This privacy notice is relevant to the following categories of students and learners:
1. Prospective learners / students (aged 16-18)
2. Learners in the Further Education and Work Based Learning sectors
3. University Students
4. Postgraduate Students
5. Students following language skills courses, and receiving the WJEC accredited Language Skills Certificate
6. Any other users or students that do not fall into any of the above categories
The Coleg Cymraeg Cenedlaethol respects your privacy and is committed to protect your personal data. This privacy notice sets out how we look after your personal data and tells you about your privacy rights, and how the law protects you.
It is important that you read this privacy notice along with any other privacy notice or fair processing notice we may provide at specific times, so that you can be fully aware of how and why we use your personal data. This privacy notice is in addition to any other notices prepared by us from time to time.
Controller
Y Coleg Cymraeg Cenedlaethol is the controller and is responsible for your personal data (y “Coleg”, "us" or "our" within this privacy notice).
We have appointed a data protection officer who is responsible for overseeing questions in relation to this privacy notice.
If you have any questions regarding this privacy notice, including any requests to exercise your legal rights, then you can contact our data protection officer using the contact details noted below.
Contact details: Data Protection Officer
Our full contact details are: Y Coleg Cymraeg Cenedlaethol, College Road, Carmarthen, SA31 3EQ
E-mail: cymorth@colegcymraeg.ac.uk
Phone: 01267 610400
You are entitled to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK’s regulatory authority for data protection matters (www.ico.org.uk). However, we would appreciate the opportunity to deal with your concerns before you approach the ICO so please contact us in the first instance.
Data Protection Principles
We will comply with data protection law. The legislation notes that the personal information we have about you should be:
1. Used legally, fairly and transparently.
2. Collected only for the valid purposes as explained clearly to you and not be used in any way that is incompatible with those purposes.
3. Relevant to the purposes that we have outlined to you and limited to those purposes only.
4. Accurate and as up to date as possible.
5. Retained only for as long as necessary, for the purposes we have informed you about.
6. Stored securely.
Changes to this privacy notice and your responsibility to inform us of any changes
It is important that the data we hold about you is accurate and up to date. Please inform us if your personal data changes during your relationship with us.
The data we collect about you
Personal data, or personal information, means any information about an individual that the person can be identified from. It does not include data where personal details have been removed (anonymous data).
We may collect, use, store and share different kinds of personal data about you, for example:
- Your Personal Details include first name, surname, marital status, title, date of birth and gender.
- Contact Data includes billing address, home address, e-mail address and phone numbers.
- Financial Data includes bank and payment card details.
- Discussion Data includes information about payments to and from you and other details relating to the products and services you have bought or that you receive from us.
- Profile Data includes your username and password, purchases or requests made by you, your interests, preferences, feedback and survey responses.
- User Data includes information about how you use our services.
- Marketing and Communication Data includes your preferences when receiving marketing materials from us or third party and your communication preferences.
- Sensitive Personal Data includes information about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political beliefs and information about your health data.
We also collect, use and share Collective Data such as statistical data or demographics for various purposes. The Collective Data may stem from your personal data, but it will
not be considered as personal data by law as this data does not disclose your identity directly or indirectly. For example, we may combine your User Data to calculate the percentage of students or users that use a specific feature on the website. However, if we combine or link Aggregated Data with your personal data where it is possible to identify you either directly or indirectly, we will treat the collective data as personal data that will be used in line with this privacy notice.
If you do not provide personal data
Where it is necessary for us to collect personal details by law, or under the terms of a contract we have with you, and if you fail to provide those details when requested, we may not be able to fulfil the current or prospective contract we have with you (for example, to provide you with a scholarship). In this case, we may have to cancel the service you receive from us. We will advise you if this is the case at that time.
How is your personal data collected?
We use different methods to collect data from you and about you, including through:
- Direct interaction. You can give us your [Personal details, Contact Data and Financial Data] by completing forms or by communicating with us by post, over the phone, e-mail, on our website, or otherwise. This includes personal data provided by you when you:
- apply for our services (including scholarships);
- create an account on our website;
- subscribe to our services or publications;
- join the Coleg
- request marketing materials to be sent to you;
- take part in a competition, research or survey; or
- give us feedback.
- from third parties or publicly available sources such as:
- Contact Data, Financial and Transaction Data from technical services providers, payments and provision.
- Personal details and Contact Data from data brokers or aggregates.
- Personal details and Contact Data from publicly available sources such as Companies House and the Electoral Role.
How we use your personal data
We will only use your personal data when the law allows us to do so. Most commonly, we will use your personal data in the following circumstances:
- Where necessary so that we can fulfil the contract we are about to start with you or that you have joined.
- Where necessary for our legitimate interests (or those of a third party) and in situations where your interests and basic rights override those interests
- Where we need to comply with a legal or regulatory obligation.
In general, we do not depend on permission as a legal basis for processing your personal data. If, in the future, we require your permission to process your personal data, we will contact you to request your permission whilst providing a full explanation of the reasons that we believe that we need your permission to process your data.
The purposes for which we will use your personal data
We have noted below, in table format, a description of the ways in which we intend to use your personal data, and which legal bases we rely upon to do so. We have also noted our legitimate interests where appropriate.
Please note that we can process your personal data in more than one legal area, depending on the specific purpose for which we use your data. Please contact us should you require information regarding the specific legal area we rely on to process your personal data where more than one area is noted in the table below.
The following terms are used in the table below:
- Legitimate Interest means the interests of our business in running and managing our business to enable us to provide the best service / product and the best and safest experience to you. We ensure that we consider and balance any potential effect on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for any activities where the effect on your interests is substantial (unless we have your permission or otherwise where it is required or by law). You can receive further information about how we assess our legitimate interests against any potential effect on you by contacting us.
- Contract Performance involves processing your data where necessary to deliver the contract you are currently part of, or during the application process before or as you agree to be part of such a contract.
- Complying with a legal or regulatory obligation means processing your personal data where necessary in order to comply with a legal or regulatory obligation we are subject to.
| Purpose / Activity | Type of data | Lawful basis for processing including a valid interest basis |
| To register you as a student / user | (a) Personal details (b) Contact |
Contract performance with you |
| To manage our relationship with you including: (a) To inform you of any changes to our terms or privacy policy (b) Ask you to leave a review or complete a survey (c) give you access to the Porth and the Coleg’s Library |
(a) Personal Details (b) Contact (c) Profile (ch) Marketing and Communication |
(a) Contract performance with you (b) Necessary in order to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records up to date and to study how our students / users use our services) |
| In order to enable you to compete for awards, scholarships, to compete or complete a survey | (a) Personal Details (b) Contact (c) Profile (ch) User (e) Marketing and Communication |
(a) Contract performance with you (b) Necessary for our legitimate interests (to review student education patterns to enable the Coleg to target funding and time to extend the provision where necessary) |
| To administrate and protect the Coleg and this website (including problem solving, data analysis, systems testing and maintenance, support, reporting (and maintaining data) | (a) Personal Details (b) Contact |
(a) Necessary for our legitimate interests (for running our institution, providing services, administration and IT, network security, to prevent fraud and in the context of institutional restructuring) (b) Necessary in order to comply with a legal obligation |
| To provide relevant web content and adverts for you and measure or understand the effectiveness of the adverts we provide for you | (a) Personal Details (b) Contact (c) Profile (ch) User (e) Marketing and Communication |
Necessary for our legitimate interests (to study how our students / users use our services, to develop them, to promote Welsh medium education and to guide our marketing strategy) |
| To use data analyses to improve our services, marketing, relationships and the experience of our students / users | (a) User | Necessary for our legitimate interests (to define types of students / users of our services, to promote Welsh medium post-16 education and to guide our marketing strategy) |
| To make suggestions and recommendations for services that could be of interest to you | (a) Personal Details (b) Contact (c) User (ch) Profile |
Necessary for our legitimate interests (to develop our services and to promote Welsh medium post-16 education) |
| To publish the name of your Secondary School or Further Education College on the honours list of the Coleg’s Scholars | (a) Name (b) Secondary School or Further Education College |
Necessary for our essential interests of promoting Welsh medium post-16 education. |
How we use particularly sensitive personal information
There are “special categories" of particularly sensitive personal information which require a higher level of protection. We need further justification for collecting, storing and using this kind of personal information.
We can process special categories of personal information under the following circumstances:
1. Under limited circumstances, with your specific permission.
2. Where necessary for the benefit of the public, such as equal opportunities monitoring.
Less commonly, we can process this kind of information where necessary in relation to legal claims or where needed in order to protect your interests (or the interests of
others) and that you cannot give your permission, or where you have already made the information public.
Promotional offers from us
We may use your Personal Details, Contact, User and Profile Data to form an opinion on what we think you would like to receive, or need, or what could be of interest to you. This is how we decide which products, services and offers could be relevant to you, and contact you to inform you of them. You will receive marketing communications from us if you have asked for information from us or if you gave us your details when you competed or registered with us.
Opting out
You can ask us or a third party such as one of the universities, or Cronfa William Salesbury to stop sending you marketing messages at any time by contacting us at any time.
If you opt out of receiving these marketing messages, this will not be relevant to the personal data provided to us as a result of the fact that you continue to use our services.
Change of purpose
We will only use your personal data for the purposes for which it was collected, unless it can be reasonably considered that we need to use it for another purpose and that it is compatible with the original purpose. If you would like an explanation regarding how processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for another purpose, we will inform you and explain the legal basis that allows us to do so.
Please note that we can process your personal data without your knowledge or permission, in line with the above rules, where required or allowed by law.
Disclosure of your personal data
We will have to share your personal data with the parties noted below for the purposes noted in the table in paragraph 3 above.
| To introduce you to the universities, including their tutors, lecturers and Coleg Cymraeg Cenedlaethol liaison officers employed by them | (a) Personal Details (b) Contact (c) Discussion (d) Marketing and Communication |
(a) Contract performance with you (b) Necessary for our legitimate interests (promoting and facilitating your access to Welsh medium education) |
| Welsh Joint Education Committee (WJEC) | (a) Personal Details (b) Contact (c) Discussion (d) Personal Details |
(a) Necessary for our legitimate interests (recording your success in receiving the Coleg’s Language Skills Certificate) |
| The Coleg’s Teaching Area Service Providers | (a) Personal Details (b) Contact Details |
(a) Contract performance with you (b) Necessary for our legitimate interests (promoting and facilitating your access to Welsh medium education) |
| Work placement settings or educational partners involved with joint provision | (a) Personal Details (b) Contact Details |
(a) Contract performance with you (b) Necessary for our legitimate interests (promoting and facilitating your access to Welsh medium education) |
| Welsh Government | (a) Personal Details (b) Contact Details (c) User (d) Profile |
(a) Contract performance with you (b) Necessary for our legitimate interests (as they are responsible for our funding and so we need to report on statistics / successes) |
| External Technology Companies, including IT and HR Companies | (a) Personal Details (b) Contact Details (c) Discussion (d) Marketing and Communication (e) User (f) Profile |
(a) Contract performance with you (b) Necessary for our legitimate interests (promoting and facilitating your access to Welsh medium education and work) |
| Employers or education providers you have been in contact with | (a) Personal Details (b) Contact Details |
(a) Contract performance with you (b) Necessary for our legitimate interests (promoting and facilitating your access to Welsh medium education and work by confirming your qualifications |
| Plagiarism service providers | (a) Personal Details (b) Contact Details (c) Discussion (d) User (e) Profile |
(a) Contract performance with you (b) Necessary for our legitimate interests (promoting and facilitating your access to Welsh medium education and work and ensuring that standards are maintained) |
| Scholarship providers, be they charities such as Cronfa William Salesbury or educational institutions | (a) Personal Details (b) Contact Details |
(a) Contract performance with you (b) Necessary for our legitimate interests (promoting and facilitating your access to Welsh medium education and work) |
| Professional advisers (acting as processors or co-controllers) including solicitors, bankers, auditors and insurers | (a) Personal Details (b) Contact Details (c) Financial Data |
(a) Contract performance with you (b) Necessary for our legitimate interests in order to run the institution efficiently |
| HM Revenues and Customs, regulators and other authorities that act as processors or co-controllers based in the UK that we will need to report processing activities to under some circumstances. | (a) Personal details (b) Contact details (c) Financial data |
(a) Contract performance with you (b) Necessary for our legitimate interests in order to run the institution efficiently |
| Third parties with which we could choose to transfer or merge our assets. Otherwise, we may merge with other institutions. If a change happens to our institutions, the new institution can use your personal data in the same way as noted in this privacy notice. | (a) Personal details (b) Contact details (c) Financial data (d) Profiling Data (e) Discussion (f) User |
(a) Necessary for our legitimate interests in order to run the institution efficiently |
We make it compulsory for all third parties to respect the security of your personal data and to deal with it in line with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only allow them to process your personal data for specific purposes in line with our instructions.
International transfers
We do not transfer your personal data outside the European Economic Area (EEA)
Data protection
We have implemented suitable security measures to stop your data being lost, used or used in an authorised way, amended or disclosed accidentally. In addition, we limit access to your personal data to workers, agents, contractors and other third parties that have a business reason to know about it. They will only process your personal data on our instruction and they are subject to a duty of confidentiality.
We have implemented procedures to deal with any suspected breach in personal data rules and we will inform you and any other relevant controller of any breach of personal data rules where we are required to do so by law.
Data retention
How long will you use my personal data?
We will only retain your personal data for as long as necessary to fulfil the purposes for which the data was collected, including to satisfy any legal, accounting or reporting purposes.
In order to determine the appropriate retention period for personal data, we consider the sum, nature and sensitivity of the personal data, the potential risk of harm that may arise from using or disclosing your personal data without your authorisation, the purposes for which we process your personal data and if there is a way of achieving that purpose by other means, and the relevant legal requirements.
By law, we must retain basic information about our customers (including Contact Details, Personal, Financial and Discussion Data) for six years.
In some circumstances, you can ask us to remove your data:
In some circumstances, we may anonymise your personal data (so that it can no longer be linked to you) for research or statistical purposes, and if so, we may use this information for an indeterminate amount of time without further notice to you.
Your legal rights
In some circumstances, you have rights under data protection laws in relation to your personal data.
You have the right to:
- Request access to your personal data (commonly referred to as “data access request”). This enables you to receive a copy of the personal data we have about you and to check that we are processing it legally.
- Request to amend the personal data we hold about you This enables you to correct any incomplete or inaccurate data we have about you, although we may need to check the accuracy of the new data provided by you.
- Request to delete your personal data. This enables you to request to delete personal data where there is no good reason for continuing to process it. You also have the right to request that we delete your personal data where you have exercised your right to refuse processing (see below), where perhaps we would have processed your data illegally or where you have asked us to delete personal data to comply with local law.
Please note however that we will not always be able to comply with your request for specific legal reasons and we will inform you, if this is relevant, at the time of the request. - Object to processing your data where we rely on a legitimate interest (or those of a third party) and something about your specific circumstances make you want to object to the processing of data on this basis and that you feel it affects your basic rights and freedom. You also have the right to object where we process your personal data for direct marketing purposes. In some cases, we may show that we have a strong lawful foundation to process your information that overrides your rights and freedom.
- Request to limit how your personal data is processed. This enables you to ask us to stop processing your personal data in the following scenarios: (a) if you want us to establish the accuracy of the data; (b) where our use of the data is unlawful but that you do not wish us to remove it; (c) where it is necessary for us to hold the data even though we no longer need it as it will be needed by you to establish, exercise or protect legal rights; or (ch) that you have objected to the use of your data but that we need to check if we have a legal basis to use it which overrides your objection.
- Request to transfer your personal data to you or a third party. We will provide your personal data in a structured format which is commonly used, and is readable on paper, to you or a third party of your choice. Please note that this right is only relevant to automatic information you gave us permission to use in the first place, and that has been used to fulfil a contract with you.
- Revoke your permission at any time where we rely on permission to process your personal data. However, this will not affect the legality of any processing undertaken before revoking your permission. If you revoke your permission, we may not be able to provide some of our products or services to you. We will advise you if this is the case at the time you revoke your permission.
If you would like to exercise any of the rights noted above, please contact us.