Privacy statement

1. Who we are

DIVD Academy is the education programme of the Dutch Institute for Vulnerability Disclosure. We train young people in cybersecurity, ethical hacking and IT fundamentals, and help graduates take a next step into practical experience. For questions about this statement or about your data, write to office@divd.academy.

2. What data we process

• Website statistics. We use GoatCounter to count page visits. It does not set cookies and does not build a profile of you; it stores aggregated data such as the page visited, the referring site and a rough browser and country indication.
• Sign-ups and applications. When you apply for a course, traineeship, internship or volunteer role, or fill in one of our questionnaires, we receive the data you enter in the form: your name, contact details, education or work background, motivation and anything else you choose to share.
• Course accounts. Our courses run on external learning platforms. To give you access we share the account data required by those platforms and we can see your enrolment and progress.
• Trainees, interns and volunteers. For people who join us we additionally process the data needed for the agreement and for supervision, such as school and supervisor details, an account on our own systems, and the fact that a Certificate of Conduct (VOG) has been received where one is required.
• Correspondence. Email and support messages you send us, including what you write in them.

3. Why we process it

• To handle your sign-up or application and to give you access to courses and learning materials.
• To supervise and support trainees, interns and volunteers, and to carry out the agreements we make with them and with schools.
• To answer your questions and support requests.
• To understand which pages of this website are used, so we can improve them.
• To report anonymised, aggregated numbers about our programmes to funders and partners.
• To comply with legal obligations.

Depending on the situation the legal basis is the performance of an agreement with you, our legitimate interest in running and improving the programme, a legal obligation, or your consent.

4. Who else processes your data

We do not sell personal data and we do not use it for advertising. We do use external providers to run the Academy: a form provider for sign-ups, learning platforms for the courses, a workplace and email provider, a support-desk tool, and hosting for this website. They process data on our instructions and are bound by agreements on security and confidentiality. We share data with a school or employer only where that is part of an internship or traineeship arrangement, and with authorities when the law requires it.

5. Cookies

This website does not place tracking or advertising cookies. The statistics we collect are cookieless. Pages that link to an external platform, such as a course environment or a sign-up form, are subject to that platform's own cookies and privacy statement.

6. How long we keep data

We keep personal data no longer than necessary. Sign-ups that do not lead to participation are removed once they are no longer relevant. Data about participation in courses, traineeships and internships is kept for as long as we are involved with you and for a limited period afterwards, so we can confirm participation and report on our programmes. Financial records are kept for the seven years that tax law requires.

7. Security

We take organisational and technical measures to protect personal data, including limiting access to the people who need it. Found a weakness in our systems? Please report it; our contact details for that are in security.txt.

8. Your rights

You can ask us to see, correct, delete or transfer your data, to limit what we do with it, or to object to it. Where we process on the basis of your consent, you can withdraw that consent at any time. Send your request to office@divd.academy and we will respond within one month. If you are not satisfied, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Links to other websites

This site links to external websites and platforms. We are not responsible for how they handle your data; please read their own privacy statements.

10. Changes

We may update this statement. The current version always stands on this page, with the effective date at the top.