Privacy notice

This privacy notice explains how THREATBYTES™ ("we", "us") handles personal data when you use the public research website, documentation, and (where enabled) platform services associated with the doctoral research programme in predictive malware intelligence.

We process personal data lawfully, fairly, and transparently. Formal data-controller details for the host institution will be published when doctoral registration and hosting are confirmed.

Until institutional affiliation is confirmed, enquiries about this notice should be sent through the Contact page. When confirmed, the data controller will be the awarding/host institution together with the programme lead, and this notice will name the controller, Data Protection Officer (if applicable), and registered address.

Depending on how you use the site, we may process:

- Identity and contact data (name, email, organisation) when you contact us or request platform access. - Account and authentication data if you register for research or demonstration accounts. - Technical and usage data (IP address, browser type, device identifiers, pages viewed, timestamps) from server logs and analytics configured for security and performance. - Submission metadata when you use specimen or research workflows (filenames, hashes, upload timestamps, contributor identifiers). We do not intend to collect unnecessary content from live malware beyond what is required for governed research ingestion. - Communications you send us (email content, support tickets).

We rely on one or more of the following, depending on the activity:

- Legitimate interests: operating and securing the research platform, documenting the programme publicly, and responding to enquiries, balanced against your rights. - Contract: providing services you sign up for where account terms apply. - Legal obligation: compliance with research ethics, security, or institutional requirements when applicable. - Consent: where required for optional cookies or mailing lists; you may withdraw consent without affecting lawful processing before withdrawal.

We use personal data to:

- Provide and improve the website and platform features. - Authenticate users and enforce role-based access in research demonstrations. - Process governed malware-specimen submissions and maintain provenance records for doctoral research. - Respond to contact, collaboration, and security disclosure reports. - Monitor abuse, protect infrastructure, and investigate incidents. - Meet ethics, audit, and reproducibility obligations for the research programme. - Publish aggregated, non-identifying research statistics where appropriate.

We do not sell personal data. We may share data with:

- Host institution systems and supervisors when affiliation is confirmed. - Infrastructure providers (hosting, email, analytics) under data-processing terms. - Ethics or security reviewers where required for responsible research. - Law enforcement or regulators when legally required.

Malware specimens and analysis artefacts are handled under separate research governance documented on the Ethics and Security research pages - not as personal data unless they contain identifiable information about individuals.

If processors or services are located outside the United Kingdom, we use appropriate safeguards (such as UK adequacy regulations, standard contractual clauses, or equivalent mechanisms) unless a narrow legal exception applies. Details will be listed in an updated notice when production hosting is finalised.

We keep personal data only as long as necessary for the purposes above, including:

- Contact correspondence: typically up to two years unless needed for ongoing collaboration or legal claims. - Account data: for the life of the account plus a short archival period. - Server logs: rolling retention aligned with security monitoring (often 30-90 days unless incident investigation requires longer). - Research submission records: for the duration of the doctoral programme and any mandatory institutional retention period.

We may anonymise data for long-term research archives.

Under UK data protection law you may have the right to access, rectify, erase, restrict processing, object, data portability, and to withdraw consent where processing is consent-based. You may lodge a complaint with the Information Commissioner's Office (ICO).

To exercise rights, contact us via the Contact page. We may need to verify identity before responding.

We ask for your choice the first time you visit, and you can change it at any time from Cookie settings in the site footer. We do not use advertising or analytics cookies.

- Essential, always on: tbmocksession keeps you signed in to the platform (session length, up to 8 hours). tbconsent records your cookie choice (180 days). tblocale holds your chosen language for the current visit so pages render in that language. - Functionality, only with your permission: tb_locale is kept for 12 months so we remember your language next time, and the tb-theme browser storage entry remembers light or dark theme. If you reject functionality cookies, we delete these and your choices last only for the current visit.

The live threat map loads map tiles from OpenFreeMap; this does not set cookies. You can also block or delete cookies in your browser settings, but blocking essential cookies will stop sign-in working. If we add new kinds of cookies, we will ask for your choice again.

We apply technical and organisational measures appropriate to a research platform handling sensitive security material metadata, including access control, encryption in transit, and monitored hosting. No system is perfectly secure; report concerns via Security disclosure.

The research platform is not directed at children under 16. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it promptly.

We may update this notice when features, hosting, or institutional requirements change. Material updates will be reflected on this page with a revised "last updated" date in page metadata when maintained.

Questions about this privacy notice or our use of personal data: use the general or research contact routes on the Contact page. For security issues affecting the platform, use Security disclosure.