This policy transparently explains what personal data IBCSC processes, why it does so, how long data is kept and how you can exercise your rights.
Last updated · 13 October 2026
This policy applies to website visitors, form users, account holders, applicants, employers, advertisers, institutional contacts and persons referred to in a report or application. It covers processing carried out through ibcsc.be and its administration.
The controller is the Institut Belge de Cybersécurité Citoyenne ASBL, with registered office at Rue André Lafaille 6, box 012, 6031 Monceau-sur-Sambre, Belgium, enterprise number 1039.889.191. IBCSC has not appointed a data protection officer at this time. Privacy requests may be sent to info@ibcsc.be.
The data processed depends on the service used. IBCSC limits collection to information relevant to the stated purpose and asks users not to submit excessive information.
Data mainly comes from the data subject when they submit a form, create an account, publish a listing or apply. Some information may be provided by another user in an application or report, or generated by the system for security and administration. IBCSC may consult public sources where a limited and legitimate verification is necessary.
Each processing activity relies on a legal basis appropriate to its purpose. IBCSC does not use personal data for behavioural advertising and does not sell it.
Published listings, professional profiles and contact details that a user chooses to display become visible to website visitors. Users should not publish a home address, identity document, national number, bank details, password or unnecessary sensitive data. IBCSC may hide or remove manifestly excessive data.
Access to non-public data is limited to authorised persons who need it to administer the service. Depending on the service, information is disclosed to a listing author, applicant or chosen contact. Technical providers may process data for hosting, email, maintenance or security under instructions and confidentiality duties.
The main operational infrastructure is administered in the European Union. IBCSC does not organise systematic transfers outside the European Economic Area. If a future service involves such a transfer, the Institute will verify an adequacy decision or put required safeguards in place and update this policy.
Data is kept for the time required for its purpose and is then deleted or anonymised, unless a legal duty, report, dispute or evidential need justifies limited additional retention.
IBCSC applies proportionate technical and organisational measures: encrypted communications, restricted access, private storage separated from the public website, password hashing, session protection, short-lived tokens, attempt limits, backups and logging of administrative actions. No system is absolutely secure; measures are reviewed against risk and service developments.
Subject to the GDPR, you may request access and a copy, rectification, erasure, restriction, portability where applicable, or object to processing based on legitimate interests. Where processing relies on consent, it may be withdrawn at any time without affecting earlier lawful processing.
Send a request to info@ibcsc.be or to the registered office, stating the right exercised and information identifying the relevant service. IBCSC may request proportionate proof of identity where reasonable doubt exists. A response is provided without undue delay and generally within one month; this may be extended in the cases allowed by the GDPR.
You may request mediation or lodge a complaint with the Belgian Data Protection Authority: Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, +32 (0)2 274 48 00. Without limiting your rights, IBCSC invites you to contact it first so that the issue can be addressed.
The website is not designed to collect sensitive data or children’s data without necessity. A report may nevertheless contain special information. Submit only what is strictly necessary, redact irrelevant documents and identifiers, and avoid sharing third-party data without a legitimate basis.
IBCSC does not make decisions producing legal effects solely by automated processing and does not use a visitor advertising profile for moderation. If advertising consent is granted and an advertising tag is active, Google may personalise advertising as described in the Cookie policy. Moderation decisions are reviewed by an authorised person.
Like any web service, the hosting server may retain limited request logs such as IP address, date, requested path, response status and security events for security, availability, diagnostics and abuse prevention. Client-side audience measurement remains disabled unless it is accepted in the consent manager; when accepted, the categories described in the Cookie policy may be collected. The IP tool sends an address to ipwho.is only after an explicit user action.
The strictly necessary session cookie is described in the Cookie policy. IBCSC may update this policy when its activities, processing or applicable law change. Material changes will be communicated appropriately and the update date will be revised.
To create and manage a candidate or employer workspace, IBCSC processes identity and contact details, the professional profile, CVs and attachments, preferences, applications and employer-verification information. The account, profile and each application are processed to provide the requested service or take requested pre-contractual steps. Optional visibility, job alerts and any disability information rely on the person’s choices and, where required, explicit consent.
The candidate profile and private documents are kept while the account remains active and are then deleted with the account, unless a legal duty, dispute or evidential need justifies limited retention. Each submission creates a fixed copy of the application file and the platform immediately assigns it an expiry date.
To limit service availability to the European Union, the United States and Canada, the server locally compares the directly received IP address with a GeoIP database installed on the infrastructure. No IP address is sent to an external provider for this check. The processing relies on IBCSC’s legitimate interest in defining and securing the service availability area.
Only if you accept the category "Audience measurement and technical fingerprint", a script collects information about your visit and your browser. Without this consent, none of this is collected.
To protect candidates, freelancers and employers against fake profiles and fraud, every jobs.ibcsc.be account is identified.
Messages and attachments exchanged between members are stored encrypted on our servers.
For account security, jobs.ibcsc.be logs logins, logouts, failed attempts and actions performed by members (page, form, date, IP address, browser). Passwords, codes and IBANs are never included.
Payments (freelance orders and donations to the ASBL) are processed by Mollie B.V. (Amsterdam, Netherlands). IBCSC neither receives nor stores your card data or bank credentials; we retain the amount, date, status and payment reference.
The data is hosted on our own servers in Belgium. It may be transmitted, for the stated purpose only, to:
If you subscribe to the IBCSC newsletter (form on the site with email confirmation, or a ticked box in your account on ibcsc.be, jobs.ibcsc.be or market.ibcsc.be), we send you our publications, alerts, events and announcements.
To secure our services, detect abuse and improve search and usability, ibcsc.be, jobs.ibcsc.be and market.ibcsc.be keep a browsing log of every visit.
You can lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels (www.dataprotectionauthority.be). Last update of this policy: October 13, 2026.
We use mechanisms required for the operation and security of the site. With your consent, we may also measure site use and fund our content through advertising. Refusing is as easy as accepting.