Privacy notice relating to the processing of personal data by the South East Wales Corporate Joint Committee (SEWCJC)

South East Wales Corporate Joint Committee

The South East Wales Corporate Joint Committee (SEWCJC) is known as Cardiff Capital Region (CCR), but the SEWCJC is the legal entity and remains the data controller and the responsible statutory body.

The Cardiff Capital Region comprises the 10 local authority areas covering South East Wales – Blaenau Gwent; Bridgend; Caerphilly; Cardiff; Merthyr Tydfil; Monmouthshire; Newport; Rhondda Cynon Taf; Torfaen; and Vale of Glamorgan. Brecon Beacons National Park Authority is also a member in relation to Strategic Development Planning

For more detail regarding the governance of SEWCJC, see the Governance Privacy Notice.

About this privacy notice

This privacy notice is intended to provide information about how the SEWCJC will use (or ‘process’) personal data about individuals for the purpose of undertaking the day-to day business of the SEWCJC.

The Data Controller

The SEWCJC is the controller for the personal data it processes.

The SEWCJC is registered with the ICO as a controller under registration number ZB295457.

How to contact us for data protection matters or concerns

You can contact us by phone, email and post as follows:

Email us: InfoRights@cardiffcapitalregion.co.uk

Write to us at: Cardiff Capital Region, Data Protection Officer, Sbarc|Spark, Maindy Road, Cardiff, CF24 4HQ

You can also complain to the ICO if you are unhappy with how we have used your personal data, but we encourage you to contact us first.

The Data Protection Officer

RCTCBC provides a data protection support service to the SEWCJC, including the provision of a Data Protection Officer (DPO).

We encourage you to contact the SEWCJC in the first instance regarding any data protection matter. However, should you have the need to contact the Data Protection Officer directly, you can do so via email at Information.management@rctcbc.gov.uk

We recommend, when contacting the DPO, you send a copy of the correspondence to the SEWCJC as the data controller InfoRights@cardiffcapitalregion.co.uk

Whose personal data we process

We process personal data relating to:

  • Consultees
  • Prospective and current employees
  • Individuals attending training and events
  • Businesses who are Sole Traders
  • Correspondence with members of the public

The categories of personal data we process

We process the following categories of personal data:

  • Personal details – name, address
  • Contact details – telephone number, email address.
  • Education details – qualifications and work experience (when managing job applications)
  • Health information – dietary requirements, accessibility requirements (to accommodate diet and provide reasonable adjustments for attendance at an event or meeting

Why we process the personal data

We process the personal data in order to fulfil our statutory obligations relating to the day-to-day functions of SEWCJC. This includes but is not limited to the following activities:

  • Managing applications or enquiries related to funding programmes
  • Managing applications for employment and skills related programmes
  • Responding to requests for information (e.g. Freedom of Information, Data Protection)
  • Undertaking surveys
  • Undertaking consultations
  • Corresponding in respect of public meetings
  • Reviewing and responding to Complaints and feedback
  • Sending communications and newsletters to individuals who have signed up to receive these

Our lawful bases for processing the personal data

Under the General Data Protection Regulation (GDPR), our lawful bases for processing personal data to undertake our statutory functions is:

  • Consent (a): The data subject has given consent to the processing of his or her personal data for one or more specific purposes
  • Performance of a Contract (b): Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal Obligation (c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Public Task – Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • Substantial public interest – Article 9 (2) (g) – processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The lawful basis for processing special categories of data is as follows:

  • Article 9(2)a: The data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where domestic law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject.

The primary legislation, regulations and guidance that supports this includes:

Who or where we get the personal data from

We may receive the personal data from the following individuals or organisations:

  • Consultees
  • Funding applicants
  • Individuals attending training or events
  • Employees of SEWCJC
  • Business contacts
  • Members of the public requesting information from us

Who we share the personal data with

The SEWCJC works with a number of trusted partners, agencies, business, suppliers and contractors. We only share personal data with third parties in limited circumstances, where there is a business need to do so, for example:

  • when running collaborative projects with external organisations.
  • to manage the Venture Graduates scheme.

Should we anticipate such activity we will inform you at the point we collect information from you or at the nearest possible opportunity.

Data Processors

A data processor is a company or organisation that processes personal data on behalf of a controller. The SEWCJC uses data processors that provide services to us. The categories of data processors we use are:

  • Human Resources Services
  • Payroll Services
  • Insurance Arrangements and Services
  • Data Protection Support Services
  • Finance and Procurement Services
  • ICT Services and Support Providers
  • Venture Graduate Programme Partner Organisations

Our data processors act only upon our instruction – they cannot do anything with your personal data unless we have instructed them to do it. They will not share your personal information with any organisation apart from us or use it for their own purposes. They will hold it securely and retain it for the period we instruct.

Should you have a specific query relating to our data processors, please contact InfoRights@cardiffcapitalregion.co.uk

How long we retain the personal data

We will retain your information in line with the period outlined at the time the data is collected and only for as long as it is necessary to do so.

Legislation tells us how long we need to keep some information.

Your data protection rights

Under data protection law, you have rights we need to make you aware of. The right available to you depend on our reason for processing the information.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this right on the ICO’s website.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances. You can read more about this right on the ICO’s website.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right on the ICO’s website.

Your right to object to processing

You have the right to object to processing if we are able to process your information because the process forms part of our public tasks or is in our legitimate interests. You can read more about this right on the ICO’s website.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering a contract and the processing is automated. You can read more about this right on the ICO’s website.

You are not required to pay any charge for exercising your rights. We have one month to respond to your request from the date your request is validated. We may extend this period by a further two months if the request is complex or we receive a number of requests from you.

Please contact the Data Protection lead if you wish to make a request.

Your right to make a data protection complaint

You have the right to complain to the SEWCJC if you believe we have not handled your personal data responsibly and in line with good practice.

If you have a concern, we encourage you to contact the Data Protection Lead in the first instance. Most concerns can be resolved relatively quickly through a simple phone call or email. Should you wish to make a formal complaint please refer to the Complaints Policy on our website or contact Feedback@cardiffcapitalregion.gov.uk

You can also complain to the ICO if you are unhappy with how we have used your data, but we encourage you to contact us first. The ICO’s contact information is:

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk

Skip to content