1. Introduction
CyberTips Bermuda ("CyberTips", "we", "our", or "us") is an online public education and cyber safety initiative operated by the Cabinet Office, Government of Bermuda.
CyberTips Bermuda provides cybersecurity education, awareness resources, reporting pathways, digital safety tools, downloadable publications, and public information designed to improve cyber resilience across Bermuda.
We are committed to protecting the privacy of every visitor and processing personal information lawfully, fairly, and transparently in accordance with the Personal Information Protection Act 2016 (PIPA) and the Personal Information Protection Amendment Act 2023.
This Privacy Policy explains how information is collected, used, stored, protected, disclosed, and retained when you use www.cybertips.bm.
2. Legal Authority
CyberTips Bermuda processes personal information in accordance with:
- Personal Information Protection Act 2016
- Personal Information Protection Amendment Act 2023
This Privacy Policy has been developed to satisfy the obligations contained within:
- Section 5 — Responsibility and Compliance
- Section 6 — Conditions for Using Personal Information
- Section 7 — Sensitive Personal Information
- Section 8 — Fairness
- Section 9 — Privacy Notices
- Section 10 — Purpose Limitation
- Section 11 — Proportionality
- Section 12 — Integrity of Personal Information
- Section 13 — Security Safeguards
- Section 14 — Breach of Security
- Section 15 — Overseas Transfers
- Section 16 — Personal Information About Children
- Sections 17 through 21 — Rights of Individuals
3. Information We Collect
CyberTips Bermuda collects only the information necessary to provide requested services, respond to enquiries, process reports, improve website performance, and fulfil statutory responsibilities.
3.1 Information You Voluntarily Provide
You may voluntarily submit personal information when using services including:
- Cybercrime reporting
- Cyberbullying reporting
- Workshop requests
- School presentations
- Community awareness programmes
- Contact forms
Information collected may include full name, email address, telephone number, school or organisation, job title, incident descriptions, supporting documentation, screenshots, images, documents, uploaded evidence, and any additional information you choose to provide.
Pursuant to Section 6 of PIPA, this information is collected only for the purposes identified at the time of collection.
4. Interactive Educational Tools
CyberTips Bermuda includes interactive educational tools designed with privacy as the primary objective. The following tools operate entirely within your web browser:
- Digital Hygiene Calculator
- Password Strength Checker and Generator
- Security Checklists
- Educational Games and Quizzes
Information entered into these tools is processed locally on your device. It is never transmitted to CyberTips servers, never stored, never associated with your identity, and cannot be viewed by CyberTips staff.
This approach reflects the principles of Section 11 (Proportionality) and Section 13 (Security Safeguards) of PIPA.
5. Automatically Collected Technical Information
Like most Government websites, our hosting environment automatically records technical information necessary for security, maintenance, and operational purposes. This may include IP address, browser type, operating system, device type, date and time of access, pages viewed, session duration, referral URLs, HTTP request information, and website performance metrics.
This information is collected to detect cyber attacks, improve website performance, maintain system security, diagnose technical problems, and produce anonymous statistical reports. Where reasonably possible, this information is aggregated and anonymised.
6. Crime Reporting and Sensitive Information
CyberTips Bermuda provides reporting pathways for cybercrime, cyberbullying, online exploitation, identity theft, image-based abuse, fraud, phishing, and artificial intelligence misuse. Reports may contain sensitive personal information as defined under Section 7 of PIPA.
Sensitive reports are never published, sold, shared for advertising, used for marketing, or released without lawful authority. Access is restricted to authorised Government personnel and, where appropriate, the Bermuda Police Service or other competent authorities.
7. Children's Privacy
CyberTips Bermuda places particular importance on protecting children and young people. Consistent with Section 16 of PIPA, educational content intended for children does not require registration or account creation.
Where personal information relating to children is collected through reporting forms, workshops, or school programmes, collection is limited to information necessary for the identified purpose, information is handled with enhanced security, verifiable parental or guardian consent is obtained where required by law, and children's information is never used for advertising or profiling.
Parents and guardians who believe their child has submitted personal information in error may contact CyberTips Bermuda to request review or deletion where appropriate.
8. Cookies
CyberTips Bermuda uses only essential cookies necessary for website functionality. These may include session cookies, security cookies, and accessibility preferences. If enabled, anonymous analytics cookies may be used solely to improve website performance.
CyberTips Bermuda does not use advertising cookies, behavioural profiling cookies, social media tracking pixels, or third-party marketing cookies.
9. Third-Party Services
Certain website services may involve trusted third-party providers including website hosting, content delivery services, and Google Fonts. Where third parties process information on our behalf, appropriate safeguards are implemented consistent with Section 15 of PIPA. CyberTips Bermuda does not sell personal information to third parties.
10. Information Sharing
Personal information will only be disclosed where required by law, necessary to investigate reported incidents, necessary to protect public safety, necessary for criminal investigations, authorised by the individual, or required by a court order. Information will not be disclosed for commercial purposes.
11. Security Safeguards
Pursuant to Section 13 of PIPA, CyberTips Bermuda implements reasonable administrative, technical, and physical safeguards including:
- HTTPS encryption
- Secure Government hosting
- Role-based access controls
- Multi-factor authentication
- Encrypted storage where appropriate
- Security monitoring and vulnerability assessments
- Audit logging and backup procedures
12. Data Retention
Information is retained only for as long as necessary to fulfil operational, legal, investigative, or regulatory purposes.
Records are securely destroyed when no longer required.
13. Your Rights Under PIPA
Under Part 3 of the Personal Information Protection Act 2016, individuals have the right to:
- Request access to personal information
- Request correction of inaccurate information
- Request deletion where appropriate
- Withdraw consent where consent forms the legal basis for processing
- Request that certain uses cease
- Make a complaint to the Office of the Privacy Commissioner
Requests should be submitted in writing to the Cabinet Office.
14. Breach Notification
If a security breach involving personal information is likely to adversely affect an individual, CyberTips Bermuda will act in accordance with Section 14 of PIPA by promptly investigating the incident, notifying the Privacy Commissioner where required, notifying affected individuals where appropriate, and taking corrective action to reduce risk.
15. Privacy Officer
In accordance with Section 5(4) of PIPA, the Cabinet Office has designated a Privacy Officer responsible for ensuring compliance with applicable privacy legislation.
16. Changes to This Privacy Policy
CyberTips Bermuda reserves the right to amend or update this Privacy Policy to reflect changes in legislation, Government policy, operational requirements, cybersecurity practices, or website functionality. Updated versions will be published on www.cybertips.bm and will become effective upon publication.
17. Governing Law
This Privacy Policy shall be governed by and construed in accordance with the laws of Bermuda. Any disputes relating to the collection, use, disclosure, or processing of personal information shall be subject to the jurisdiction of the courts of Bermuda.