This page sets out our privacy notice concerning customer research and evaluation activities. It explains how we comply with General Data Protection Regulation (GDPR) regulations.
In accordance with General Data Protection Regulation (GDPR) which came into force on 25 May 2018, this notice sets out how Careers Wales manages and shares information used for internal and external research purposes. We carry out research and evaluation activities to understand customer experiences, assess the effectiveness of our services, improve service delivery, support evidence-based decision making, demonstrate value for money, and meet our public accountability obligations. This processing is necessary for the performance of tasks carried out in the public interest and the exercise of our official functions.
The information in this notice will be kept under review to incorporate any further changes communicated by the Information Commissioner’s Office (ICO) and updated versions will be available on our website careerswales.gov.wales.
Purpose
The purpose of this notice is to allow us to be open, honest, and upfront about the purpose of why we collect your personal data, and also to identify the sources and type of data we receive from other organisations and how we share the data we hold. This will provide confidence that the personal data we hold is being used in the right way and your privacy is protected.
Why are we contacting you?
We may invite you to take part in surveys, interviews, focus groups, consultations, or other research activities to help us understand customer experiences and improve our services.
Research may be carried out:
- us using our own staff, through telephone or email
- By a third-party research organisation acting on our behalf
We may provide your name and contact details to an appointed research provider solely for the purpose of conducting customer research on our behalf. The research provider acts as our data processor and is contractually prohibited from using your information for any other purpose, including marketing. They must delete or return the information once the research project has been completed.
Do I have to take part?
Participation in surveys, interviews, focus groups or other research activities is voluntary.
You may:
- Decline to participate
- Skip questions you do not wish to answer
- Withdraw from the research at any time before analysis has been completed
Choosing not to participate will not affect any service you receive from us.
1. Our lawful basis for processing personal data
We process personal information for customer research and evaluation under:
UK GDPR Article 6(1)(e) – Public Task
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the organisation, where special category data is processed, Article 9(2)(j) UK GDPR (Research and Statistical Purposes). Appropriate safeguards are applied to protect individuals' rights and freedoms.
Research and evaluation help us:
- Assess whether our services are achieving their objectives
- Understand customer experiences and outcomes
- Improve service quality and accessibility
- Inform policy development and decision-making
- Meet accountability and reporting requirements
2. Who and where we get the personal data from
We may obtain your information:
- Directly from you when you use our services
- From records held by our organisation relating to services you have received
- Other public sector bodies
- From a third-party research provider acting on our behalf under a written contract
Where a research provider is engaged, they are required to process your information only in accordance with our instructions and applicable data protection legislation.
3. The categories of personal data we process
We process the following categories of data relating to research and evaluation:
- Name
- Contact details (email address, telephone number, postal address)
- Customer reference numbers
- Information about services you have used
- Demographic information where relevant to the research
- Your feedback, opinions and experiences
- Recordings or interview notes (where you have been informed this will occur)
We will only collect information that is necessary for the research purpose.
4. Who we share personal data with
Your information may be shared with:
- Approved research organisations acting on our behalf
- Professional advisers where necessary
- Regulators, auditors or oversight bodies where required by law
We do not sell personal information. Any third-party research organisation must comply with UK GDPR, the Data Protection Act 2018 and our contractual requirements.
5. How do we keep your personal data safe?
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those of our employees who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
6. How long do we keep your personal data?
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting our data privacy team using the contact details set out below. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes or for reporting information to our funders in which case we may use this information indefinitely without further notice to you.
7. Individual rights
Under GDPR, you have the following rights in relation to the personal information you provide. Specifically you have the right:
- To access a copy of your own data
- For us to rectify inaccuracies in that data
- To object to or restrict processing (in certain circumstances)
- For your data to be ‘erased’ (in certain circumstances)
- To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection
The contact details for the Information Commissioner’s Office are Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 01625 545 745 or 0303 123 1113. www.ico.org.uk
8. Further information
Careers Wales Data Protection Officer can be contacted in relation to data protection matters, by post at, Unit 4 Churchill House, 17 Churchill Way Cardiff CF10 2HH or Email, personal.data@careerswales.gov.wales