Quick Exit

Privacy Policy

Last updated: February 8, 2026

Privacy Policy

Effective Date: 8th of February, 2026 Last Updated: 8th of February, 2026

1. Introduction

The International Online Crime Coordination Center (IOC3) is committed to protecting the privacy and security of individuals who interact with our services. This Privacy Policy explains how we collect, use, store, and share personal information in connection with our mission to coordinate global responses to online crime.

IOC3 is registered in New Zealand with non-profit status pending. We operate internationally and comply with applicable privacy laws including the New Zealand Privacy Act 2020, the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant privacy regulations.

2. Who We Are

Organization Name: International Online Crime Coordination Center (IOC3)
Registered Location: New Zealand
Contact: [email protected]

IOC3 is a cybercrime intelligence and operations organization that receives, assesses, and coordinates responses to reports of serious online crime through reporting, investigation support, platform partnerships, research, and training.

3. Information We Collect

3.1 Information You Provide Directly

When you submit a report or interact with our services, we may collect:

  • Contact Information: Name, email address, phone number
  • Report Details: Description of incident, timeline, context, individuals or entities involved
  • Evidence: Screenshots, videos, documents, chat logs, URLs, social media profiles
  • Optional Information: Age, location, relationship to incident

Anonymous Reporting: You may submit reports anonymously without providing identifying contact information. However, this may limit our ability to follow up or request additional information.

3.2 Information Collected Automatically

When you use our website or reporting platform, we automatically collect:

  • Technical Data: IP address, browser type and version, device information, operating system
  • Location Data: Approximate geographic location based on IP address
  • Usage Data: Pages visited, time spent, navigation patterns

3.3 Information from Third Parties

We may receive information from:

  • Technology Platforms: Reports, user data, or metadata shared through API integrations or direct partnerships with social media companies and online service providers
  • Law Enforcement Agencies: Case-related information shared as part of coordinated investigations
  • Partner Organizations: Reports or intelligence shared by NGOs, child protection organizations, or trusted reporting partners

3.4 Information About Minors

Minors (individuals under 18) may report incidents directly to IOC3. We take special care to protect the privacy and safety of minors and process their information in accordance with applicable child protection laws.

4. How We Use Your Information

We process personal information for the following purposes:

4.1 Legal Bases for Processing

We process your information based on:

  • Legitimate Interest: Preventing and coordinating responses to online crime
  • Public Interest: Protecting public safety and preventing harm
  • Legal Obligation: Complying with laws requiring reporting or cooperation with authorities
  • Consent: Where you have explicitly agreed to processing for specific purposes

4.2 Specific Uses

  • Report Assessment: Reviewing, triaging, and analyzing submitted reports to determine severity, credibility, and urgency
  • Coordination: Routing reports to appropriate law enforcement agencies, platform trust and safety teams, or partner organizations
  • Investigation Support: Providing intelligence and analytical support to authorized agencies
  • Intelligence Analysis: Identifying patterns, trends, and emerging threats to inform broader cybercrime prevention efforts
  • Case Management: Tracking case status, maintaining records, and ensuring accountability
  • Communication: Contacting you regarding your report, requesting additional information, or providing updates (if contact information was provided)
  • Legal Compliance: Responding to legal requests, court orders, or regulatory requirements
  • Service Improvement: Improving our reporting systems, processes, and coordination capabilities

5. How We Share Your Information

IOC3 may share personal information with the following categories of recipients:

5.1 Law Enforcement Agencies

We share reports and related information with national and international law enforcement agencies when:

  • Our assessment determines the report warrants law enforcement action
  • We identify immediate risk or ongoing harm
  • We are legally obligated to disclose information
  • A law enforcement agency requests information related to an active investigation

5.2 Technology Platforms

We share information with online platforms and service providers (e.g., social media companies, hosting providers) when:

  • The platform's trust and safety response is necessary to address the reported harm
  • Platform action is required to preserve evidence or prevent further harm
  • We have a formal partnership or data-sharing agreement

5.3 Partner Organizations

We may share information with:

  • Child protection and safeguarding organizations
  • NGOs and trusted reporting partners
  • Research institutions (in aggregated, anonymized form)

5.4 Service Providers

We use Amazon Web Services (AWS) to host our infrastructure. AWS processes data on our behalf under strict data processing agreements and security requirements.

5.5 Legal Requirements

We may disclose information when required by law, court order, subpoena, or to:

  • Comply with legal processes
  • Protect the rights, property, or safety of IOC3, our users, or the public
  • Prevent or investigate potential crimes or policy violations

6. Data Retention

6.1 Active Cases

Information related to active cases is retained for the duration of the case investigation and coordination activities.

6.2 Closed Cases

Information related to closed cases is retained for three (3) years following case closure for:

  • Intelligence analysis and trend identification
  • Potential case reactivation
  • Legal and accountability purposes

6.3 Intelligence Data

Aggregated, de-identified data may be retained indefinitely for research, threat intelligence, and policy development purposes.

6.4 Deletion Exceptions

We may retain information beyond standard retention periods when:

  • Required by law or legal hold
  • Requested by law enforcement as part of an ongoing investigation
  • Necessary to protect the rights or safety of individuals

7. Data Security

We implement robust technical and organizational measures to protect personal information:

  • Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256)
  • Access Controls: Strict role-based access controls limit data access to authorized personnel only
  • Infrastructure Security: Secure cloud infrastructure hosted on AWS with industry-standard security certifications
  • Regular Audits: Periodic security assessments and vulnerability testing
  • Staff Training: All team members receive training on data protection and confidentiality

Despite these measures, no system is completely secure. We cannot guarantee absolute security of information transmitted over the internet.

8. Your Privacy Rights

Depending on your location, you may have the following rights:

8.1 Access and Portability

You have the right to request:

  • Confirmation of whether we process your personal information
  • Access to your personal information
  • A copy of your personal information in a portable format

8.2 Correction

You may request correction of inaccurate or incomplete personal information.

8.3 Deletion

You may request deletion of your personal information, subject to:

  • Legal obligations to retain information
  • Ongoing law enforcement investigations
  • Legitimate intelligence or public safety interests

8.4 Restriction and Objection

You may request restriction of processing or object to processing based on legitimate interests.

8.5 Withdrawal of Consent

Where processing is based on consent, you may withdraw consent at any time.

8.6 Exercising Your Rights

To exercise these rights, contact us at [Insert contact email]. We will respond within the timeframes required by applicable law (typically 30 days).

Important: If your report is part of an active law enforcement investigation, we may be unable to delete or provide certain information without authorization from the investigating agency.

9. International Data Transfers

IOC3 operates internationally and may transfer personal information across borders to:

  • Law enforcement agencies in various jurisdictions
  • Platform partners with global operations
  • Cloud service providers (AWS) with data centers worldwide

We ensure appropriate safeguards are in place for international transfers, including:

  • Standard contractual clauses
  • Adequacy decisions
  • Necessity for the performance of our mission

10. Children's Privacy

While minors may report incidents directly to IOC3, we do not knowingly collect personal information from children for marketing or non-essential purposes. Our collection and processing of information from minors is limited to what is necessary for incident reporting, assessment, and coordination.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or services. We will post the updated policy on our website with a revised "Last Updated" date.

For material changes, we will provide prominent notice on our website or, where appropriate, direct notification.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Email: [email protected]

13. Complaints and Supervisory Authorities

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with a supervisory authority:

  • New Zealand: Office of the Privacy Commissioner (https://www.privacy.org.nz)
  • EU/EEA: Your local data protection authority
  • California: California Attorney General's Office

By using IOC3's services or submitting a report, you acknowledge that you have read and understood this Privacy Policy.