Formal Complaints - Privacy Notice

This page sets out our privacy notice concerning formal complaints and how we process them. It explains how we comply with General Data Protection Regulation (GDPR) regulations.

In accordance with General Data Protection Regulation (GDPR) which came into force on 25 May 2018, this notice sets out how Careers Wales processes data in relation to a formal complaint.

Data Controller

Career Choices Dewis Gyrfa Ltd trading as Careers Wales is the data controller for the personal data we process. We are registered as a data controller with the Information Commissioner’s Office (ICO), registration number: Z276256.

Purpose

The purpose of this privacy notice is to provide information about how we use, collect and share the data that we collect when you make a formal complaint or provide feedback, in accordance with our formal complaints policy to allow individuals the opportunity to express dissatisfaction about the provision of any of our services.

Our lawful basis for processing personal data

Our lawful basis for processing personal information is:

Public Task, Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Complaints Standards Authority (CSA) Wales guidance
Section 46 Code of Practice FOI Act 2000

We rely on an additional lawful basis to process your Special Categories of Personal Data. The lawful basis is "Reasons of substantial public interest (with a basis in law)" meeting the condition in Schedule 1, Part 2 of the Data Protection Act 2018 as below:

(6) Statutory etc and government purposes.

Who and where we get the personal data from

We obtain the personal data directly from an individual who makes a formal complaint, or from a formal complaint made by another individual; either in person, on the telephone, written request or via our website. We are unable to process anonymous formal complaints.

The Categories of personal data we process

The personal data we process includes but is not exhaustive to the below:

Name
Contact details
Details of your complaint

This may also include special category data where this is relevant to the complaint.

Who we share personal data with

We will store your formal complaint on our management information system (MIS) against any record we hold of you. If we do not have your details on our MIS system we will create a record to store your formal complaint. In order to process your formal complaint, we will need to share your complaint internally to allow us to investigate claims within the complaint in order to provide a response.

After you have exhausted our internal complaints process you may choose to escalate your formal complaint to the relevant ombudsman. Should you decide to escalate a formal complaint we will share the information we have gathered with the ombudsman as required by the Public Ombudsman (Wales) Act 2019.

How do we keep your personal data safe?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those of our employees who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long do we keep your personal data?

We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting our data privacy team using the contact details set out below in the Further Information section.

Individual rights

Under GDPR, you have the following rights in relation to the personal information you provide, specifically you have the right:

To access a copy of your own data
For us to rectify inaccuracies in that data
To object to or restrict processing (in certain circumstances)
For your data to be ‘erased’ (in certain circumstances); and
To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection

The contact details for the Information Commissioner’s Office are Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 01625 545 745 or 0303 123 1113. Website: www.ico.org.uk

Further information

Careers Wales Data Protection Officer can be contacted in relation to data protection matters, by post at: Unit 4 Churchill House, 17 Churchill Way, Cardiff, CF10 2HH. Or e-mail: personal.data@careerswales.gov.wales