The NetBeacon Institute (the Institute) was created by, and is a part of Public Interest Registry (PIR), and is tasked with creating outcomes-based initiatives that will generate recommended practices, foster collaboration, and develop industry shared solutions to combat Domain Name System (DNS) abuse: malware, botnets, phishing, pharming, and related spam.  

The Institute manages several initiatives, including NetBeacon Reporter and NetBeacon MAP.  This notice applies to activities of the Institute and NetBeacon MAP. You can find the NetBeacon Reporter Privacy Notice here.

This Notice outlines what information the Institute and NetBeacon MAP collects through your interactions with these products and services, how we use that information, and how we work to protect your privacy and personal data.

Inquiries can be made electronically via e-mail at privacy@netbeacon.org, or via mail to NetBeacon Institute, 11911 Freedom Drive, 10th Floor, Suite 1000, Reston, VA 20190, USA , or via the Institute’s EU Representative at datenschutz@rickert.net or Rickert Rechtsanwaltsgesellschaft mbH, Kaiserplatz 7-9, 53113, Bonn, Germany. 

Why Do We Collect Information?

The Institute and NetBeacon MAP ingest data to provide reports, newsletters, and information to individuals and companies that request access to measurement reports and products. NetBeacon MAP produces reports measuring the use of the DNS for phishing and malware.  

NetBeacon MAP works with an independent third-party group (KOR Labs) that conducts the data gathering and technical analysis that go into developing NetBeacon MAP reports and products. 

The Institute and NetBeacon MAP will also process personal data to administer newsletter and mailing lists as well as to provide parties with access to NetBeacon reports and tools. 

Information We Collect

The Institute collects information to administer newsletters, and share best practices and reports, as requested by individuals and companies. The Institute may also act as a convener for events or panels where participant registration information is collected. 

NetBeacon MAP works with an independent third-party group (KOR Labs) that conducts the data gathering and technical analysis that go into developing NetBeacon MAP reports and products. 

While the methodology and data gathering done by KOR Labs and the resulting reports do not incorporate personally identifiable information, NetBeacon MAP does process personal data to deliver reports and information to requestors. More information on the methodology used is available here. 

NetBeacon MAP

In order to access NetBeacon Map, users may be asked to provide personal data. In order to provide access to the NetBeacon MAP dashboards, that personal data will also be securely processed through PIR’s instances of Snowflake and Tableau.

Institute and NetBeacon MAP Website Users

1. User Information. You may visit the Institute and NetBeacon MAP website without identifying yourself. If you are interested in our services you may be required to register with the Institute. When you register, we may request certain personal data, including your name, address, e-mail address, and other personal data. In addition to website registration, the Institute may request personal data for purposes such as the provision of customer service, service offerings, account setup, security, surveys, mailing lists, and other exchanges of information.
2. Cookies. A cookie is a small data file that certain websites write to your hard drive when you visit the site. A cookie file can contain information that allows the Institute to track the pages you have visited. The Institute uses cookies to tell when a user is a repeat visitor and to let us know how the user found the website. Cookies also allow us to automatically link users to their personalized accounts (should you choose to register with the Institute), enabling you to enter various services as a member and to visit member-restricted areas of the site without having to log in each time. This applies to the use of cookies by the Institute and does not apply to the use of cookies or other tracking technologies used by any third parties. Visitors to our sites have the option to disable cookies via their browser preferences (Google Chrome, Safari, Internet Explorer, Firefox) or through www.allaboutcookies.org. You can also refuse cookies by clicking the “reject all cookies” button in the website pop-up. However, the Institute maintains a legitimate interest in using cookies, as some portions of our website and services will not work if the ability to accept cookies is disabled. This applies to the use of cookies by the Institute and does not apply to the use of cookies or other tracking technologies used by any third parties.
3. Analytics. The Institute utilizes third-party data analytics for our website (Google) (i.e., cookies, log files, usage data, IP address, browser, and click stream data) to track general website performance. However, all website analytic data is aggregate and anonymous. Third-party data analytics platforms have access only to aggregate anonymous data. The Institute also uses general performance data from third-party ads and may use that data to analyze and evaluate the effectiveness of our website design, services, marketing, and campaigns.
4. Third-party Links. This Privacy Notice only addresses the processing of personal data you provide to the Institute via this website. The processing of any data you disclose to other parties via third-party links will be governed by their privacy policies. In some cases the Institute will use a software or host to administer services. These services may require use of their own cookies and analytics to provide the service. Users should be aware of their personal privacy settings when using platforms and apps and update them to manage your privacy preferences. The Institute is not responsible for the privacy policies of other websites. We encourage you to familiarize yourself with the privacy policies of other websites you visit.
5. User generated content.The Institute is not responsible for maintaining as confidential any personal or other data posted by you on message boards hosted by our websites. Users voluntarily disclosing such personal data makes your information publicly available.
6. Log files. The Institute gathers information about all users collectively, such as what areas of its site’s users visit most frequently and what services users access most often. This data is logged and aggregated so we may use it to understand user behavior and for system-performance monitoring. The Institute does not maintain individual log file data and only maintains aggregate user statistics which are not capable of identifying an individual. 
7. Third-party advertisement. The Institute may utilize third-party ads (Google, Facebook, Instagram). In general, the Institute receives only general ad performance data and does not receive any personal data from the third-party ad platform, however, the Institute does employ lead generation within ads where the user is given the option to provide informed consent to receive an email contact for a specific and limited purpose. The user may still engage with the ad and service without providing any personal information and the third-party does not receive any of the personal data. Any data, other than lead generation in ads, received by the Institute via third-party ad platforms will be aggregate and anonymous. The Institute does not use personal data to target ads, however, third-party advertisers may use data you submit to them to provide advertisements. In order to control your advertisement preferences as part of third-party platforms, you must update your account settings in those platforms or in your browser. The Institute takes care to structure any online advertisements to not target any individual natural person, not perpetuate any stereotype or social segregation, be fair and not create discrimination by denying natural persons access to employment opportunities, services, or target them with any risky financial ventures or services.
8. Children. Please note that we do not knowingly solicit information from children, and we do not knowingly market our products or services to children. If you have reason to believe anyone under the age of 18 has provided the Institute with any personal data, please contact us at privacy@netbeacon.org.
9. Sensitive Personal Information. Similarly, the Institute does not ordinarily or knowingly require or collect sensitive personal information (information specifying medical or health conditions, racial or ethnic origins, political opinions, religious or philosophical beliefs, trade union membership, or information specifying sex life of an individual). 

Purpose for Using Personal Data

The Institute will make all reasonable efforts to ensure that personal information is processed only for the purposes set forth in this Notice (including to provide the services requested by you). We will make all reasonable efforts to ensure that personal information is not further processed in a way incompatible with the purpose for which it was collected or received. The Institute will only disclose this information, or elements of this information, in certain situations defined in the Data Sharing and Disclosure. 

1. NetBeacon Institute and NetBeacon MAP. Personal data submitted to the Institute will be used solely to provide a requested service (e.g., access to NetBeacon MAP dashboards, addition to a mailing list, customer service engagement). Personal data submitted to the Institute by users of the NetBeacon MAP dashboards will be processed solely to provide the requested service of accessing NetBeacon MAP dashboards. Personal data will be processed through the Institute instances of Snowflake, Tableau, Azure, AWS, and Sharepoint software in order to provide access to the NetBeacon MAP developed dashboards.  
2. Website & Third-party Ad Information. If you submit personal data to the Institute through our website, we may use that information to assist with the functionality of the website. This may include sending you information you have requested to receive (i.e., newsletters, emails from lead generation ads) and providing you with policy and services updates. Be aware that any information you voluntarily provide via message boards or public discussion tools becomes publicly available information and may be used by the Institute or others. 
   The Institute collects aggregated anonymized data from visitors to our websites via third-party data analytics (Google) (i.e., cookies, log files, usage data, IP address, browser, click stream data, etc.) as well as general performance data from any third-party ads and may use that data to analyze and evaluate the effectiveness of our website design, services, marketing, and campaigns.

Lawful Bases for Processing Personal Data.

The Institute processes your personal data where we have a legitimate business interest in doing so or based upon a data subject’s active consent. The Institute will process data related to NetBeacon MAP dashboards based upon user consent which will be recorded and is revocable at any time by the user. The Institute may have a legitimate interest in using personal data that is provided by you in order to provide a requested service. In addition, the Institute may have a legitimate interest in using personal data provided by you to optimize our service and your experience on our Website.The Institute may also use third-party data providers to process data in the use of their services to provide online advertisement.

Data Sharing and Disclosure

Partners and Service Providers

Our trusted processors (vendors, subcontractors, and other similar partners) are responsible for processing some of the personal data that we receive. Therefore, the Institute discloses some personal data as received from you to our processors. These processors are not authorized to use such personal data for purposes beyond those specified by us and to the extent that they process any personal data, they are required to provide security and privacy protections in line with the Institute’s Privacy Policy and in compliance with applicable privacy and data protection laws.

Sharing the information we collect on our website & via third-party ad platform (Google, Facebook, Instagram).

The information that you supply to the Institute through this site or through a program conducted by the Institute will never be given, sold, rented, loaned, or otherwise disclosed to any third parties outside of the Institute, except where outlined above or under special circumstances. Third-party ad providers (Google, Facebook, Instagram) may have access to data that the Institute does not control or share and is subject to the third-party’s privacy policies and is not governed by the Institute. Our Exceptions and Special Circumstances Policy , permits the Institute to share information when it is necessary to comply with legal process or protect the rights, property, or personal safety of the Institute, its customers, or the public.

Links and third-party collection. 

This Notice only addresses the processing of personal data we collect from you. The processing of any data you disclose to other parties will be governed by their privacy policy. Users should be aware of their personal privacy settings when using platforms and apps and update them to manage your privacy preferences.

Software Providers.

The Institute utilizes third-party software providers (Microsoft, Sharepoint, Azure Services, Amazon Web Services, Snowflake, and Tableau) to allow us to do internal research in order to maintain and improve the services we provide. In addition, NetBeacon MAP uses instances of these third-party software providers to provide users access to their NetBeacon MAP dashboards. This data is only shared with providers which have appropriate data processing agreements in place and they are prohibited from processing the Institute provided data for any other purposes. In some instances the Institute will process personal data provided to us via our instances of Snowflake and Tableau in order to provide the service requested by the user.

Exceptions and Special Circumstances

In certain circumstances, the Institute must disclose information beyond the limits outlined including when it is necessary to fulfill a transaction or provide information you have requested; necessary to protect the rights, property or personal safety of the Institute, its customers or the public; in the vital interests of the data subject or another person; required by law or necessary to respond to legal process; necessary to meet the requirements of requests, lawfully made by public authorities, including requests to meet national security or law enforcement requirements.

The Institute reserves the right to disclose personal data or non-personal data that the Institute believes, in good faith, is appropriate or necessary to enforce our Policies, and to protect the security or integrity of our Website.

How to Access, Amend, and Control Your Personal Data

You may request to have your personal data changed or corrected (e.g., a change of address, email update). If you object to the processing of your personal data by third party service providers for online advertising please change your personal privacy settings within those services (i.e., Facebook Companies, Google, Twitter) or in your browser.

You may also wish to contact us should you no longer desire our service. You may contact the Institute via e-mail at privacy@tnetbeacon.org or at NetBeacon Institute, c/o Privacy Office, 11911 Freedom Drive, 10th Floor, Suite 1000, Reston, VA 20190, United States of America.

Special Note for EU Data Subjects

Data Subject Rights

The EU General Data Protection Regulation (2016/679) affords you certain rights. Where applicable you may request confirmation that the Institute does or does not process personal data related to you. You may request a copy of your personal data or request that a copy is sent to a third party. You may request that your data, such as your address, is amended or corrected. In some circumstances you may request that your data processed by the Institute be deleted. You may also request, in certain cases, that we restrict processing of your personal data by the Institute. You also have the right to object to receiving direct marketing. To the extent your information is processed by the Institute based upon consent, you may withdraw that consent at any time.

Should you wish to exercise any of these rights or other rights afforded you by the GDPR please contact us via e-mail at privacy@netbeacon.org, or at NetBeacon Institute, c/o Privacy Office, 11911 Freedom Drive, 10th Floor, Suite 1000, Reston, VA 20190, United States of America.

You may contact the Institute’s EU Representative at datenschutz@rickert.net or Rickert Rechtsanwaltsgesellschaft mbH, Kaiserplatz 7-9, 53113, Bonn, Germany.

Data Transfer

In order to  provide the promised services to you, the Institute may receive data from EEA countries or transfer your data to third countries. The Institute, as a non-profit, US-based entity, is not able to avail itself of the Privacy Shield Frameworks and instead transfers EEA data to third countries as is necessary to perform the requirements of our contracts using model contractual clauses as our legal basis for transfer. For certain non-contractual operations, the Institute may transfer your data on the basis of consent. In such cases, your consent will be explicitly requested and is revocable at any time.

Security

The Institute takes strong precautions to protect information and continually strives to ensure we are adhering to industry best practices and security standards. When you submit personal data via our websites your personal data are protected both online and offline.

We are required to take reasonable steps to protect personal data from loss, misuse, unauthorized disclosure, alteration, or destruction and not to use or authorize the use of personal data in a way that is incompatible with the purposes for which it was collected. All joint controllers and vendor (third party processors) partners are to adhere to the requirements in this Privacy Notice and  meet security standards that are commensurate with the data they receive and process. These third parties also have their own privacy and security policies. Should you have questions about their privacy policies or security practices, you should contact them.

Data Breaches

The Institute, upon discovering a data breach, will ensure we meet all data privacy requirements, including GDPR Articles 33 and 34 where applicable.

Data Retention

The Institute does not retain personal data for any longer than is necessary for its original purpose.

Update

We reserve the right to amend this Privacy Notice at any time. This Privacy Notice was last updated in April 2024.