PRIVACY NOTICE AND DATA PROTECTION STATEMENT

Project: Civilian Digital Infrastructure Protection (2025–2027)

Lead Institution: Georgia Institute of Technology (United States)

Supported By: International Committee of the Red Cross (ICRC)

1. Data Collection Categories & Usage We distinguish between data collected for active research participation and data collected solely for content distribution. You may belong to one or both categories.

A. For Active Program Participants (Research & Workshops)
• Data Collected: Name, Job Title, Professional Affiliation, Email, and Expertise Data.
• Usage: Identifying data is used strictly to verify credentials, qualify expertise for specific research tracks, and contact you regarding administration. Non-identifying data is aggregated to analyze project diversity and scientific validity.
• Access: Personally Identifying Information (PII) is accessible only to Georgia Institute of Technology Principal Investigators (PIs) and designated program administrators.

B. For Content Distribution (Newsletter & Updates)
• Data Collected: A valid email address is required. Name and affiliation are optional.
• Usage: We use this information solely to effect the distribution of project updates, newsletters, and public announcements to which you have positively opted-in.
• Storage & Third Parties: This data is stored securely in third-party email distribution services (e.g., compliant enterprise mailing vendors). These vendors process data solely for the purpose of sending our communications; they do not own, sell, or independently use your data.
• No Cross-Usage: Subscription to the newsletter does not constitute active participation in the research project, nor does it grant access to closed workshops.

2. General Data Protection & Anonymity

• No Sale or Sharing: We do not share, sell, or distribute email addresses or PII to third parties outside the core project administration and necessary technical vendors described above.
• Voluntary Anonymity (Participants): Active participants may choose to engage anonymously. However, choosing full anonymity may exclude you from participatory events where identity verification is logistically necessary (e.g., secure workshops).
• Anonymized Aggregation: All research data shared with external partners or published in reports is fully aggregated and anonymized.

3. Professional Capacity and Liability Disclaimer A participant may choose to engage with this project outside of their professional capacity.

• External Associations: Neither the Georgia Institute of Technology, the program administrators, nor any program participant are responsible for the associations external parties may make between participants and their organizations.
• Organizational Opinions: We are not responsible for the opinions of employing organizations regarding the participation of their associates, nor for any professional harm caused thereby.

4. Attribution & Consent We adhere to a strict “Opt-In” policy for attribution. All personal, professional, or organizational association with the project in any work product—public or private—requires explicit written approval from the individual or entity being identified before release.

5. International Data Storage Data will be securely stored on systems managed by the Georgia Institute of Technology in the United States. By participating or subscribing, you acknowledge that necessary administrative data may be processed in the U.S., subject to the access restrictions detailed in Section 1.

6. Your Rights & Unsubscribing Participation is entirely voluntary. You retain the right to:

• Unsubscribe: You may request your email be deleted from our distribution list at any time by contacting us or using the “Unsubscribe” link in any newsletter.
• Withdraw Consent: You may opt out of the research network at any time.
• Access & Erasure: You may request a copy of the data we hold on you or request its permanent deletion.