and clause 3.4:

a) A 60-minute cyber-risk briefing for a board, trustee group or executive team.

b) A 90-minute practical AI governance and security clinic for up to 6 people.

c) A 90-minute third-party and supplier cyber-risk clinic for up to 6 people.

3.4 The Medium-organisation prize options:

a) will be delivered remotely unless Cybility agrees otherwise in writing;

b) are limited to the stated duration and maximum number of participants;

c) are designed as facilitated advisory or educational sessions;

d) do not include legal advice, penetration testing, technical implementation, system configuration, remediation activity, procurement activity or follow-on consultancy; and

e) must be selected at the time of booking, booked within 90 days of winner confirmation, and delivered within six months of winner confirmation.

3.5 The Micro and Small prize is a one-hour remote Cybersecurity Clarity Call with Michala Liavaag. The winner may bring one pressing cybersecurity question, decision or concern for discussion. The call is intended to provide practical next steps but does not constitute legal advice, technical testing, implementation services or a substitute for a formal consultancy engagement.

3.6 The CITL prize consists of one year of organisational membership of Charity IT Leaders. Membership gives eligible technology, digital and IT colleagues access to CITL events, content, communities, mentoring and special-interest groups, in accordance with CITL’s current membership offering and terms.

3.7 Before awarding a prize, Cybility may reasonably verify the winner’s organisation type, annual-income band and eligibility. If a prospective winner does not meet the relevant criteria, Cybility may select a replacement winner from valid entries in the relevant category.

3.8 If there are no eligible entries in a prize category, Cybility may decide not to award that category’s prize or may reallocate it to another prize category.

3.9 Prizes are non-transferable, non-refundable and may not be exchanged for cash. No cash alternative is available. Cybility may offer an alternative prize of equal or greater value only where the advertised prize becomes unavailable or cannot reasonably be delivered.

 

4. ORGANISATION SIZE CATEGORIES

4.1 For the purposes of this prize draw, organisation size will be determined by the organisation’s most recently completed financial year’s gross annual income as stated in the Survey and, where reasonably required, evidenced to Cybility’s satisfaction.

4.2 The applicable organisation-size categories are:

a) Micro: less than £10,000.

b) Small: £10,000 to £99,999.

c) Medium: £100,000 to £999,999.

d) Large: £1,000,000 to £9,999,999.

e) Major: £10,000,000 to £99,999,999.

f) Super-major: £100,000,000 or more.

4.3 Where an organisation has not yet completed a financial year, Cybility may use its stated projected annual income or another reasonable indicator of organisational scale to determine its category.

4.4 These size categories are used solely to administer the prize draw and to support analysis of research findings. They do not indicate an organisation’s competence, cybersecurity maturity, suitability for any Cybility service or entitlement to any benefit beyond the prize stated in these terms.

 

5. SELECTING AND NOTIFYING WINNERS

5.1 Winners will be selected at random from all valid entries received by the closing date, using a verifiable random-selection method.

5.2 The prize draw will take place within 10 working days of the closing date.

5.3 Cybility will contact winners by email using the address supplied with the prize-draw entry within 10 working days of the draw.

5.4 A winner must respond and provide any reasonably required eligibility information within 14 days of the notification email. If a winner does not respond, is ineligible, or cannot accept the prize, Cybility may withdraw the prize and select a replacement winner.

5.5 Cybility will aim to provide or arrange each prize within 30 days of the winner’s eligibility and acceptance being confirmed, unless another timeframe is agreed with the winner.

5.6 Cybility’s decision on eligibility, prize allocation and all matters relating to this prize draw is final.

6. FOLLOW-UP INTERVIEWS AND £50 VOUCHER

6.1 Separately from the prize draw, Cybility may invite up to 15 Survey participants to take part in a confidential one-to-one follow-up interview.

6.2 Participants may indicate their interest in an interview using the separate, optional interview-contact option in the Survey. Indicating interest does not guarantee that a participant will be invited to interview.

6.3 Cybility will select and invite interview participants having regard to the research’s need for a balanced range of organisation sizes, types, roles and experiences. Selection is not random and is not a prize draw.

6.4 A person who is invited by Cybility, agrees to participate, and completes the agreed follow-up interview will receive a £50 Love2Shop voucher as a thank-you for their time.

6.5 The voucher is not conditional on the participant expressing particular views, providing favourable feedback or giving particular answers.

6.6 The voucher will normally be sent within 30 days after the completed interview, subject to Cybility receiving the information reasonably needed to issue it.

6.7 Before an interview is arranged, Cybility will provide further information about the interview, including its purpose, format, expected duration, confidentiality arrangements and relevant data-protection information.

 

7. DATA PROTECTION AND RESEARCH CONFIDENTIALITY

7.1 Cybility will process personal data supplied for the prize draw or interview recruitment in accordance with the Survey’s privacy notice.

7.2 Prize-draw contact details and interview-contact details will be collected separately from substantive Survey responses where practicable.

7.3 Contact details will be used only to administer the prize draw, verify eligibility, contact winners, recruit and arrange interviews, issue vouchers, and meet related record-keeping requirements, unless the individual has separately opted in to another purpose.

7.4 Personal contact details will not be included in published research findings. Survey and interview findings will be reported in aggregate or anonymised form, subject to the research privacy information and any separate interview consent arrangements.

7.5 Taking part in the prize draw or interview process does not subscribe a participant to marketing communications. Cybility will seek separate consent for marketing where required.

 

8. WINNER INFORMATION AND PUBLICITY

8.1 Cybility may publish or make available information sufficient to demonstrate that a valid prize award took place, normally the winner’s surname and county, consistent with applicable promotional-marketing rules.

8.2 Before entry, entrants may object to the publication or availability of this information, or ask Cybility to reduce the amount of information disclosed. Such a request will not affect eligibility or the chance of winning.

8.3 Cybility will not use a winner’s photograph, job title, organisation name, logo, testimonial or other material for marketing or publicity without the winner’s separate, prior consent and, where applicable, the organisation’s permission.

8.4 If Cybility is required to demonstrate that a valid award took place, it may need to provide relevant winner information to the Advertising Standards Authority on request.


9. LIABILITY AND GENERAL TERMS

9.1 Nothing in these terms limits or excludes liability that cannot lawfully be limited or excluded.

9.2 Subject to clause 9.1, Cybility is not responsible for any loss, damage, cost or expense arising from participation in the prize draw, use of a prize, or inability to use a prize, except where caused by Cybility’s negligence or breach of legal duty.

9.3 Cybility may amend, suspend or cancel the prize draw or interview incentive arrangements where reasonably necessary due to circumstances outside its reasonable control. Any material change will be communicated clearly.

9.4 These terms are governed by the law of England and Wales. The courts of England and Wales will have jurisdiction, subject to any mandatory rights available to participants under applicable law.

9.5 By entering the prize draw, an entrant confirms that they have read and agree to these terms and conditions.

9.6 Please retain a copy of these terms for your records.