Privacy policy

Version 2.0 - Last updated: 3 October 2026

1. Purpose and scope

This Policy explains how personal data is collected and processed as part of Executive Cybersecurity Week ("ECW"), including through use of executivecyberweek.com, Forum or ECW Live registrations, the ISO/IEC 27001 Executive Experience, Speaker or Ambassador applications, partnership requests, the Partner Hub, payments, communications and commercial relationships.

It is established primarily with reference to Senegalese Law No. 2008-12 of 25 January 2008 on the protection of personal data, its implementing Decree No. 2008-721 of 30 June 2008 and regional instruments applicable in the ECOWAS area.

2. Principal data controller

For ECW Dakar 2026 and processing decided upon for operation of the initiative in Senegal, the principal data controller is:

Cobadisec, a company governed by Senegalese law, established in Dakar, Senegal.

Information concerning COBADISEC and other entities involved in ECW is set out in the Legal Notice and, where necessary, the applicable contractual documents.

Cobadisec determines, in particular, the purposes and essential means relating to:

ECW registrations and accounts;
selection of in-person participants;
the Partner Hub;
partnership requests and sponsor relationships;
training / the Executive Experience;
payments and invoicing where it is the contracting entity;
ECW-related service communications.

3. DPO / privacy contact

ECW has designated the following contact for data protection questions:

dpo@bluepinksecurity.com

Requests may also be submitted through /privacy-request.

4. Processing partners and allocation of roles

4.1 BluePinkSecurity INC - United States

BluePinkSecurity INC, a corporation registered in the State of Delaware, United States, acts as COBADISEC's operational partner for certain processing activities relating to marketing, communications, technical support, security, data administration and assistance to the DPO.

In this context, BluePinkSecurity INC processes ECW data within the purposes agreed with COBADISEC and under confidentiality, security and data protection obligations.

4.2 AAIOP - France

AAIOP, a single-shareholder simplified joint-stock company (SASU) governed by French law, SIREN 978 170 280, Paris Trade and Companies Register (RCS) 978 170 280, acts as a business development and referral partner for certain B2B opportunities.

AAIOP accesses only the professional data necessary for the prospects, organisations or opportunities assigned to it as part of its commercial mission. This mission does not grant general access to private Partner Hub data or the entire participant database.

Where AAIOP processes data on behalf of COBADISEC, that processing takes place under the applicable instructions and commitments. Where AAIOP independently determines a purpose of its own, it assumes the obligations associated with that purpose.

4.3 Other authorised sales representatives / partners

ECW may appoint other sales representatives, referral partners or distribution partners. They receive only the data necessary for opportunities assigned to them and must comply with written confidentiality and data protection obligations.

5. Categories of data subjects

This Policy covers, in particular:

Website visitors;
ECW Live registrants;
Forum applicants and participants;
VIP participants;
training / Executive Experience participants;
speakers and speaker applicants;
ambassadors and ambassador applicants;
sponsor and partner representatives;
organisation team members in the Partner Hub;
prospects and commercial contacts;
suppliers and institutional contacts;
people submitting a privacy, support or security request.

6. Data collected

Depending on the interaction with ECW, the following may be collected:

6.1 Identity and contact details

first and last name;
title, where applicable;
professional email and, where necessary, personal email;
professional or personal telephone number where necessary;
country and city;
account identifiers and authentication elements managed by the identity provider.

6.2 Professional data

role;
company / organisation;
sector;
organisation size or category;
countries / markets covered;
LinkedIn profile;
professional biography;
areas of interest;
professional photograph where provided or authorised.

6.3 Registration and access data

ECW Live registration;
in-person application / approval;
participation status;
ECW role (Speaker, Ambassador, Sponsor Representative, Training Participant, etc.);
access associated with the Forum, dinners or specific experiences;
accreditation and attendance history where necessary.

6.4 Partner Hub data

discoverability preferences;
organisation membership;
associated team / members;
profiles viewed where such logging is necessary for security or service quality;
shortlists;
connection requests;
meeting requests;
responses to those requests;
private contact requests and the recipient's choices;
history necessary to manage rights and prevent abuse.

6.6 Training data

participant identity and contact details;
information necessary for registration and training arrangements;
attendance and administrative follow-up;
examination / certification information limited to data communicated or necessary between ECW and the certification body.

ECW does not determine the certification result and does not collect sensitive data unnecessary for the programme.

6.7 Payment and invoicing

name / registered organisation name;
billing address;
NINEA / tax or VAT identifier where applicable;
amount, currency, invoice reference;
payment method and status;
transfer proof / reference;
accounting reconciliation information.

Where payment is made through a payment provider, ECW does not collect the full bank card number if the provider directly handles card entry and processing.

6.8 Technical and security data

connection logs;
IP address;
timestamps;
device / browser;
access logs;
security alerts;
records necessary for fraud prevention, access control and auditing.

6.9 Cookies and preferences

cookie choices;
communication preferences;
optional consents;
objection to prospecting;
Partner Hub preferences.

7. Processing purposes and grounds

ECW processes data only for specified, explicit and legitimate purposes.

7.1 Pre-contractual measures and contract performance

The following may be necessary to perform a contract or pre-contractual measures requested by the person:

account creation and administration;
Forum, Live or training registration;
processing a Partnership Access request;
generating a proposal or invoice;
payment;
onboarding;
providing purchased access;
support;
administering Partner Hub rights associated with the requested service.

7.2 Legal obligations and evidence

Certain data is retained or used for:

accounting and invoicing;
evidence of an electronic order / contract;
tax and commercial obligations;
responding to a competent authority;
preventing or handling disputes.

7.3 Consent

Consent is used where required, including for:

certain promotional communications;
cookies that are not strictly necessary;
certain optional uses of a profile or image where the context requires specific agreement;
one-off transfers where the law expressly requires consent as the basis for the transfer.

Withdrawal of consent for an optional purpose does not affect the lawfulness of previous operations and does not remove processing necessary for the contract or required by law.

7.4 Professional operation of the Partner Hub

The ECW profile and its professional discoverability are processed as part of the ECW service accepted by the participant and the Participation Terms / Terms of Use. Displayed data is limited to the professional categories provided for by the service and the visitor's rights.

Private contact details remain protected unless the person concerned takes a specific action.

8. Partner Hub: visibility, organisations and teams

8.1 Professional profile

An ECW participant may have a professional profile containing, depending on their status and choices:

name;
role;
company;
sector;
country;
visible ECW role;
professional biography;
professional photograph;
professional email;
LinkedIn.

8.2 Organisations

Sponsors and partners may have an Organisation profile visible in the Hub, containing:

name / brand;
logo;
partner type;
partnership level where public;
description;
sectors / solutions;
website / LinkedIn;
ECW representatives made visible.

8.3 Sponsor teams

An organisation may invite several members to its team. A single member may combine several ECW roles or statuses, for example: Sponsor Representative + VIP, Speaker, Ambassador or Training Participant.

Membership of an organisation's team does not automatically grant physical or VIP access.

8.4 Private contact

Private data (personal email, personal telephone, WhatsApp) is not displayed by default. Where a Request Private Contact feature is offered, the person concerned decides whether they wish to communicate those details.

8.5 Prohibited abuse

Hub data may not be used for:

scraping or bulk extraction;
unauthorised automated enrichment;
data resale / brokerage;
spam or abusive prospecting;
creation of a competing database;
profiling unrelated to the ECW experience;
attempts to circumvent access limits.

9. Data sources

Data may be collected:

directly from the person;
from their organisation where it invites them to join a team;
from an authorised sales representative or partner who initiated a B2B opportunity;
from a public professional source provided or confirmed by the person (for example LinkedIn);
from an authentication / payment provider;
through interactions with the Website or Partner Hub.

Where data is obtained indirectly, the required information is provided to the person concerned no later than the first useful contact or before disclosure to a third party where required by law.

10. Data recipients

Depending on needs and applicable rights, data may be accessible to:

Cobadisec and its authorised personnel;
BluePinkSecurity INC within its defined missions;
AAIOP and other commercial partners only for opportunities assigned to them;
technical providers necessary for operation, authentication, security, support and communications;
payment providers;
the training / certification body for data necessary for the service;
authorised sponsors and partners, only within the Partner Hub scope corresponding to their rights;
administrative, judicial or supervisory authorities where required by law;
professional advisers where a dispute, audit or legal obligation requires it.

11. International transfers

ECW's operation involves international data access and transfers, particularly between Senegal, the United States and France, due to the involvement of COBADISEC, BluePinkSecurity INC, AAIOP and certain providers necessary to deliver the service.

Under Senegalese Law No. 2008-12, a transfer to a State other than Senegal constitutes a transfer to a third country. These transfers are governed in accordance with applicable Senegalese legal requirements, particularly Articles 49 to 51, and the formalities and safeguards required by the Personal Data Protection Commission (CDP).

Where providers located in other countries participate in delivering a service requested by the user, the corresponding transfers are limited to necessary data and governed in accordance with applicable law.

12. Retention periods

The following periods constitute ECW's framework, subject to a longer legal obligation or a dispute:

Data	Reference period
ECW account and profile	lifetime of the account, then up to 24 months after the last activity, unless earlier deletion is possible
Unsuccessful in-person application	up to 12 months after the relevant edition
Unsuccessful Speaker / Ambassador application	up to 24 months for professional follow-up, unless an objection is made
Unconverted commercial opportunity	up to 24 months after the last useful interaction, unless an objection or evidentiary obligation applies
Connection / meeting requests	lifetime of the account, then up to 24 months for continuity, security and evidence
Contracts, orders, invoices and payment evidence	up to 10 years where necessary for legal or accounting obligations or evidence of an electronic contract
Security and access logs	generally 12 months, unless an incident requires longer retention
Privacy requests	up to 5 years to document the response and exercise of rights
Marketing preferences	until withdrawal / objection, followed by minimal retention of evidence of the objection
Cookies	according to the period stated in the Preference Center and Cookie Policy

Data is not retained beyond what is necessary for its purpose, evidence or a legal obligation.

13. Communications

13.1 Service communications

Emails essential to perform the service are not a marketing option:

registration confirmations;
access decisions;
invoices / payment;
essential programme changes;
account security;
meetings / requests received;
necessary logistical information.

These communications cease when no longer needed for the service, subject to messages required by law.

13.2 Marketing communications

Newsletters, announcements of future offers and optional commercial communications are managed separately. The person may withdraw consent or object to prospecting through the Preference Center or the unsubscribe link.

ECW's commercial partners are not granted the right to freely prospect all participants outside the authorised Partner Hub rights / uses.

14. Cookies and similar technologies

Details of cookies, trackers, providers, purposes and preferences are available at:

/cookies;
/preferences.

Strictly necessary cookies may be placed without an optional choice where required to provide the service. Non-essential categories are subject to the applicable preference mechanism.

15. Security and confidentiality

ECW implements organisational and technical measures appropriate to the risks, including:

role-based access control;
separation of organisations and rights;
encryption of communications;
security logging;
authentication;
limits on administrator rights;
backup and recovery;
written commitments from processors;
access reviews;
vulnerability reporting mechanisms.

No transmission or storage method is absolutely infallible. In the event of an incident, ECW applies the notification / remediation obligations provided by applicable regulations.

16. Your rights

Subject to the conditions provided by law, any data subject may, in particular:

obtain information about processing;
request access to their data;
request an accessible copy of the data;
request the available source of the data;
request rectification, updating, completion, blocking or deletion;
object on legitimate grounds to certain processing;
object free of charge to disclosure or use for prospecting purposes;
request information about intended transfers to third countries;
withdraw consent where processing relies on it;
manage certain visibility and communication preferences.

Requests may be sent through /privacy-request or to dpo@bluepinksecurity.com.

Proportionate identity verification may be requested where necessary to prevent an unauthorised person from exercising a third party's rights.

17. Response time

ECW handles requests within the periods provided by regulations. For rectification / deletion requests under Article 69 of Law No. 2008-12, the controller must substantiate the operations carried out within one month of registration of the request.

18. Complaint to the CDP

A person may contact the Personal Data Protection Commission of Senegal (CDP) if they believe their rights are not being respected.

Website: cdp.sn

ECW nevertheless encourages prior contact with the DPO to attempt to resolve the request promptly.

19. Minors

ECW is designed primarily for professionals and adults. Accounts, paid registrations and contracts must be entered into by a person with the required legal capacity. Any participation by a minor, if exceptionally authorised, must be handled in accordance with applicable legal and authorisation requirements.

20. Changes to the Policy

This Policy may be updated following changes to the service, regulations or providers. The update date is displayed at the top of the page. Substantial changes may be notified appropriately.