Terms of Service Summary
Last Updated: October 12 2023
Our terms of service is backed by our policy framework, including our privacy and cookies policy. This document will be updated as the site and services it provides access to are changed.
By using this site and choosing to register for the CyberStart America program, you agree to these terms and associated policies referred to above. If you break the rules outlined below and in the detailed policies referred to above, we may suspend your access to the program and its associated third-party services, and, in severe cases, refer information to the relevant legal authorities.
We may amend these terms and our policies from time to time. If the changes are significant, we will notify you by email if you have already registered for the CyberStart America program.
Who can participate in CyberStart America
To participate in CyberStart America as a student:
- You must be at least 13 years of age as of September 1 2023
- You must be enrolled in 9th, 10th, 11th, or 12th grade at a U.S. public, private, or DoDEA secondary school (or the homeschool equivalent)
- You must have completed the student registration form by no later than January 11 2024
- You must agree to receive essential program communication via our selected provider Active Campaign
To participate in CyberStart America as a teacher, parent, or other advisor:
- You must be at least 18 years of age or older as of September 1 2023
- You must agree to receive essential program communication via our selected provider Active Campaign
- You must be involved in the education of U.S. high school students, through a school, homeschool or a relevant extracurricular club or program, and must provide details of your involvement on your registration form
When you register, you are required to give accurate information about yourself for purposes of safeguarding and to validate your eligibility for the program.
As part of the program, you will be provided with access to software and training content. You agree that this material will be used solely by you, the registered user, and not shared with other parties.
Eligibility for Our Service – Educators and other School Personnel
If you are entering into this Agreement on behalf of a company or other legal entity (including if you are School Personnel entering on behalf of your school), you warrant and represent that you have the authority to bind such entity to these terms and conditions, in which case the terms "you", "your" or "User" shall refer to such an entity. If you do not have such authority, or if you do not agree with these terms and conditions, you must not accept this Agreement on behalf of the legal entity, and may not use the Service in that capacity.
Rights to Access and use for Educational Purposes
Subject to your compliance with these Terms, CyberStart America hereby grants you the right to access and use the website and the services and content we offer to you or your school through the website. These rights are strictly limited to your educational, and non-commercial use of the website, services, and content in connection with your schoolwork, if you are a student, or the assignment of schoolwork or monitoring of an associated student's progress, if you are a parent, teacher, or administrator.
Who is eligible for an extended JROTC CyberStart licence
If you are a student or instructor in a JROTC program, you could be eligible for extended access to CyberStart through CyberStart America over the summer period before and after the advertized program dates. This extended access will only be available via a JROTC-specific registration link, which will be shared with eligible cadets and instructors via JROTC Cadet Command.
Any points scored after January 11, 2024 will not be counted as part of the 2023-24 CyberStart America program or any associated awards, but may count toward future awards, and may qualify you for JROTC-specific awards and training opportunities.
By registering an account and agreeing to these terms, we will provide you with a licence to access CyberStart, a third-party online service which contains training material, challenges and games.
Post-registration and using your CyberStart account to access the service and materials, you will be provided with material and tools that, applied unethically or without consideration, could result in violation of (amongst others) the Computer Fraud and Abuse Act of the United States or the Computer Misuse Act 1990 of the United Kingdom. By registering for this program, you agree that you will not use any of the information provided, tools or techniques against other individuals or organizations without consent to do so.
By registering for CyberStart America and providing accurate details, you agree that you will comply with our Policies and Terms & Conditions (Terms and Policies). Failure to do so could result in termination of your access.
In order to participate in and be eligible for the program, you must agree to receive essential program communication via our selected provider, Active Campaign. If you opt out of these emails or unsubscribe from them, you will not receive essential program communication and will become ineligible to participate and ineligible to be considered for prizes and awards.
By registering for the program, you may be assigned a licence to the CyberStart product. The license you are issued is for the purposes of the program and bound by the timeframes, eligibility criteria and scholarship or award criteria. Your license may be revoked for failure to comply with these terms, or otherwise at the end of your interaction with the program. CyberStart products operate under a commercial license, and your right to access and use the licensed material on the platform or any other expressions based on the product end with your license termination. You may continue to access your CyberStart account and the non-licensed content in accordance with the Terms and Policies of CyberStart.
As part of this program, subject to eligibility criteria, you may be granted a temporary licence to CyberStart. CyberStart provides educational material and security related puzzles or challenges. As part of these challenges you may be required to apply unusual tools or use patterns to services to uncover logic flaws or issues. With your licence, you are provided permission to undertake the activities covered in each of the 'briefings' against the defined targets. As covered in the product-specific licences and user guides, it is not acceptable to attempt denial of service attacks, or to purposefully attempt to cause damage to the infrastructure or data. It is also deemed a violation of acceptable use to identify flaws and to purposefully attempt to damage or disrupt other platform users, or their data.
Uncovering security flaws and learning about cybersecurity vulnerabilities will require use of certain tools that can only be used in a context where permission has been given by the target party, as is provided here. In severe circumstances where error cannot be blamed, violation of these terms could result in rejection from the program, or prosecution. If you are unsure of the activity you are undertaking at any time please contact email@example.com.
How your data will be used
How you may use material on the CyberStart America website
We are the owner or the licensee of all intellectual property rights in the CyberStart America website, and in the material published on it. Those works are protected by copyright laws and treaties around the world. All such rights are reserved.
You may print off one copy, and may download extracts, of any page(s) from our site for your personal use and you may draw the attention of others within your organization to content posted on our site.
You must not modify the paper or digital copies of any materials you have printed off or downloaded in any way, and you must not use any illustrations, photographs, video or audio sequences or any graphics separately from any accompanying text.
Our status (and that of any identified contributors) as the authors of content on our site must always be acknowledged.
You must not use any part of the content on our site for commercial purposes without obtaining a licence to do so from us or our licensors.
If you have any questions about these terms or any associated policy, please contact firstname.lastname@example.org.
Last Updated: August 4, 2023
CyberStart America is committed to protecting your privacy and complies with the principles of all applicable data protection laws and regulations, including the Family Educational Rights and Privacy Act (FERPA). We commit to holding the minimum amount of data that we can from you, and we are committed to ensuring that your data is handled properly and any information we hold is stored securely and used in a lawful and ethical way.
Who is holding my data?
Your information is being collected by CyberStart America to help run and deliver information security talent assessment and training programs. The program is delivered by the National Cyber Scholarship Foundation, a charitable foundation based in the United States of America at 8300 Douglas Avenue, Suite 800, Dallas, TX 75225, and CyberStart Limited, based in the United Kingdom at The Old Bull Pens, Sezincote, Moreton-In-Marsh, Gloucestershire, GL56 9AW. CyberStart Limited acts as the controller of your data, and National Cyber Scholarship Foundation acts as a processor of your data.
Educators' registration information (name, school, and contact information) will also be shared with state-specific "Task Forces" in states where these exist to support the delivery of the CyberStart America program in that state.
The Task Force teams for the 2023-24 CyberStart America program are:
- CSA State Taskforce for Alabama (Lead organization: Alabama State Department of Education - alabamaachieves.org)
- CSA State Taskforce for Florida (Lead organization: STEM2Hub - stem2hub.org)
- CSA State Taskforce for Georgia (Lead organization: University of North Georgia - ung.edu)
- CSA State Taskforce for Texas (Lead organization: Texas Advanced Computing Center TACC - tacc.utexas.edu)
- CSA State Taskforce for Virginia (Lead organization: CodeVA - codevirginia.org)
This program and the prior mentioned parties will maintain information that you provide to us, and data collected during your interaction with the provided services. This is collected for the operational purposes of security and safeguarding, but primarily for the running of the talent identification and training outlined on this website.
CyberStart America uses Amazon Web Services to host our registration service and store data.
We use Tableau to analyse and report on program registration, progress, and outcomes data.
We use a company called Active Campaign to send you important information about the program. This is information that you need to participate in CyberStart America.
Other organizations, such as cybersecurity employers, may offer prizes which you could be eligible for. If these become available and applicable to you, you will be contacted by email with a link to complete an application form, on which you will be asked for your consent to provide your data for you to receive your prize. If you are under 18, this consent for sharing your data will need to be validated by a parent/guardian.
We will always ask for your permission before sending your information to any other organization, or for any use case other than what is outlined above. We may on occasion offer you invitations to access or join third party services and/or platforms that may be of interest to you as a participant of CyberStart America. Your use of these services is entirely optional and will not affect your access to or eligibility for CyberStart America. We may send you information related to our programs and further suitable opportunities for you, which you may terminate at your discretion.
What information do you collect about me?
The types of information we hold about you include:
- When you register for the program as a student, we collect your first name, last name, email address, date of birth, school information, state information, your gender, race and ethnicity, whether or not you are a member of JROTC/CAP (and service/brigade information if applicable), and whether you want to join any of our communities.
- When you register for the program as a teacher, parent, or adult advisor, we collect your first name, last name, email address, school or organization information, state information, your job role, and whether you want to join any of our communities.
- Information on how you use and experience this website and its forms, including server logging that may contain basic data such as IP address, date and time, the URL or path of the resource or file accessed, browser information, or error information.
- Marketing Information including tracking and cookie data that we collect when you use our website.
Who are you sharing my personal data with?
When you register with CyberStart America, we will share your name and email address with the CyberStart game platform in order to create your account and provide you with a licence to the content on the CyberStart product.
If you are part of JROTC
Participants who identify themselves as a JROTC cadet through the registration form will have their Personal details (first name, last name, email address, and date of birth), school information, JROTC service and brigade information, and progress made within CyberStart (points score and levels reached) shared with the U.S. Department of Defense and the relevant service branch's Junior Reserve Officers' Training Corps (Army JROTC, Air Force JROTC, Navy JROTC, Marine Corps JROTC, Space Force JROTC, Coast Guard JROTC), for the purposes of identifying students for further cybersecurity training opportunities. The U.S. Department of Defense and any of its service departments may contact students directly regarding these opportunities. Aggregated reports of demographic information may also be shared, but sensitive personal data (race, ethnicity, gender) will not be shared in a personally identifiable way.
If you choose to join the CyberStart Community
If you ask to join one of our communities as part of your registration, we will share your name and email address with our community platform service, Bettermode (formerly known as Tribe). Your details will be shared only if you ask to join a community, and you can leave the community and ask Bettermode to remove your data at any time without changing your eligibility for CyberStart America.
If you register via your school
If you register as a student via your school, CyberStart America has the right to share your first name and last name with a teacher/school official confirmed by CyberStart America to be a current employee at the school you attend. If a teacher/official from your school requests information about participating students from the school, that teacher/official will be required to provide evidence of their identity and current employment at the named school before any student names will be shared with them. If this evidence is provided and validated, the first and last names of participating students from the same school can be shared securely with the teacher/official if requested. Identity and employment validation may be repeated each time a request is made, and we do not provide ongoing regular reporting to teachers with this information.
Where Data is provided by schools or other educational organizations
Where student data is provided to the program by their school or school district:
The school maintains control over any and all student data that is shared with CyberStart America. CyberStart America is committed to processing such data in alignment with this policy and fulfilling the obligations as outlined in the program's terms of service. This commitment ensures that the school remains the primary authority and controller over its student data while CyberStart America acts as a diligent processor to facilitate the program effectively.
Access and Deletion of Data
If the parent or legal guardian of a Student wants to review the information that CyberStart America has collected about the Student via their school or learn more about the Service(s) the Student is participating in, they should directly contact the Student's School.
If Schools wish to access, modify or delete other personal information that they have provided to CyberStart America, please contact us at email@example.com for assistance.
We will retain your information for as long as your account is active or as needed to provide you services. Please contact us if you wish to cancel your account or request that we no longer use your information to provide you services. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
Facebook Lookalike & Custom Audiences
Facebook Lookalike & Custom Audiences enables us to use existing datasets of users over the age of 18 (exclusively those who have registered as educators with CyberStart America) to compile groups and lists of users based on certain criteria in order to provide users with similar interests and preferences with relevant information on Facebook’s services. Before transmission to Facebook, the data is irreversibly encrypted in the form of hash values (encrypted numeric values) on our computers. The data of minors is not used for this purpose; this only applies to those registering as a teacher or educator.
When your data such as your IP address is collected by a third party, we rely on legitimate interests to provide a lawful basis for processing.
We get your information from your registration form, from your use of the website and materials, and from details of your progress in the program. For us to process your data we need to get your consent or permission to use your information on behalf of all those involved. We can't enrol you in the program and keep you up to date without your registration information, and we also need to monitor your progress.
Whether you choose to join or leave the program is entirely up to you. The only effect of asking us to delete your information would be that you are no longer able to be a member of the program. You are entitled to do this at any point in support of your right to be forgotten.
You must meet the program eligibility criteria in order to register, including the criteria that you are of an age which can consent to provide your data. For this reason, we ask for your date of birth.
We've tried to make this notice easy to read, but you can always contact the Data Protection Officer via firstname.lastname@example.org who will help explain things further and will answer your questions.
Leaving the program and removing your information
If you change your mind about allowing us to use your information, you simply need to tell us by emailing email@example.com. We will then take you through a couple of quick steps to confirm you want to delete your information and leave the program.
We'll update you when this has been done, or in exceptional circumstances if we can't do this.
Why do you need my information anyway?
We need it to run the program outlined on this site. The National Cyber Scholarship Foundation and CyberStart Limited will need your data to run the program, to assess eligibility, and to invite you to apply for scholarships and awards based on your performance in the program.
Program user data are not being used for other commercial purposes, and at no time will CyberStart America share or otherwise transfer students' personally identifiable information or directory information to a third party for advertising or marketing purposes.
If you don't want us to hold your information, you will no longer be able to participate in the program, you will not be invited to apply for any prizes related to the program, and we will delete your records from the system.
What security measures are you taking?
We carry out regular security assessments to make sure your information is secure. We follow all the standard industry practices to make sure we hold your information as securely as possible.
We will always inform you as quickly as possible if we discover any security incidence that has affected your data. We will take all action that we can to reduce risks and we will let you know if you need to take any action to protect yourself as a result.
The security of your data, including personally identifiable information, is important to us. User accounts are protected by a password. Users are required to protect the confidentiality of their passwords.
We will endeavor as best as we can, in accordance with applicable rules, regulations and laws, to maintain appropriate electronic and managerial policies and procedures to ensure that your data, including personally identifiable information, is kept secure in accordance with commercially reasonable information technology standards.
If CyberStart America becomes aware of a systems security breach by an unauthorized party or that any user data was used for an unauthorized purpose, we will comply with relevant state and other data breach laws. We will notify users of any breach resulting in unauthorized release of data electronically, at minimum, and without unreasonable delay so that you can take appropriate steps. The notification will include: date of the breach, the types of information that were subject to the breach, general description of what occurred, and steps CyberStart America is taking to address the breach.
How long will the information be held?
We keep your information for five years from the date of your last interaction with the program, or until you ask us to delete it, if this is sooner, and you wish to leave the program. If the circumstances arise where we need to keep the data longer, we will tell you and explain why.
Change of control
In the unlikely event that CyberStart America goes out of business, or files for bankruptcy, we will protect your personal information, and will not sell it to any third-party.
What about my other rights?
You have a right to have a copy of the information which CyberStart America holds on you or to transfer your information. You can make a request for a copy of your data through support by emailing firstname.lastname@example.org.
FERPA and California AB 1584
Regarding FERPA and California AB 1584 (Buchanan) Privacy of Pupil Records: 3rd-Party Digital Storage & Education Software (Education Code section 49073.1), CyberStart America will abide to the following:
- Student records obtained by CyberStart America from an educational institution continue to be the property of and under the control of the educational institution. The educational institution retains full ownership rights to the personal information and education records it provides to CyberStart America.
- CyberStart users may retain possession and control of their own generated content by CyberStart America.
- Parents, legal guardians, or eligible students may review personally identifiable information in the student’s records and correct erroneous information by contacting their educational institution. Additionally, CyberStart America users may access, correct, update, or delete personal information in their profile by signing into play.cyberstart.com, accessing their CyberStart account, and making the appropriate changes.
- CyberStart America is committed to maintaining the security and confidentiality of student records. Towards this end, we take the following actions: (a) we limit employee access to student data to only those employees with a need to such access to fulfill their job responsibilities; (b) we conduct background checks on our employees that may have access to student data; (c) we conduct regular employee privacy and data security training and education; and (e) we protect personal information with technical, contractual, administrative, and physical security safeguards in order to protect against unauthorized access, release or use.
- In the event of an unauthorized disclosure of a student's records, CyberStart America will (1) promptly notify Users unless specifically directed not to provide such notification by law enforcement officials. Notification shall identify: (i) the date and nature of the unauthorized use or disclosure; (ii) the Private Data used or disclosed; (iii) general description of what occurred including who made the unauthorized use or received the unauthorized disclosure; (iv) what CyberStart America has done or shall do to mitigate any effect of the unauthorized use or disclosure; (v) what corrective action CyberStart America has taken or shall take to prevent future similar unauthorized use or disclosure; and (vi) who at CyberStart America the User can contact. CyberStart America will keep the User fully informed until the incident is resolved.
- CyberStart America will delete or de-identify personal information provided by an educational institution when it is no longer needed, upon expiration or termination of our agreement with an educational institution, with any deletion or de-identification to be completed according to the terms of our agreement with the educational institution, or at the direction or request of the educational institution.
- CyberStart America agrees to work with educational institution to ensure compliance with FERPA and the Parties will ensure compliance by providing parents, legal guardians or eligible students with the ability to inspect and review student records and to correct any inaccuracies therein as described in statement (4) above.
- CyberStart America prohibits using personally identifiable information in student records to engage in targeted advertising.
What if I want more information or I want to complain?
If at any time you want further information, or you need help understanding what you can and cannot request, or if you want to make a complaint, the Data Protection Officer can help you with this.
You can be asked to be put in contact with our Data Protection Officer via our support channels. Please email email@example.com and ask to be put in contact with the Data Protection Officer. Alternatively, you can write to the National Cyber Scholarship Foundation, a charitable foundation based in the United States of America at 8300 Douglas Avenue, Suite 800, Dallas, TX 75225, or to CyberStart Limited, based in the United Kingdom at The Old Bull Pens, Sezincote, Moreton-In-Marsh, Gloucestershire, GL56 9AW.
If you still aren't happy with our response you can complain to your local data protection authority.