Privacy Statement

The Institute of Cybersecurity and Applied Research Inc. (“ICAR,” “we,” “us,” or “our”) respects the privacy of individuals who interact with our websites, digital platforms, educational programs, professional certification services, examinations, research activities, events, institutional partnerships, employer initiatives, Placement+, ICAR Talent Readiness, and related services. This Privacy Statement explains how Institute of Cybersecurity and Applied Research Inc. collects, uses, stores, shares, protects, transfers, and otherwise processes personal information. By interacting with ICAR, you acknowledge that your personal information may be processed as described in this Statement and in any supplemental notice applicable to a specific service.

This Privacy Statement applies to personal information processed through ICAR-operated websites, applications, learner portals, certification and examination services, events, publications, research activities, customer support, institutional programs, professional communities, Placement+, Talent Readiness, purchases, payments, and related services. For certain activities, ICAR may provide a supplemental privacy notice containing more specific information. Depending on the activity and applicable law, ICAR may act as a data controller, organization responsible for personal information, processor, service provider, or participant in an independent or joint data-processing arrangement.

The organization responsible for ICAR-controlled personal information is Institute of Cybersecurity and Applied Research Inc., located at [Insert Address]. Privacy inquiries may be directed to Privacy@incyb.ca.

The information ICAR collects depends on the services you use and your relationship with us. Personal information may include your name, contact details, username, account identifier, authentication information, location, date or year of birth where necessary, educational institution, academic program, academic eligibility information, employment history, professional experience, résumé or CV, professional references, certification applications, credential information, examination status, assessment results, training records, and professional-development information.

Where examinations or assessments require additional controls, ICAR may process identification information, examination responses, scores, technical logs, proctoring records, screen activity, video or audio recordings, photographs, or other information reasonably required to preserve assessment integrity. Where you participate in Placement+ or ICAR Talent Readiness, ICAR may also process certification status, credential verification, career interests, professional-pathway information, readiness activities, employer-engagement preferences, professional-profile information, and employment-outcome information.

ICAR may also process communications, support requests, feedback, complaints, appeals, payment and billing records, transaction identifiers, marketing preferences, event registrations, device information, IP addresses, browser information, login history, platform activity, cookies, and similar technical information. Sensitive information will generally be collected only where reasonably necessary, for example to provide accessibility accommodations, satisfy identity-verification requirements, meet legal obligations, or administer specific services.

ICAR may obtain personal information directly from you, from your educational institution, an authorized ICAR partner, certification or examination organization, employer, Employer Partner, technology provider, payment processor, screening provider, or another service provider involved in delivering an ICAR service. In appropriate circumstances, ICAR may also verify professional credentials or other relevant information using legitimate public sources. Where an independent third party collects information directly from you, that organization may process your information under its own privacy terms.

ICAR may process personal information to create and administer accounts; register individuals for courses, certifications, examinations, events, and professional programs; assess eligibility; deliver educational content; coordinate examinations; administer or verify credentials; provide customer support; maintain program and transaction records; operate institutional and employer partnerships; manage Placement+ and Talent Readiness activities; facilitate approved employer engagement; improve ICAR services; conduct appropriate research and analytics; prevent fraud and misconduct; protect examination integrity; maintain cybersecurity; comply with applicable legal, financial, regulatory, sanctions, and recordkeeping obligations; and communicate relevant services, programs, events, professional opportunities, and updates.

ICAR may disclose personal information where reasonably necessary to provide its services or meet legitimate business and legal obligations. Recipients may include certification bodies, examination providers, educational institutions, Employer Partners, cloud and technology providers, payment processors, identity-verification providers, customer-support providers, analytics and security providers, consultants, auditors, accountants, legal advisers, insurers, government authorities, regulators, courts, and law-enforcement agencies.

Where ICAR shares information with an educational institution, information may include participation, completion, certification status, cohort information, or other data required for the applicable program. Where authorized candidate information is provided to an Employer Partner, it may be used for legitimate recruitment, career-engagement, internship, graduate-program, or employment-related purposes. ICAR does not sell personal information as a commercial database to unrelated third parties, and Placement+ Employer Partners do not purchase ownership of candidate information.

If ICAR undergoes a merger, restructuring, acquisition, financing, transfer of assets, or similar corporate transaction, relevant personal information may be transferred as part of that transaction subject to applicable law and appropriate safeguards.

ICAR seeks to collect personal information that is relevant, proportionate, and reasonably necessary for the identified purpose. We do not intend to collect information simply because it may become useful in the future. Individuals are responsible for providing reasonably accurate and current information. Inaccurate information may affect account access, certification eligibility, examination registration, credential verification, Placement+ participation, communication, or other services.

ICAR retains personal information only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable contractual, certification, accounting, tax, regulatory, security, fraud-prevention, dispute-resolution, and legal requirements. Different categories of information may therefore have different retention periods. Certification and examination records may be retained where necessary to maintain credential integrity, financial records may be retained in accordance with applicable accounting requirements, and consent or communication-preference records may be maintained where necessary to demonstrate compliance. Aggregated or appropriately de-identified information may be retained for longer periods.

ICAR uses reasonable administrative, organizational, physical, and technical safeguards designed to protect personal information from unauthorized access, loss, misuse, alteration, destruction, or disclosure. Depending on the nature of the service, these safeguards may include encryption, authentication, access controls, secure communications, system logging, network security, backups, vendor controls, confidentiality requirements, monitoring, and incident-response processes. No information system can be guaranteed to be completely secure, and ICAR cannot warrant absolute security.

If ICAR becomes aware of a material privacy or security incident, it may investigate, contain, remediate, document, and report the incident as required by applicable law. Where required, affected individuals, institutions, regulators, or other appropriate parties may be notified.

Depending on your jurisdiction, you may have rights to request access to personal information held about you, correct inaccurate or incomplete information, request deletion, restrict or object to certain processing, withdraw consent, request portability, object to direct marketing, obtain information concerning certain automated processing, or lodge a complaint with an applicable privacy authority. These rights are subject to legal exceptions and may not apply in every circumstance.

ICAR may request reasonable verification before processing a privacy request. Where information must be retained to comply with certification, financial, legal, fraud-prevention, or dispute-resolution requirements, ICAR may be unable to immediately delete it.

Where processing is based on consent, withdrawal of consent will generally affect future processing only and will not invalidate processing lawfully completed before withdrawal.

ICAR may use technology to support fraud detection, security monitoring, credential verification, learning analytics, career-pathway recommendations, candidate matching, Talent Readiness, and program analysis. Where automated processing is subject to specific legal requirements because it produces significant legal or comparable effects, ICAR will provide appropriate safeguards and information as required by applicable law. ICAR Talent Readiness and Placement+ matching are intended to support professional decision-making and do not require any employer to interview or hire a candidate. Employers remain responsible for final recruitment decisions.

ICAR may provide services internationally and may use service providers, certification organizations, institutions, employers, or technology infrastructure located in countries other than the country in which an individual resides. As a result, personal information may be transferred to or processed in jurisdictions with privacy laws different from those of the individual's home jurisdiction.

Where required by applicable law, ICAR will use appropriate mechanisms for international transfers, which may include contractual protections, data-processing agreements, standard contractual clauses, adequacy mechanisms, or other legally recognized safeguards.

ICAR websites and digital platforms may use cookies, analytics technologies, session identifiers, local storage, and similar technologies for authentication, security, site functionality, preferences, analytics, and marketing where permitted. Further details regarding these technologies and available choices are provided in the applicable “ICAR Cookie Policy” or consent-management tool.

ICAR may send communications concerning certifications, educational programs, research, conferences, webinars, professional development, Placement+, events, publications, newsletters, and related services. Individuals may generally unsubscribe from optional marketing communications at any time.

Certain communications are necessary to administer an active service or relationship and may include registration confirmations, invoices, examination instructions, credential notices, account updates, security alerts, policy updates, and other transactional or legal communications. These communications may continue while the relevant account, registration, certification, contract, or service remains active.

ICAR may process or screen information where reasonably necessary to comply with economic sanctions, export controls, trade restrictions, fraud-prevention requirements, anti-money-laundering requirements, or other applicable laws. Where an automated screening system identifies a potential match, ICAR will seek appropriate review before taking a materially adverse action where legally required or reasonably practicable. ICAR may decline, restrict, or suspend services where providing them would violate applicable law.

ICAR may use aggregated, statistical, or appropriately de-identified information for research, benchmarking, workforce analysis, professional capability research, certification analysis, employer-demand analysis, program evaluation, service development, and institutional reporting. ICAR will seek to use such information in a manner that does not improperly identify individuals.

ICAR may invite individuals to participate in testimonials, case studies, photographs, videos, alumni stories, or other promotional activities. Declining promotional participation should not ordinarily affect access to unrelated ICAR services.

If you apply for employment, consulting, training, examiner, advisory, contractor, or other professional opportunities with ICAR, we may process information reasonably necessary to evaluate qualifications, conduct recruitment, verify professional experience, manage contractual relationships, administer payment, comply with legal obligations, and maintain professional standards.

ICAR's services are primarily intended for adults, university-level students, professionals, institutions, and organizations. Where a participant is below the age at which they may legally provide valid consent or enter into an applicable agreement, appropriate authorization may be required. If ICAR becomes aware that personal information has been improperly collected from a child, ICAR will take appropriate action in accordance with applicable law.

If you provide ICAR with personal information concerning another individual, such as a reference, employee, student, colleague, representative, or emergency contact, you are responsible for ensuring that you are legally authorized to provide that information where required. You should not provide unnecessary sensitive information about another individual.

ICAR services may contain links to, integrate with, or operate alongside independent websites and platforms. ICAR does not control the privacy, security, or data-processing practices of independent third parties. Individuals should review the privacy information of those organizations before providing information directly to them. An external link or integration does not, by itself, constitute an endorsement of the third party's privacy practices.

ICAR may revise this Privacy Statement periodically to reflect changes in law, technology, services, data practices, partnerships, or organizational requirements.

ICAR may provide additional privacy notices or jurisdiction-specific provisions where required by local law, including in jurisdictions in which ICAR operates or provides services. Where mandatory local privacy legislation provides rights or protections that cannot lawfully be limited by this Statement, those requirements will apply.

Questions, privacy-rights requests, complaints, or concerns regarding this Privacy Statement or ICAR's handling of personal information may be directed to:

• ICAR Privacy Office
• Institute of Cybersecurity and Applied Research Inc.
• Privacy Officer / Data Protection Contact: [Insert Name or Title]
• Email: [Insert Privacy Email]
• Address: [Insert Address]
• Website: [Insert Website]

ICAR may require reasonable information to verify identity before processing certain privacy requests. Depending on your jurisdiction, you may also have the right to submit a complaint to an applicable privacy or data-protection regulator.

This Privacy Statement should be read together with the ICAR Terms of Use, ICAR Cookie Policy, Placement+ Privacy & Data-Sharing Notice, Placement+ Student Participation and Consent Terms, applicable certification and examination rules, partner agreements, and other privacy or contractual notices applicable to the relevant service. Where a specific service contains additional privacy terms, those provisions supplement this Statement.