This page sets out our privacy notice concerning data we collect from users of our websites and how we process it. It explains how we comply with General Data Protection Regulation (GDPR) regulations.
In accordance with General Data Protection Regulation (GDPR) which came into force on 25 May 2018, this notice sets out how Careers Wales manages and shares information that we collect when you register or complete the quizzes available on the careerswales.gov.wales website.
The information in this notice will be kept under review to incorporate any further changes communicated by the Information Commissioner’s Office and updated versions will be available on our website careerswales.gov.wales.
The purpose of this notice is to allow us to be open, honest, and upfront about the purpose of why we collect your personal data, and also to identify the sources and type of data we receive from other organisations and how we share the data we hold. This will provide confidence that the personal data we hold is being used in the right way and your privacy is protected.
Data Controller
Career Choices Dewis Gyrfa Ltd trading as Careers Wales is the data controller for the personal data we process. We are registered as a data controller with the Information Commissioner’s Office (ICO), registration number: Z276256.
Purpose
The purpose of this privacy notice is to provide information about how we use, collect and share the data that we hold as a company when you interact with either careerswales.gov.wales website or workingwales.gov.wales website.
This notice covers the following areas:
1. Why we process the personal data
The purpose of processing personal data is to allow users of the website to access the services that we provide. Users can either log in to the website or access the website pages without registering to use the system. We only retain data linked to registered users who log onto our website. When you first register on the website we create a record on our management information database. All personal data entered on the website is allocated to your record. All our data is stored securely within the UK.
2. Our lawful basis for processing personal data
Our lawful basis for processing personal information provided when using our website is:
- Consent Article 6(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Individuals have the right to withdraw this consent at any time. You have the right to ask for all your personal record entry to be deleted from our database. We will remove your data as soon as practicable after receiving a deletion request.
3. Who and where we get the personal data from
For website records we only collect data directly from the user. This can be through the use of any of the contact forms on our contact us page, LiveChat (Webchat), surveys, booking appointments or completing the quizzes on the website.
4. The Categories of personal data we process
We collect the following information across our website:
Website registration
Personal information collected:
- Email Address
- First Name
- Last Name
The registration data is used to create a unique self-contained record within our database. We receive pupil data from schools as part of our public task requirement to provide pupils in school with careers advice and guidance. When we receive the pupil information we create a user registration on our website to allow pupils to access the website. Pupils can request that their website registration be deleted.
The website registration details are stored on an Azure Active Directory, B2C. Their privacy notice can be accessed by clicking on the link Microsoft Privacy Statement – Microsoft privacy.
Career Match Quiz, Buzz Quiz and the profile facility
All information provided during completion of these activities are stored against your user record on our management information database.
Third Party providers on the website
We provide a webchat service through a third-party provider, LiveChat. We collect this data under consent. When you access LiveChat we can see the IP address of your computer and we therefore know your location.
The personal information collected:
- Name
- Email address
- Date of birth
- Details of the chat
- IP Address
A copy of the chat transcript will also be stored on the LiveChat domain which is operated by Text Inc who are based in the USA. They comply with UK cross border data sharing laws. We are able to access your chat transcript for three months. At this point it is removed from our view. If you send a request to post@careerswales.gov.wales we are able to request that the transcription be deleted from the live chat environment. Once we have had confirmation of deletion, we will email you to confirm.
- Email Contact Form
- Name
- Location
- Status
- Narrative about the reason for requiring us to contact you
- Call Back
- Name
- Telephone number
- Email address
- Language
- Information about why you would like us to call you
When either of the above forms is submitted from the website the information is emailed to our LiveChat corporate account so that we can allocate your request to one of our staff to respond. We are able to view the request for three months. At this point it is removed from our archive store. If you wish to have your details deleted from the LiveChat domain send a request to post@careerswales.gov.wales. When we receive confirmation of deletion, we will email you to confirm.
Booking Appointments
See our separate privacy policy available on the booking appointment website page.
Cookies
We use cookies to store information about how you use the careerswales.gov.wales website, such as the pages you visit. These cookies are not used to identify you personally. By setting the cookie preferences you can decide which non-essential cookies you are happy for us to use. You can clear and manage cookies in your browser settings. Our cookies policy can be accessed by the Cookies webpage.
5. Who we share personal data with
We will only share data that is collected from our website for research and evaluation and statistical reporting purposes. We will only provide the research and evaluation companies data for a specific purpose and for a limited time period, after which the research or evaluation company must confirm that the data has been destroyed. Data will be shared with third party providers such as LiveChat.
6. How do we keep your personal data safe?
We have appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those of our employees who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. We undertake external security assessments annually.
7. How long do we keep your personal data?
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting our data privacy team using the contact details set out below. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes or for reporting information to our funders in which case we may use this information indefinitely without further notice to you. You can request that all data we hold from your website activity be deleted.
8. Individual rights
Under GDPR, you have the following rights in relation to the personal information you provide. Specifically you have the right:
- To access a copy of your own data
- For us to rectify inaccuracies in that data
- To object to or restrict processing (in certain circumstances)
- For your data to be ‘erased’ (in certain circumstances)
- To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection.
The contact details for the Information Commissioner’s Office are Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 01625 545 745 or 0303 123 1113. www.ico.org.uk
9. Further Information
Careers Wales Data Protection Officer can be contacted in relation to data protection matters, by post at: Unit 4 Churchill House, 17 Churchill Way Cardiff CF10 2HH, or email: personal.data@careerswales.gov.wales